Privacy policy

Updated 2026-07-25

Short version: the free analyzer stores nothing about you. If you connect an account, we store what is needed to show and manage your follow graph, and deleting it is one button.

Using the analyzer without an account

When you analyze a handle we call Bluesky’s public API and cache the result for up to 24 hours so the page loads instantly for the next visitor. That cache contains only public profile data — handle, display name, avatar, follower counts — for the account that was analyzed. We do not store your IP address alongside it, and we do not build a profile of you.

Rate limiting keeps a short-lived, in-memory count of requests per IP address. It is never written to disk and disappears when the process restarts.

Connecting a Bluesky account

If you sign in and connect an account, we store:

• Your identity on the network — your DID and handle.
• An access credential. With “Sign in with Bluesky” this is a revocable OAuth token. If you use an app password instead, it is encrypted at rest with AES-256-GCM; we need it to be replayable because network sessions expire.
• A cached copy of your follow graph — who you follow, who follows you, their public profile fields, and when you followed them.
• Your action log — the follows and unfollows you ran through the tool, used to enforce the rate budget and to show you what happened.
• A session cookie (bh_session), HttpOnly and Secure, so you stay signed in. It is not used for tracking and is not shared with anyone.

Disconnecting the account deletes all of it — credential, graph and action log — immediately and permanently. You can also revoke our access from Bluesky’s own settings at any time.

Advertising

Blue Horizons is free because the public pages show ads served by Google AdSense. Google may use cookies or similar technologies to serve and measure ads. If you are in the EEA, the UK or Switzerland you will be asked for consent through a Google-certified consent platform before any personalised advertising cookie is set, and you can change or withdraw that choice at any time from the link in the footer of the consent notice. Without consent, ads are served non-personalised.

Google’s own explanation of how it uses data from partner sites is at policies.google.com/technologies/partner-sites.

What we do not do

• No selling, renting or sharing of your data.
• No posting, replying or messaging on your behalf.
• No analytics that follow you across other websites.
• No access to anything the AT Protocol does not expose publicly or that you did not explicitly authorise.

Legal basis and your rights

If you are in the EU/EEA: we process connected-account data to perform the service you asked for (Art. 6(1)(b) GDPR) and advertising data on the basis of your consent (Art. 6(1)(a)). You can access, correct, export or delete your data — the fastest route to deletion is the “disconnect account” button, which removes everything we hold. For anything else, write to the contact address below.

Retention

• Public analysis cache: up to 48 hours.
• Connected account data: until you disconnect or delete the account.
• Backups: rolling snapshots kept for at most 14 days, then overwritten.

Contact

Questions, or a data request: gaspare.bitetto@gmail.com.

This policy may change as the product grows; the date at the top always reflects the current version.