Privacy Policy

Version 1.1 · Published 19 August 2026 · Takes effect 19 September 2026

Part 1: Introduction

1. Welcome

This Privacy Policy explains how Stichting Modal ("Modal", "we", "us", "our") processes personal data when you use:

the Eurosky Personal Data Server (PDS), our infrastructure for hosting your AT Protocol identity and the data associated with it;
the Eurosky Portal, the front-end at portal.eurosky.tech for managing your Eurosky account;
mu, a social application by Eurosky for reading, posting, and following conversations across the open social web. mu is available in your web browser and as mobile applications for iOS and Android; this Privacy Policy covers all of them.

Stichting Modal is a non-profit foundation established under the laws of the Netherlands, registered at Kranenburgweg 135 A, 2583 ER The Hague (RSIN 868779465). For the purposes of the EU General Data Protection Regulation (GDPR), Stichting Modal is the data controller for personal data processed in connection with the operation of all three services.

This Privacy Policy is the companion to our Terms of Service, which sit at the same URL family and govern your use of the same three services. The Privacy Policy explains what we do with personal data; the Terms of Service explain what the services are and how you use them.

2. What this Privacy Policy covers, and which Parts apply to you

This Privacy Policy is organized in four Parts, mirroring the structure of our Terms of Service.

Part 1 (this Part) introduces the document.

Part 2 sets the common rules that apply to all processing across our services: who we are, the rights you have, our security and breach posture, our retention principles, our position on selling and profiling, international transfers, and how to contact us.

Part 3 covers personal data processed in connection with the Eurosky PDS and the Eurosky Portal. It applies to you if you have an Eurosky account.

Part 4 covers personal data processed in connection with mu. It applies to you if you use mu, regardless of where your account is hosted.

The three common user paths from the Terms of Service apply here too:

You have an Eurosky account and you do not use mu. Parts 1, 2, and 3 apply to your processing. Part 4 does not.
You have an Eurosky account and you use mu. Parts 1, 2, 3, and 4 all apply.
You use mu with an account on a different PDS provider. Parts 1, 2, and 4 apply. Part 3 does not, because we do not host your account.

3. What this Privacy Policy does not cover

This Privacy Policy does not cover:

the Eurosky marketing website, mailing lists, and general communications: a separate Privacy Policy applies at https://eurosky.tech/privacy;
the EU-HAUL migration tool, which is a separate Modal product with its own Terms of Service and Privacy Policy at https://move.eurosky.tech;
the processing carried out by other ATProto applications and PDS providers that you may use through your Eurosky account or alongside mu, which are governed by their own privacy notices.

The Eurosky marketing-site Privacy Policy is kept separate from this document because the marketing site has different data flows (mailing list, newsletter, donor data) and a different lawful-basis profile. We point you to it explicitly so you know where to find it.

Part 2: Common rules

Applies to everyone using any of our services.

4. Who we are and how to reach us

Data controller: Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands (RSIN 868779465).

Privacy contact: privacy@eurosky.tech.

Data Protection Officer (DPO): we have designated a Data Protection Officer in line with Article 37 of the GDPR. You can contact our DPO at dpo@eurosky.tech. Correspondence routed to that mailbox reaches the DPO directly.

Postal correspondence: Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands.

You also have the right to lodge a complaint with your local supervisory authority. As we are established in the Netherlands, the lead supervisory authority for cross-border processing is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live in another EU or EEA Member State, you can also complain to your own national authority.

5. The categories of personal data we process

Across our services we process the following broad categories of personal data. Parts 3 and 4 below set out the specifics for each service.

Identity and account data: your AT Protocol handle, your account identifier (DID), your profile information, and (for Eurosky-hosted accounts) the email and password you set during sign-up.
Age confirmation: for the Eurosky PDS and Portal, the record that you self-declared you are 16 or over at sign-up, with the date and source of that confirmation. For mu, your date of birth, which we collect at sign-up or sign-in and use to confirm you are 18 or over.
Content you create or receive: posts, profile fields, photos, videos, lists, direct messages, and feedback you send us.
Social graph data: your follows, followers, likes, and other relationships expressed through your account.
OAuth grants and app authorizations: the list of third-party applications (including mu) that you have authorized to act on your behalf via OAuth, the scopes you have granted them, and the timestamps of those grants.
Authentication metadata: sessions, last-login timestamps, login attempts, two-factor authentication setup where applicable, and email verification tokens.
Account recovery information: recovery email if different from sign-up email, recovery keys, and pending recovery actions.
Handle change history: if you change your handle, we keep a record of the previous handle for trust-and-safety, abuse-prevention, and federation reasons.
Service interaction data: the actions you take while using our services, including reports you submit, appeals you file, and interactions with our recommender feeds where applicable.
Account-state acknowledgements: records of your acceptance of these Terms, dismissal of in-product notices and banners, and similar acknowledgements needed to operate the services.
Technical and operational data: IP addresses (and the approximate geographic location they imply), user-agent strings, timestamps, server logs, OAuth flow state, and security and abuse-prevention signals.
Preferences and configuration: your settings within each service, such as language, theme, content filters, and feed selections.
Push notification data: if you enable push notifications in the mu mobile apps, the device push token issued by your platform provider and records of the notifications we send (see §22.8.1).
Crash and diagnostics data: crash logs and device diagnostics from the mu mobile apps, such as device model, operating system version, and the state of the app at the time of a crash (see §22.8.2).
Purchase confirmations: if you buy a paid feature or make a donation through an app store, the confirmation records the store passes to us; never your card or bank details (see §22.8.3).
Aggregated and de-identified analytics: as described in §22, mu uses privacy-preserving analytics that count visits, sessions, and aggregate patterns without identifying individual users.
Personal data we receive from third parties on your instruction: for example, when you migrate an account to us using a tool that transfers data on your behalf, or when an age-assurance vendor (where applicable, post-launch) returns a result of your age check.

