Privacy Policy

What this app does

pronouns.blue is an AT Protocol app that lets you publish your names and pronouns directly to your own ATProto repository (your personal data server, or PDS). Your data belongs to you and lives in your repo — not on our servers.

Data we store

• Nothing server-side — we run no database. Your OAuth session is stored entirely in your browser as encrypted cookies (see below). When you sign out, those cookies are deleted.
• Names & pronouns — your names and pronouns are written directly to your PDS and read back on every page load. We never keep a copy.

Third-party services we contact

• Bluesky public appview (public.api.bsky.app) — used to resolve handles and search for users. This is a public, unauthenticated API.
• PLC directory (plc.directory) — used to look up the PDS endpoint for a given DID.
• Your PDS — all record reads and writes go to your personal data server, authenticated via OAuth.

Cookies

We set three httpOnly session cookies. They are never accessible to JavaScript and are never used for tracking.

• did — your ATProto DID, used to identify your login session.
• session — your OAuth tokens and DPoP private key, used to make authenticated requests to your PDS on your behalf. Expires after 30 days or when you sign out.
• oauth_state — temporary PKCE state during the sign-in redirect. Expires after 10 minutes automatically.

Data deletion

Sign out to delete your session cookies. Your name/pronoun records are stored in your own ATProto repo — delete them there (via your PDS, any ATProto client, or PDSLS) to remove them from your repo and from public view.

Contact

Questions or concerns? Open an issue on GitHub.