The analyzer reads public Bluesky data. Connecting an account lets the service store and manage the data described below. Technical connection data is also processed to deliver and protect the service.
Data controller
The controller of personal data processed by Blue Horizons is Gaspare Bitetto.
Postal address: Via Rea Silvia, 8 - 00181 - Roma (Italia)
Email: webmaster@pudgycat.io
Using the analyzer without an account
The service is operated from Italy. Its production server is hosted by Hetzner in Germany. Other providers described in this policy may process data elsewhere.
Public analyses cache profiles, connections, public posts and interaction references. The activity summary walks the available public history; deleted or inaccessible records cannot be reconstructed. Results are reused for 24 hours. Collection checkpoints allow interrupted work to resume; they are cleared when the job finishes. Resource limits can leave a collection unavailable rather than complete.
Rate limiting keeps a short-lived, in-memory count of requests per IP address. It is never written to disk and disappears when the process restarts.
Connecting a Bluesky account
If you sign in and connect an account, we store:
- Your identity on the network, your DID and handle.
- An access credential. A revocable OAuth token, issued when you approve access on Bluesky. It is the only way to connect a new account, and you can withdraw it from your Bluesky settings at any time. Accounts connected before that was true still work on the app password they were connected with, held the same way and deleted by the same button. The token, its refresh token and the key that signs our requests are all encrypted at rest with AES-256-GCM.
- A cached copy of your follow graph, who you follow, who follows you, and the public profile fields the network publishes about them: handle, display name, avatar, bio, follower and post counts, whether Bluesky reports them as verified, the languages their recent posts are tagged with, and when they last posted. Plus when you followed them, and a record of the moments people followed you or stopped following you, which is what the “unfollowed you” list is built from. That record is kept for at least six months and then deleted; on the top plan, which offers the full history, it is kept for as long as the account is connected. Disconnecting deletes it either way.
- Posts, replies and reposts you read, their metadata and the record of deletions, plus protected accounts, saved searches and temporary search results.
- Your action log, the follows and unfollows you ran through the tool. It is what enforces the rate budget and what makes undoing a run possible; it is not shown as a feed anywhere in the app.
- A session cookie (
__Host-bh_session), HttpOnly and Secure, so you stay signed in. It is not used for advertising tracking and is not shared with anyone.
Disconnecting removes the account credential and associated data from the active database. It does not immediately erase existing backups, separate feedback messages or a Paddle subscription. Account deletion also removes your user account and sessions. You can revoke access in Bluesky settings.
For signed-in use, we store a cumulative visit count and the first and latest activity timestamps per user. A new visit begins after 30 minutes without foreground activity; linked accounts share the count. We do not store visited pages, typed content, individual interaction events or IP addresses in this counter, and it is not sent to advertising providers. Tracking starts when this feature is enabled; earlier visits are unknown. The aggregate is removed when the user account is deleted.
Activity, suggestions and saved preferences
Automatic suggestions use the connected account’s public topics and follow graph. Account-scoped results are reused for up to 30 minutes and removed with the connected account. Hiding suggestions is saved in this browser, separately for each account. Theme, language, saved topics and feedback preferences also use functional browser storage. These features do not add advertising cookies or send your private graph to an AI provider.
Activity dates can be missing, outdated or unavailable. Such accounts are not automatically treated as inactive. Likely bots combines public declarations and conservative activity/profile indicators; it is an uncertain indication, not proof or a moderation decision. Recommendations and scores do not guarantee results. Follow, unfollow and publishing actions require the applicable user choice.
Normal audience changes remain visible for 30 days on Basic, 180 on Pro and without a time cutoff on Max. The stored record is kept for at least 180 days and pruned during synchronization on finite plans; disconnecting removes it. Public automation observations expire after seven days and obsolete entries are removed during background maintenance.
Private account tools store directional follow protections, private labels and up to 20 observed handle entries per person. These data are isolated by connected account and removed from the active database on disconnect. Mute and block actions and their reversals are included in the action log.
The connected app also stores your private labels, follow protections and blacklist settings, observed moderation state, and cached public list membership. These belong to the connected account and are removed when it is disconnected. Labels and local protection choices are not published as Bluesky records.
Daily audience totals can be retained after individual relationship events expire. They contain counts rather than the departed accounts and are removed from the active database when you disconnect the account.
We also keep the DIDs of accounts you unfollowed through the app or whose removal was observed during a complete sync, for as long as your account remains connected, independently of visible history retention. Older, unobserved removals cannot be reconstructed.