We do not intentionally process special categories of personal data (Article 9 GDPR). We recognize that content you post may incidentally reveal such information, in which case our processing is limited to what is necessary to host and display the content you have chosen to make public, to apply moderation, and to comply with the law.

6. The lawful bases on which we rely

Under Article 6 of the GDPR, we rely on the following lawful bases. Parts 3 and 4 below indicate which lawful basis applies to which specific processing.

Performance of a contract (Article 6(1)(b)) to provide the services you have asked us to provide and to take steps at your request before entering into the contract.
Legitimate interests (Article 6(1)(f)) to operate, secure, and improve our services, to detect and prevent abuse, and to inform you of changes that affect you, where those interests are not overridden by your fundamental rights and freedoms.
Legal obligation (Article 6(1)(c)) to comply with EU and Member State law, including the Digital Services Act, the Terrorist Content Online Regulation, tax and accounting law, and lawful orders from competent authorities.
Vital interests (Article 6(1)(d)) in rare cases involving an immediate threat to life or safety.
Consent (Article 6(1)(a)) where the law requires consent for a specific processing activity, for example certain forms of marketing communication. Where we rely on consent, you can withdraw it at any time and we will stop the processing that depended on it.

We do not rely on consent for the core operation of the services, because Article 6(1)(b) and (f) cover those activities. We may rely on consent for specific optional features.

7. What we will never do with your personal data

These are negative commitments that apply across all our services.

We will never sell your personal data. Not your account information, not your content, not your interaction data, not any other personal data we hold.
We will never profile you for advertising purposes. We do not build advertising profiles of you. We do not sell or share data that would let anyone else profile you for advertising.
We will not train general-purpose AI models on your content without your separate, opt-in consent. We may use automated systems (including AI-based systems) to detect spam, abuse, and prohibited content, as described in §23.

8. International transfers

Personal data processed in connection with our services is hosted and processed in the European Union. We are committed to using only hosting providers that are headquartered in the EU and that operate from data centres located in the EU for the primary services (the Eurosky PDS, the Eurosky Portal, and mu's own servers). The specific providers change from time to time; the current list, by category, is published on the providers page of our Transparency Centre at eurosky.tech/transparency and updated when providers change.

In the course of operating, securing, and supporting our services, we may use ancillary tools and service providers (for example, for email delivery, error tracking, or operational support), some of which may be established outside the European Economic Area. Where personal data is transferred to a country outside the EEA as a result, we ensure that appropriate safeguards are in place in accordance with EU data protection law, including:

Standard Contractual Clauses approved by the European Commission;
adequacy decisions by the European Commission, where one exists for the destination country;
other measures permitted under Articles 46 to 49 of the GDPR.

The primary contents of your Eurosky PDS account, and the primary processing carried out on mu, are not transferred outside the European Union, except as a result of AT Protocol federation as described in §13.

Content delivery on mu may transit Bluesky's infrastructure during the appview transition. This is a material exception we want to flag separately. mu is switching from the appview (indexer) operated by Bluesky Social, PBC to an appview we run ourselves on EU infrastructure. Until the switch completes, the posts, profiles, follows, and other public records shown to you on mu may be fetched and served through Bluesky's appview in the United States, so your interactions and the content displayed to you may transit Bluesky's US-based infrastructure even where your account is hosted on the Eurosky PDS or a third-party EU PDS. The underlying records you have published to your PDS remain on your PDS in the EU; what transits the US is the delivery and indexing of the public content shown in your mu experience. Two functions will remain on Bluesky's infrastructure for longer: search on mu may continue to be processed through Bluesky's search service for some time after the appview switch, and media delivery may run through Bluesky's content delivery network, our own, or a combination (see §22.2). The lawful basis for these transfers is the necessity of providing you with mu (Article 6(1)(b) GDPR) combined with the public character of the content involved (see §13 federation). We will update this section as the transition completes.

Push notifications from the mobile apps are delivered by Apple and Google. If you enable push notifications in the mu apps, delivery runs through the Apple Push Notification service (Apple Inc.) or Firebase Cloud Messaging (Google LLC), depending on your device. Both are US providers; both are covered by the safeguards described above, and we minimize what the notification payload contains (see §22.8.1).

9. Your rights under the GDPR

You have the following rights in relation to personal data we process about you. You can exercise them by writing to privacy@eurosky.tech or by using the relevant in-product setting where available.

Access (Article 15): ask us for a copy of the personal data we process about you, and information about how we process it.
Rectification (Article 16): ask us to correct inaccurate or incomplete personal data.
Erasure (Article 17): ask us to delete personal data, in the circumstances set out in the GDPR.
Restriction of processing (Article 18): ask us to stop processing personal data for a period while we resolve a dispute about it.
Data portability (Article 20): ask us to provide personal data you have given to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible. The AT Protocol is built around portability; our Terms of Service §20 describes the migration mechanics.
Object (Article 21): object to processing carried out on the basis of legitimate interests; we will stop unless we can demonstrate compelling legitimate grounds that override your interests.
Withdraw consent (Article 7(3)) where processing depends on consent.
Not be subject to a solely automated decision (Article 22) that produces legal effects or similarly significantly affects you. Our moderation decisions on mu involve automated systems, but appeals are reviewed by a person (see Terms of Service §26.2 and §23 below).

