What atproto-acl reads and keeps

What the service reads

When you ask for a preview, the service reads your ATProto account identity, PDS, configured Timeline or Discover samples, account relationships, moderation state, and observations from the publishers your policy names. Requests go to your ATProto PDS, the Bluesky AppView when a selected feed requires it, and the selected observation publishers.

What the service stores

The service stores your DID, handle, display name, PDS, server-side OAuth credentials and DPoP material, policies and exceptions, saved post URI/CID exposure references, label evidence, observed mute state, previews, approvals, action outcomes, admission records, and operational timestamps. Saved feed evidence contains identifiers and provenance; atproto-acl does not retain sampled post bodies.

Why it is stored

This information is used to build the previews you request, bind approval to an exact account and policy revision, execute only approved actions, reconcile uncertain outcomes, preserve mute-ownership history, recover work after restart, and prevent one user from seeing another user’s records.

How long it remains

Policies, action history, approved-preview evidence, and mute-ownership records remain until you delete your data. Unapproved previews and measurements expire after 30 days. Live data is removed promptly after deletion can safely complete. Ordinary backup copies expire within 30 days.

Deletion and backups

Deleting atproto-acl data does not automatically unmute accounts. You can leave existing Bluesky mutes unchanged, or review releases first and then delete. Pending actions are cancelled or refused before deletion.

To prevent an older backup from restoring deleted account data, the service keeps a keyed deletion tombstone outside ordinary backups for 31 days. It contains a keyed, non-reversible account identifier plus deletion and expiry times. Every restore reapplies retained tombstones before the service accepts traffic.

Disconnect is different

Disconnect revokes this app’s connection and prevents further execution. It keeps policies, history, approved evidence, and ownership records so you can reconnect later. Existing Bluesky mutes remain.

Contact

For privacy questions or ordinary support, message @neutral.zone on Bluesky. Security reports should use GitHub private vulnerability reporting.