Privacy

In your own repository

The accounts you follow, your display preferences and your saved posts are written to your PDS, under social.blueweave.*. They are yours: they stay if you stop using Blueweave, and they are readable by anything that can read your repository.

On the server

• OAuth tokens, so you are not signed out on every deploy. Removed when you sign out, or when your PDS refuses them.
• A session identifier in an httpOnly cookie, mapped server-side to your DID. The cookie holds no identity of its own. Expires after 30 days.
• A short-lived cache of your feed and of the accounts fetched for it — 60 seconds for the feed, 15 minutes per source account. In memory, gone on restart.

What is not collected

No analytics, no third-party scripts, no advertising, no email address. The operator can see counts — how many people use it, how many accounts are followed — never who follows what, and never the content of a feed.

Requests leaving the server

Reading Mastodon and X means fetching public pages from the instances that serve them, from the server rather than from your browser. Those hosts see the server's address and the account being read — never yours.