We aim to respond to requests within one month of receiving them. The GDPR allows us to extend this by two further months for complex or numerous requests; if we do, we will tell you why.

If we decline to act on your request, we will tell you why and inform you of your right to complain to your supervisory authority.

We may need to verify your identity before responding, particularly for access, erasure, and portability requests, to make sure we are not disclosing personal data to the wrong person.

10. Children and minors

Our minimum age depends on the service:

Eurosky PDS and Portal: 16 years old.
mu: 18 years old.

Users aged 16 or 17 may hold an Eurosky account but cannot use mu (see Terms of Service §4). We do not knowingly process personal data of users below the applicable minimum age for the service they are using.

If we have reasonable grounds to believe a user is below the applicable minimum age, we will suspend access until age is confirmed and, failing confirmation, terminate the account or the relevant access and delete the personal data in accordance with §11.

For users aged 16 or 17 with an Eurosky account, we apply the same data-protection commitments as for adult users, and additionally do not present recommendations based on profiling of any user and do not target advertising of any kind (see §7 and Terms of Service §13).

At launch, age assurance is light-touch and differs by service.

For the Eurosky PDS and Portal, we rely on self-declaration: at sign-up, we ask you to confirm that you are 16 or over, and we record that confirmation.
For mu, we ask you to provide your date of birth at sign-up or sign-in, and we use that date of birth to confirm you are 18 or over.

We do not, at launch, use payment-card checks, government-ID verification, or any third-party age-assurance vendor for either service.

Where local law later requires us to apply specific age-assurance methods, we will introduce them over time, choosing the least intrusive method that meets the requirement. Methods we anticipate adopting may include verified payment-card checks and zero-knowledge proof of age via the EU Digital Identity system. We do not retain biometric data, ID documents, or images supplied to age-assurance vendors. We will not use facial age estimation.

If you are a parent or guardian and believe a person below the applicable minimum age has provided us with personal data, please contact privacy@eurosky.tech and we will take prompt action to delete that data.

11. How long we keep personal data

We retain personal data only as long as necessary for the purposes for which it was collected, taking into account legal obligations, security, and your ability to use the services. The specific retention periods that apply to each service are set out in Parts 3 and 4 below; the principles in this section apply across them all.

Account data is retained for as long as your account is active.
Technical and operational data, including server logs, IP addresses, and security signals, is retained for 30 days, unless a longer period is required for legal, security, or operational reasons (for example, to investigate a specific incident).
Backups are retained on a rolling basis as described in §12; deletion requests are honoured in the active systems and the data is purged from backups on the next rotation cycle.
Trust-and-safety records, including evidence relating to moderation actions and abuse investigations, are retained for as long as necessary to enforce these decisions, defend appeals, and meet our legal obligations under the DSA and applicable Member State law.
Records required by tax, accounting, and other legal obligations are retained for the periods required by the law that imposes the obligation (typically seven years for Dutch tax records under Article 52 AWR).

When the retention period ends, we delete or irreversibly anonymize the data.

12. Backups

We make regular backups of our infrastructure for resilience and disaster-recovery purposes. Backups are stored on EU infrastructure with the same hosting principles described in §8. Personal data persists in backups until the backup is rotated out; rotation runs on a defined cycle (typically no longer than 35 days). Erasure requests are honoured in the active systems immediately and the backup copies are purged on the next rotation.

13. AT Protocol federation: an important note

Our services run on the AT Protocol, an open, federated standard. This has practical consequences for your personal data that you should understand.

Public content is genuinely public. Posts, profile information, follows, likes, and similar records are designed to be readable by anyone on the network, including ATProto operators we do not control.
Other operators may cache or store your content. Relays, AppViews, feed generators, and other ATProto services may read, index, cache, and re-display your content. We cannot control them.
Deletion propagates but cannot be guaranteed network-wide. When you delete content from your Eurosky PDS, we publish deletion (tombstone) events on the protocol firehose. We honour the deletion in our systems and notify the network. We cannot force other operators to honour the deletion in theirs.
Federation runs both ways. Even after you stop using mu, public content involving you may continue to appear on mu, because mu fetches content from across the AT Protocol network rather than only from people who actively use mu. This includes content you posted before you stopped, and new replies, quotes, or reshares from others. See §27 for what we do with mu-side caches when you leave.

These are structural consequences of using an open protocol. They are part of the value (your account and content are portable, not locked into our infrastructure) and part of the cost (you cannot un-publish public content with absolute certainty, and you cannot guarantee that public content involving you stops appearing on mu just because you stopped using mu).

14. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or destruction. Measures include encryption in transit (HTTPS for all connections), access controls on our internal systems, monitoring for unauthorized activity, and regular review of our infrastructure and procedures.

We do not claim our security is infallible. No service connected to the internet is.

15. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (the Dutch Autoriteit Persoonsgegevens) without undue delay and, where feasible, no later than 72 hours after we become aware of the breach (Article 33 GDPR).

