Bluesky Privacy Policy

This document is Bluesky Social, PBC's privacy policy governing the collection, use, and sharing of personal data by the Bluesky microblogging application and website, with Bluesky acting as data controller as explicitly stated in the policy. The policy states that Bluesky collects account data (email, phone, birth date, images), usage data (IP address, device identifiers, browsing behavior within the app), direct messages (described as unencrypted and accessible for Trust and Safety purposes), and may collect biometric-adjacent data through third-party age verification services including facial age estimation and government ID verification. A structurally notable provision is the explicit statement that direct messages are unencrypted and can be accessed for Trust and Safety purposes, which diverges from the end-to-end encryption practices offered by some messaging platforms and creates a meaningful distinction users should understand; the policy also acknowledges the decentralized AT Protocol architecture means public posts are distributed across the network, potentially beyond Bluesky's direct control. The policy engages GDPR (referencing Standard Contractual Clauses for EEA transfers), UK data protection law, Brazil's LGPD, CCPA and other US state privacy laws, and COPPA-adjacent age verification obligations; the policy includes supplemental jurisdiction-specific notices and articulates legal bases for processing for jurisdictions that require such disclosure. Compliance teams should note the intersection of the AT Protocol's decentralized architecture with data deletion rights, as the practical enforceability of deletion requests against third-party nodes hosting federated content is not fully addressed in the document.