Top engagers
For connected accounts using activity details, we store public post references, interaction types, actor DIDs, handles, display names, avatars and collection checkpoints to build Top engagers. Collection starts when Overview opens and revisits public counters at most daily. Observations are deduplicated and kept until the account is disconnected; prior likes or reposts can remain after removal on Bluesky. We do not read private messages or notifications for these rankings. Data is isolated by connected account and removed from the active database on disconnect.
Schedule posts
We store draft text, links, image files and alternative text, scheduled dates, timezone, delivery state and publication references to carry out the publishing you request. Drafts and calendar history stay until you delete them or disconnect the account; deleting a plan does not delete published Bluesky posts. Daily quota records can outlive a deleted plan to prevent reusing spent slots.
Feedback
Reviews can include an optional rating from 1 to 5 stars and are linked to the account selected when sent. Only the Blue Horizons team can see them; they are not published automatically. Disconnecting that account removes the account link from the review, while the message and optional contact address remain subject to the retention rules below.
The feedback box inside the app stores what you wrote, the language the app was in, and the browser string your request carried. If you fill in the optional email field, that address is stored with the message, and it is used for one thing: answering you. It is not added to any list, and leaving it empty is a supported way to write to us.
Feedback is kept until it has been dealt with. Ask at the address below and it will be deleted sooner.
Payments
If you subscribe, the payment is handled by Paddle, who are the merchant of record: the checkout is theirs, the card details go to them and never to us, and they are the ones who charge the tax owed where you are. What they collect to do that, which is your email address, your country and the card itself, is held under their privacy policy, at paddle.com/legal/privacy.
The Paddle entity responsible for your purchase is identified at checkout and on your receipt.
What this service stores about a subscription is the identifier Paddle gives the customer, the identifier of the subscription, which plan it is for, whether it is active, and the dates it runs between. That is what the account screen reads to tell you what you have, and it is what decides which ceilings apply. There is no card number, no billing address and no tax number in this database.
Deleting your account removes that record along with everything else. It does not cancel a subscription, which only Paddle can do, so cancel first or write to us and we will make sure it is stopped.
Advertising
The public pages and the free plan show ads served by Google AdSense; it is part of what pays for the service, and Pro and Max disable ads inside the app. Google may use cookies or similar technologies to serve and measure ads. If you are in the EEA, the UK or Switzerland you will be asked for consent through a Google-certified consent platform before any personalised advertising cookie is set, and you can change or withdraw that choice at any time from the link in the footer of the consent notice. Ad delivery depends on the applicable consent choices and Google’s eligibility rules; rejecting personalisation does not guarantee that an ad will be served.
Google’s own explanation of how it uses data from partner sites is at policies.google.com/technologies/partner-sites.
Analytics
We use Google Analytics 4 to count visits and see which pages people actually read. It runs on the public pages and inside the app. We look at it to decide what to build and what to write; we do not use it to build a profile of you, and we do not join it to your connected Bluesky account.
Concretely: the address of an analysis page carries the handle you are looking at, and that handle is not reported. Google is given the analyser page without it, and the page is set so the full address does not travel in the Referer header to the other services it loads either.
Analytics storage starts denied. With the current configuration, the tag can send cookieless requests before consent, so connection data including your IP address can reach Google. Google’s applicable privacy information describes its processing and international transfers. Cookie storage is subject to your consent choices.
You can opt out for every site with Google’s browser add-on, or refuse consent in the notice.
What we do not do
- No sale or rental of your data. The providers described above process data to deliver their services.
- No automatic following or direct messages.
- No advertising or analytics profile that follows you from here to other websites.
- No access to anything the AT Protocol does not expose publicly or that you did not explicitly authorise.
Legal basis and your rights
If you are in the EU/EEA: we process connected-account data to perform the service you asked for (Art. 6(1)(b) GDPR) and advertising data on the basis of your consent (Art. 6(1)(a)). You can access, correct, export or delete your data, use the account controls for deletion from the active service. Backups and separately submitted feedback are described above. For anything else, write to the contact address below.
You may also request restriction or object where applicable, withdraw consent and complain to your competent data protection authority. Personal-data rights do not depend on a paid plan.
Retention
- Public analysis cache: results are reused for 24 hours; expired entries are removed by periodic background maintenance.
- Connected account data: until you disconnect or delete the account.
- Who followed you and who stopped: at least six months, then deleted, whether or not you are still connected. On the plan that offers the full history it is kept while the account is connected, and goes with it when you disconnect.
- Feedback: until it has been dealt with, or sooner on request.
- Backups: up to 14 rolling snapshots, replaced as new snapshots are made.
Contact
Questions, or a data request: webmaster@pudgycat.io.
This policy may change as the product grows; the date at the top always reflects the current version.