Where the breach is likely to result in a high risk to the rights and freedoms of affected users, we will also notify those users without undue delay, by the channels described in Terms of Service §16 (Article 34 GDPR).

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, our processing, or applicable law. The most recent version will always be published at this URL, with the date of the latest update at the top. Older versions, and a log of substantive changes, are kept in our Transparency Centre at eurosky.tech/transparency.

Changes that get at least 30 days' advance notice. If we make a material change, we will tell you through the relevant service or by email at least 30 days before the change takes effect, unless the change is required immediately by law. A new version may also take effect for you earlier than its general effective date if you expressly accept it, for example when you first sign in to a new mu application that presents it to you. The following are always material:

processing a new category of personal data, or processing an existing category for a new purpose;
a change of lawful basis for an existing processing activity;
sharing personal data with a new category of recipient;
transfers of personal data to a third country not previously disclosed in this policy;
extending a retention period;
introducing an analytics or measurement tool that uses cookies or persistent identifiers requiring consent (in which case we will also ask for that consent rather than assume it);
any weakening of the commitments in §7. A change to §7 will always be announced prominently in-product, not only in this document.

Changes that take effect on publication. The following are not material, and we make them by publishing the updated text and recording them in the change log:

clarifications and rewording that do not change what we do;
swapping a provider within the same category, under the same safeguards and commitments, reflected on the providers page at eurosky.tech/transparency;
updates to contact details, legal citations, or links;
new features that process only categories of data already described here, for purposes already described here.

Part 3: The Eurosky PDS and Portal

Applies to you if you have an Eurosky account.

17. About the Eurosky PDS and the Portal

The Eurosky Personal Data Server (PDS) provides identity hosting and personal data storage for the AT Protocol. It is infrastructure: it does not provide feeds, rank posts, or curate speech.

The Eurosky Portal is the front-end at portal.eurosky.tech for managing your Eurosky account. It allows you to create or sign in to your account, view your profile information and the data stored under your account, discover compatible third-party AT Protocol applications, and (for selected apps) use sign-in facilitation. The Portal is currently in beta. The Portal is not an online platform: it does not host user content, operate feeds, recommend content, or curate speech.

The Portal's featured-apps directory is a form of editorial curation: we choose which third-party applications appear in the directory and may feature specific apps. We do this to help you find applications that work with your Eurosky account. The applications themselves are operated by independent third parties under their own terms and privacy policies, and we do not control them. Inclusion in the directory is not an endorsement or warranty; it indicates that the application is compatible with the AT Protocol and your Eurosky account.

Modal operates the PDS and the Portal together. Your Eurosky account is a single thing; the PDS is the data layer and the Portal is one of the surfaces you can manage it through.

18. Personal data processed by the Eurosky PDS

Depending on how you use the PDS, we may process the following categories of personal data:

account identifiers including your AT Protocol DID and your handle;
handle change history if you change your handle, kept for trust-and-safety and federation reasons;
profile information you choose to provide (display name, description, avatar, banner, links);
content you post, upload, or store via your PDS, including the post records, media blobs, and metadata associated with them;
social graph data including your follows, blocks, mutes, lists, and similar relationships;
OAuth and authentication state for sessions and access tokens used by applications you have authorized, including mu;
email and password you provide when creating an Eurosky account, used for account creation and recovery;
account recovery information, including recovery email if different from sign-up email and any recovery keys;
age confirmation that you self-declared you are 16 or over at PDS sign-up (and, where you also use mu, 18 or over at mu sign-up or sign-in), with the date and the in-product surface where you declared it;
technical and operational data needed to operate the PDS, including IP addresses, timestamps, and server logs;
security and abuse-prevention signals.

We do not intentionally process special category data via the PDS.

Lawful bases. Performance of a contract (Article 6(1)(b)) for the core hosting service; legitimate interests (Article 6(1)(f)) for security, abuse prevention, and operations; legal obligation (Article 6(1)(c)) for compliance with EU and Member State law.

19. Personal data processed by the Eurosky Portal

The Portal is a front-end. Most of the data it shows you is fetched from your PDS on demand. The Portal itself processes:

OAuth flow state during sign-in, including the temporary parameters needed for the OAuth handshake. The Portal does not handle or store your password; passwords are submitted directly to the PDS.
OAuth access tokens that the Portal holds server-side only and uses to retrieve your profile information from your PDS. Tokens are not exposed to your browser or to third-party applications.
Profile data fetched from your PDS for display in your dashboard: handle, display name, avatar, post count, follower count, following count. Depending on how your PDS resolves the request, this fetch may also call an AT Protocol AppView (such as the Bluesky AppView, operated by Bluesky PBC in the United States). Only the minimum public data needed to populate the dashboard is involved; your OAuth token is never shared with an AppView.
Server-side account state for whether you have accepted the Terms of Service, whether you have dismissed the welcome banner, your login-session state, and the OAuth flow state described above.
The handle you share when using sign-in facilitation for selected third-party apps. Only your handle (and, where applicable, a marker identifying Eurosky as the referring service) is shared. The Portal does not share your OAuth access token, your email address, your password, or any other profile or account data with third-party apps through this feature.
Technical and operational data for the Portal's operation, including IP addresses, user-agent strings, timestamps, and server logs.

