Privacy Policy

1. What We Collect

mootbase collects data in two ways: by indexing publicly available Bluesky data, and by receiving information you provide when you sign in and use the Service.

Public Bluesky data

We index the following from Bluesky's public AppView API (no authentication required on Bluesky's side):

• Bluesky handles and display names.
• Avatar image URLs (hotlinked from Bluesky's CDN; refreshed on rescan).
• Profile descriptions.
• Public post excerpts where the post contains an @-mention and attached media — the signal we use to infer a collaboration.
• Associated media URLs and external links from those posts.

Account data (signed-in users)

When you sign in with your Bluesky account, we store:

• Your Bluesky DID — the stable, persistent identifier for your account.
• Your Bluesky handle at the time of sign-in (updated on rescan).
• An internal user identifier generated by our authentication system.
• Instagram and/or X/Twitter handles you choose to add (self-reported, optional).
• Thumbs-up/down ratings you submit for collaborators.
• Self-reported capacity/role claims for your collaboration edges.
• Account creation and last-updated timestamps.
• Whether your account has been soft-deleted and the reason, if applicable.

Automatically collected data

Standard server logs (IP addresses, user-agent strings, request paths) are collected automatically by our hosting provider and error-reporting service. We do not build persistent profiles from this data.

2. How We Use It

We use the data we collect to:

• Build and display the public creator social graph.
• Authenticate you and maintain your session.
• Allow you to manage your profile, identities, capacity claims, and ratings.
• Rate-limit Bluesky scans and prevent abuse of the Service.
• Detect and address technical errors via error reporting.
• Measure aggregate site usage to improve the Service.

We do not sell, rent, or trade your personal data to third parties for advertising or marketing purposes. We do not use your data to train machine learning models or sell it to AI companies.

3. Bluesky and Public Data

Indexing publicly available social-media data for research and informational purposes is generally lawful in most jurisdictions, provided the data is not combined with sensitive categories of information or used to harm individuals. mootbase indexes only the public collaboration signals described above.

Bluesky deletion model: When a Bluesky user deletes their account or posts, Bluesky marks the relevant records as deleted or tombstoned. On mootbase's next scheduled rescan of an affected creator, we detect this upstream deletion and hide that creator's profile from all public views ("upstream-deleted" status). We aim to process upstream deletions promptly, though there may be a delay between the Bluesky deletion and the mootbase update.

If you have deleted your Bluesky account and your creator profile is still showing on mootbase, please send us a DM at @mootbase.com on Bluesky and we will remove it promptly.

4. Cookies

mootbase sets a single session cookie when you sign in. This cookie:

• Is HttpOnly — not accessible to JavaScript running in your browser.
• Has SameSite=Lax set to mitigate cross-site request forgery.
• Is session-scoped by default; it expires when you sign out or your session times out.
• Contains a session token, not personal data.

We do not set advertising cookies, tracking pixels, or third-party analytics cookies. If you are not signed in, no cookies are set by mootbase itself.

5. Analytics and Error Reporting

Vercel Web Analytics

We use Vercel Web Analytics, a privacy-preserving analytics product. It does not use cookies, does not collect personally identifiable information, and does not track you across sites. Aggregate metrics (page views, referrers, device types) are visible only to us.

Sentry (error reporting)

We may use Sentry for error reporting and performance monitoring. Sentry may collect your IP address, browser user-agent, the URL you were visiting, and a stack trace at the point of an error. This data is used solely to diagnose and fix bugs and is subject to Sentry's Privacy Policy. Error reporting is configurable and may be disabled in future settings.

6. Third-Party Services

mootbase relies on the following third-party services to operate:

• Bluesky AppView — We make read-only, unauthenticated HTTP requests to Bluesky's public API to fetch creator profiles and posts. No data about you is sent to Bluesky beyond what a normal browser request would include (IP address, user-agent).
• Vercel — Our hosting provider. Your requests are processed on Vercel's infrastructure. See Vercel's Privacy Policy.
• Neon (database hosting) — Creator graph data is stored in a Postgres database hosted by Neon. Data is encrypted at rest and in transit. See Neon's Privacy Policy.

We select service providers who offer reasonable data-protection standards, but we cannot guarantee the practices of any third party. This policy does not govern third-party privacy practices.

7. Your Rights

You have the following rights regarding your data:

• Delete your account — You can soft-delete your account at any time from your profile settings page. This hides your profile and blocks your DID from future sign-ins, as described in our Terms of Service.
• Data export — You can request a copy of your account data by sending us a DM at @mootbase.com on Bluesky. We aim to respond within 30 days.
• Correction — If you believe any information we hold about you is inaccurate, please contact us and we will investigate and correct it where possible.
• Opt-out of public indexing — If you have deleted your Bluesky account and your profile remains visible on mootbase, contact us for expedited removal. See Section 3 above.

Depending on where you live, you may have additional rights under applicable privacy laws (such as GDPR or CCPA). Please contact us to exercise any such rights.

8. Children

mootbase is not directed at children under 16 years of age, and we do not knowingly collect personal information from anyone under 16. If you believe we have inadvertently collected data from a child under 16, please send us a DM immediately at @mootbase.com on Bluesky and we will take prompt steps to delete that information.

9. Changes to This Policy

We may update this Privacy Policy periodically. For material changes — changes that meaningfully affect how we collect, use, or share your data — we will display a notice within the Service at least 30 days before the new policy takes effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

10. Contact

For privacy questions, data requests, or to report a concern, please send us a DM on Bluesky:

@mootbase.com on Bluesky

We aim to acknowledge all privacy-related requests within 5 business days and to resolve them within 30 days.