Cookies and local browser storage. The Portal uses:

a first-party session cookie to maintain your authenticated login session;
a theme key in your browser's local storage to remember whether you have selected light or dark mode;
a language key in your browser's local storage to remember your preferred language.

The Portal sets no third-party cookies, no tracking cookies, no advertising cookies, and no analytics cookies.

Lawful bases. Performance of a contract (Article 6(1)(b)) for the core Portal functionality; legitimate interests (Article 6(1)(f)) for security, abuse prevention, and operations; legal obligation (Article 6(1)(c)) for legal compliance.

20. Hosting, transfers, and retention for the PDS and Portal

Hosting. The PDS and the Portal are both hosted on cloud infrastructure provided by an EU-headquartered hosting provider, in data centres located within the European Union. The current provider is listed on the providers page at eurosky.tech/transparency. We may change provider, but we will use only EU-headquartered providers operating EU data centres.

Transfers. As described in §8, the PDS and Portal do not transfer the primary contents of your account outside the European Union. The exceptions are AT Protocol federation (§13) and the Bluesky AppView call described in §19. Both are necessary consequences of operating on an open protocol.

Retention.

PDS account data (DID, handle, profile, content stored in your repository) is retained for as long as your account is active or deactivated. While an account is deactivated, the data stays in place but is not served on the network. Your handle is held for you for 30 days from the moment of deactivation; after 30 days of continuous deactivation, the handle is released. The account itself remains in its deactivated state until you reactivate, fully delete, or the additional retention period set out for deactivated accounts expires (see §21.3 of the Terms of Service).
Technical and operational data for the PDS and the Portal (server logs, IP addresses, security signals) is retained for 30 days unless a longer period is required for legal, security, or operational purposes.
OAuth tokens and login-session state are retained server-side for the duration of your session, and are deleted or invalidated when your session ends.
Server-side acknowledgements (Terms of Service acceptance, welcome-banner dismissal) are retained for as long as your Eurosky account exists.
Age-confirmation records are retained for as long as your account exists and as required by applicable law (for example, to demonstrate compliance with minimum-age obligations if challenged by a supervisory authority).

If you delete your account or migrate to another provider, we handle your data in accordance with the AT Protocol and applicable law. Certain limited data may be retained where required for legal, security, or operational purposes, as described in §11.

21. PDS-layer moderation and data flows

The Eurosky PDS is infrastructure, not a curation platform. We do not proactively monitor, rank, or curate content. We do not use third-party moderation services at the PDS layer. Moderation at the PDS layer is legal compliance only: we act on lawful notices we receive and where we are legally required to do so.

The notices we act on include:

notices submitted under the EU Digital Services Act (Article 16), including notices from any natural or legal person;
removal orders under Regulation (EU) 2021/784 on terrorist content;
notices submitted by trusted flaggers under Article 22 of the DSA, which we process with priority;
notices from Bluesky Social, PBC about illegal content that Bluesky detects in federated data on the AT Protocol firehose (which Bluesky's infrastructure ingests as a normal part of operating on the network);
court orders and lawful orders from competent EU and Member State authorities;
and other clearly unlawful content where we are legally required to act.

We treat all sources as notices to be assessed against the law. We are the controller of the decision to act or not act on PDS-layer data; the source of the notice does not determine the outcome.

This processing is separate from the moderation that mu carries out at the application layer, described in §23 below. Where you use mu with an account hosted on the Eurosky PDS, both layers may process your content for moderation purposes: the PDS layer for legal compliance, the mu layer under the mu Community Guidelines.

Lawful basis for PDS-layer moderation processing: legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)) for protecting users and the integrity of our services.

Part 4: mu

Applies to you if you use mu, regardless of where your account is hosted.

22. Personal data mu processes

When you use mu, we process the following categories of personal data. Some of it is yours and lives primarily on the PDS that hosts your account; the rest is generated by your use of mu specifically.

22.1 Authentication

mu supports the following ways of signing in.

OAuth (the standard route). You are redirected to the PDS that hosts your account and enter your password there, not in mu. We receive an OAuth access token that we hold server-side and use to make requests on your behalf to your PDS. We do not see or store your password.

App password (optional). You can also sign in to mu with an app password: a separate, revocable password you create with the PDS that hosts your account for use in a specific application. When you sign in this way, the app password transits mu's servers: we pass it to your PDS for verification and receive session tokens in return. We do not store the app password; we hold only the resulting session tokens, server-side, for the duration of the session, and they are deleted or invalidated when the session ends. You can revoke an app password at any time from your PDS account settings.

Your PDS account password (specific account functions only). A small set of account-level functions that the OAuth route does not yet support, such as deleting your account or generating an app password, require signing in with the password of the PDS account itself. This is never required for ordinary use of mu: if you do not use these functions, your account password is never entered in mu. When you do use them, your password transits mu's servers in the same way: we pass it to your PDS for verification, we do not store it, and we hold only the resulting session tokens for the duration of the session. As the AT Protocol's OAuth capabilities mature, we expect to reduce and eventually remove the need for password-based sign-in on mu.

If your account is hosted on the Eurosky PDS, the sign-in flow happens between mu and the PDS we also operate (covered by Part 3). If your account is hosted on a third-party PDS, the credential layer is governed by that provider's privacy policy.

Date of birth for age confirmation on mu. At sign-up or sign-in, mu asks you for your date of birth and uses it to confirm you are 18 or over. We record the date of birth, the date and source of the confirmation, and the outcome (pass or fail). We do not use your date of birth for any other purpose. The lawful basis is performance of a contract (Article 6(1)(b) GDPR) for the act of providing mu access to a user who meets the age requirement, combined with legal obligation (Article 6(1)(c)) in respect of minimum-age compliance.

22.2 Content you create and receive via mu

mu sends and retrieves content via the PDS hosting your account. When you post, the post is written to your PDS. When you read, mu fetches posts from the relevant PDSes through the AT Protocol.

mu may cache content on its servers for performance and reliability. Caches are short-lived, are not the system of record for your content, and follow the deletion rules in §11.

Content delivery on mu during the appview transition. mu is switching from Bluesky's appview (indexer) to an appview we run ourselves on EU infrastructure. Until the switch completes, the posts, profiles, follows, likes, and other public records you see when you use mu may be fetched and served through the appview operated by Bluesky Social, PBC in the United States, so your interactions and the content displayed to you may transit Bluesky's US infrastructure even where your account is hosted on the Eurosky PDS or a third-party EU PDS. We do not pay Bluesky for this access; the appview is open. Bluesky processes the data it receives under its own privacy policy. Once the switch completes, content delivery on mu runs on our own infrastructure, and we will update this section. See §8 for the international-transfer implications.

Search. When you search on mu, your search queries are processed by a search service to return results. During the transition, and for some time after the appview switch, search on mu may continue to be processed through Bluesky's search service: your search queries are then processed on Bluesky's US infrastructure under Bluesky's privacy policy. We do not attach your identity to search queries beyond what the protocol requires to serve the request. We are building our own search and will update this section when mu switches to it.

Media delivery. Images and video shown in mu are served through a content delivery network (CDN). During the transition, media may be served through Bluesky's CDN, through our own CDN, or through a combination of the two. A CDN sees the standard technical data involved in serving a file: IP address, user agent, and the file requested. The current CDN providers are listed on the providers page at eurosky.tech/transparency.

Direct Messages. mu uses Bluesky's Direct Message service as part of the Atmosphere. DMs you send through mu are routed through Bluesky Social, PBC's DM infrastructure, not through mu's own servers. DMs are not end-to-end encrypted. Bluesky's Trust & Safety can access them under Bluesky's DM policies, which are separate from these Terms and from this Privacy Policy. We are processing DM-related metadata (delivery, notifications, mute lists) on the mu side, but the message content itself sits in Bluesky's systems. If you do not want DMs to go through Bluesky's infrastructure, do not use DMs on mu until we revisit this arrangement.

22.3 Service interaction data

We process records of how you use mu, including:

feed and content interactions that drive the recommender systems described in §24 (what feeds you select, what you opt into for personalization);
reports you submit through the mu reporting channel (§25 ToS / §25 here);
appeals you file (§26 ToS / §26 here);
mute, block, and label preferences you set, including third-party label services you subscribe to (Terms of Service §27);
notification settings and notification delivery records.

22.4 Technical and operational data

When you use mu, we process technical data needed to operate the service: IP addresses, user-agent strings, timestamps, server logs, and security and abuse-prevention signals.

22.5 Analytics

We use analytics to understand how mu is doing: how many people use it, when, roughly from where, which features get used, and whether things are broken. What binds us is not the name of the tool but the following commitments, which hold for every analytics or measurement tool we use, on the web and in the mobile apps:

no advertising networks and no data brokers: analytics data is never shared with either, and never sold;
no cross-site or cross-app tracking: we do not use tools that follow you to other sites or apps, and we do not use advertising identifiers;
no advertising profiles: analytics never feeds a profile of you for advertising purposes (§7);
aggregate-first: we prefer tools that answer questions about mu in aggregate over tools that build per-user behaviour records, and where per-user signals are technically involved, we keep them to the minimum the question requires;
processors under contract: every analytics provider acts as our data processor under a Data Processing Agreement, and where a provider processes data outside the EEA, the §8 safeguards apply;
consent where required: our current tools are chosen so that they do not use cookies or similar persistent identifiers requiring consent under the ePrivacy rules, which is why we show no cookie banner for analytics. If we ever adopt a tool that requires consent, we will ask for it first rather than assume it.

The analytics tools we currently use, for the web and for the apps, are listed on the providers page of our Transparency Centre at eurosky.tech/transparency, with a note of what each is used for.

For the mobile apps, analytics within these commitments may include aggregate feature-usage measurement and the crash and diagnostics reporting described in §22.8.2, which we use to find and fix problems, not to profile you.

The lawful basis for analytics is legitimate interests (Article 6(1)(f) GDPR): the signals are necessary to operate, secure, and improve mu, and the commitments above keep the impact on your fundamental rights minimal. Where a specific tool requires consent, consent (Article 6(1)(a)) is the basis for that tool, and you can withdraw it at any time.

Our CDN and hosting providers also produce standard server-side traffic logs as a normal consequence of operating the infrastructure. Those logs are part of the technical and operational data described in §22.4, not part of the analytics described in this section. They are subject to the retention rules in §11 and §26.

22.6 Cookies, local storage, and app storage on mu

In your web browser, mu uses:

a first-party session cookie to maintain your authenticated login session;
first-party preference storage in your browser's local storage and IndexedDB (not in cookies) for theme, language, sensitive-content filter settings, feed selections, and similar preferences. Preference values persist until you clear your browser storage or revoke authorization.

The mobile apps store the equivalent session state and preferences in the app's own storage on your device. They persist until you sign out, delete the app, or clear its data.

mu sets no third-party cookies for tracking, advertising, or analytics purposes, in the browser or in the apps, and our analytics tools are chosen not to require them (§22.5).

22.7 Lawful bases for mu

Performance of a contract (Article 6(1)(b)) for the core mu functionality, including authentication, content delivery, and notifications.
Legitimate interests (Article 6(1)(f)) for the operation, security, and improvement of mu, for detecting and preventing abuse, and for the analytics described in §22.5. We have carried out balancing tests for these interests.
Legal obligation (Article 6(1)(c)) for compliance with the DSA, the Terrorist Content Online Regulation, lawful orders, and other applicable law.

22.8 The mu mobile apps

mu is also available as mobile applications for iOS and Android, distributed through the Apple App Store and Google Play. The apps process the same data as the web application, plus the following.

22.8.1 Push notifications. Push notifications are optional; the apps work without them. If you enable them, we process the push token your device's platform issues for the app, and delivery runs through the Apple Push Notification service (Apple Inc., United States) or Firebase Cloud Messaging (Google LLC, United States), depending on your device. We keep the notification payload minimal: where possible, the notification is a signal that makes the app fetch the content from our servers, rather than a copy of the content routed through Apple or Google. You can disable push notifications at any time in the app settings or your device settings. We delete the push token when you disable notifications, when you sign out, or when the platform reports the token as expired. Lawful basis: performance of a contract (Article 6(1)(b)) for delivering a feature you switched on.

22.8.2 Crash reporting and diagnostics. When the app crashes or misbehaves, we process crash logs and diagnostics: the device model, operating system version, app version, and the technical state of the app at the moment of the problem. Crash reports do not include the content of your posts or messages. Diagnostics reach us either through the platform's own opt-in mechanisms (Apple and Google let you choose whether to share diagnostics with developers) or through a crash-reporting processor listed on the providers page at eurosky.tech/transparency. We use this data to find and fix problems, and for nothing else. Lawful basis: legitimate interests (Article 6(1)(f)) in keeping the apps working.

22.8.3 App store transactions. If we offer a paid feature or a donation option through the apps, payment is handled entirely by Apple or Google under their own terms and privacy policies. We never see your card or bank details. We receive a confirmation of the transaction (what was bought, when, and the store's transaction reference) so we can provide what you paid for and meet our accounting obligations. Lawful bases: performance of a contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for accounting records.

22.8.4 Device identifiers. The apps do not use advertising identifiers (Apple's IDFA or Google's Advertising ID), and they do not track you across other companies' apps or websites. On iOS, mu does not show the App Tracking Transparency prompt, because there is nothing to ask permission for. The only device-scoped identifiers the apps use are the push token described in §22.8.1 and install-scoped identifiers needed for crash reporting, and neither is used beyond the purposes described in this section.

23. Moderation, reports, and automated systems on mu

23.1 The two layers (and what we can do during the transition)

mu's moderation is described in two layers in Terms of Service §23: a Bluesky baseline and a mu layer of our own. We are introducing our own moderation layer alongside the switch to our own appview. For this Privacy Policy, two distinctions matter.

Until our own moderation layer is fully in place. The systematic moderation signal on mu comes from the labelling service operated by Bluesky Social, PBC. The labels Bluesky publishes are public; ingesting them is not processing of your personal data per se. When mu applies a Bluesky label to specific content of yours, we process the content (which may be personal data) and our application of the label is a moderation action we record. We can suspend an account's ability to sign in to mu where suspension is warranted, but until our own layer is in place we cannot ourselves apply specific moderation actions (hide, restrict, label, remove) to specific posts at the mu layer. The most we can do beyond suspension is flag cases back to Bluesky's Trust & Safety team, with whom we are in regular contact.

As our own moderation layer is introduced. mu's own systems and moderators become able to take specific actions on specific content under the mu Community Guidelines. When they do, we record the action, the content it applies to, the reason for it, and (where applicable) the appeal you have filed. The two signals run together: our own layer sits on top of the Bluesky baseline and can reverse it (Terms of Service §23.2).

A structural point about suspension and content removal. These are different actions. Suspending an account from signing in to mu does not, by itself, remove that account's content from mu, because mu fetches content from across the AT Protocol network. Content removal is always a separate, case-by-case decision against specific content. This stays true once our own moderation layer is live; it is a property of operating on a federated protocol, not a transitional limitation.

23.1a Why Bluesky processes mu user data

You should understand a feature of the AT Protocol that affects what Bluesky sees, and why.

mu uses the `app.bsky.*` lexicon, the set of data schemas that Bluesky originally defined for posts, profiles, follows, likes, and similar records. The `app.bsky.*` lexicon is what most ATProto applications use today; mu is one of them. When you post on mu, your post is written as a record under that lexicon to the PDS that hosts your account, and is then broadcast on the AT Protocol firehose as a normal consequence of being on the open network.

Bluesky Social, PBC operates infrastructure that ingests the firehose for the `app.bsky.*` lexicon at the network level: a relay, an AppView, and a Trust & Safety service. This is part of how Bluesky's own application works and part of how it serves other applications on the network with labels. As a result, when you use mu and post `app.bsky.*` content, Bluesky's infrastructure sees that content because it is on the firehose, not because we share it with Bluesky. Bluesky's Trust & Safety service may then classify the content under Bluesky's own moderation rules and publish labels that anyone can subscribe to (including mu, see §23.1).

The consequences for your data:

We do not actively share your data with Bluesky. Bluesky's infrastructure sees `app.bsky.*` content because that content is on the AT Protocol firehose, which Bluesky's infrastructure ingests as a normal part of being on the network.
Bluesky's processing of your data is governed by Bluesky's own privacy policy, not ours. We cannot speak for it.
The labels Bluesky publishes are public. mu ingests them and applies them on mu by default (subject to §23.2 of the ToS). The label decision is Bluesky's; our application of it on mu is ours.
This arrangement is a property of the open social web, not a contract. If the AT Protocol lexicons or the firehose architecture change in ways that affect this, we will update this section.

If you do not want Bluesky's infrastructure to see your content, the answer is not to use the `app.bsky.*` lexicon. There are other lexicons on the open social web. mu currently only supports `app.bsky.*`.

23.2 Reports and appeals

When you submit a report through the mu reporting channel or by emailing safety@mu.social, we process:

the content of your report;
your account details and contact details;
evidence you provide;
our investigation notes, our decision, and the reasons.

When you file an appeal under Terms of Service §26 or by emailing appeals@mu.social, we process the appeal text, the underlying decision and its evidence, the reviewer's notes, and our decision.

We retain reports, appeals, and the records of our decisions for as long as necessary to enforce them, defend further appeals, comply with the DSA's transparency-reporting obligations (Article 24 DSA), and meet other legal obligations.

23.3 Automated systems

Until our own moderation layer is fully in place, the systematic automated moderation signal applied to content on mu comes from Bluesky's labelling service, not from mu's own systems. mu applies the Bluesky baseline labels at scale, and performs human review on a per-report basis under §23.2 above.

As our own moderation layer is introduced, mu uses additional automated systems (including AI-based systems) for:

detecting spam, abuse, and prohibited content to surface for human review or to apply our own labels;
detecting coordinated inauthentic behaviour (Community Guidelines §5.7);
supporting prioritization in our human review queues.

Automated systems may make initial decisions to label or restrict content. Significant decisions that affect your access to mu (suspension, termination) are not made solely by automated means. You have the right under Article 22 of the GDPR not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you; the appeal route under Terms of Service §26.2 is the route by which you can request a human review, express your view, and contest the decision.

23.4 Statement of reasons

Where the Digital Services Act applies (Article 17), we provide a statement of reasons for the actions we take against your content or your access. The statement describes what we did, why, whether automated systems were involved, and how to appeal.

24. Recommender systems and feeds

During the appview transition. Until the switch to our own appview completes, the default feeds you see in mu and the personalization signal they use are powered by Bluesky's appview (see §22.2), and the recommender behaviour mu surfaces is the behaviour of Bluesky's recommender, displayed through mu. The processing of your interaction data for ranking and personalization during this period is done by Bluesky's systems under Bluesky's privacy policy, not by ours. mu can record which feeds you have chosen and which content you have interacted with through mu for our own service-interaction-data purposes (see §22.3), but during the transition we do not run our own ranking models against that data.

When our own appview is live, we will run our own default feeds and our own recommender. At that point, we will process service-interaction data (which feeds you select, which content you interact with through mu) to drive ranking and personalization on mu, and we will be specific in-product about which signals each of our own feeds uses. We will update this section when the switch happens.

Third-party feeds. Regardless of whether the appview is Bluesky's or ours, you can choose alternative feeds, including third-party feeds operated by independent operators on the AT Protocol, or opt out of personalized recommendations entirely. Third-party feeds and labelling services process your data under their own terms; we are not responsible for them. See Terms of Service §27.

We do not build advertising profiles of you (§7).

25. Third parties involved in mu's operation

mu involves the following categories of third parties. The current named providers in each category are listed on the providers page of our Transparency Centre at eurosky.tech/transparency.

Hosting and content delivery providers for mu's servers and media delivery, under the EU-hosting commitments in §8. During the transition described in §22.2, media may also be served through Bluesky's CDN.
Bluesky Social, PBC, in distinct roles during the transition: (a) as the publisher of the moderation labels we ingest and apply on mu (§23.1); (b) as the operator of the DM service we use (§22.2); (c) as the operator of the appview through which content delivery and the recommender signal on mu are served until our own appview takes over (§22.2, §24); (d) as the operator of the search service that may process mu search queries for some time after the appview switch (§22.2); and (e) as a CDN through which media may be served during the transition (§22.2). Bluesky processes the data it sees in each of these roles under its own privacy policy.
Apple Inc. and Google LLC, for the mobile apps: app distribution, push notification delivery, opt-in diagnostics, and (where offered) payment processing (§22.8).
Other PDS providers, where you use mu with an account hosted elsewhere. We exchange data with the PDS that hosts your account in order to fetch and write content on your behalf.
The AT Protocol network at large, including relays, AppViews, and other ATProto operators (§13).
Analytics providers acting as our data processors, within the commitments in §22.5.
Service providers acting as data processors on our behalf, for example for error tracking, customer support, or operational tooling, where contractual safeguards and (where applicable) Standard Contractual Clauses are in place.

We do not sell personal data to any third party. We do not share personal data with advertisers, advertising networks, or data brokers.

26. Retention specific to mu

In addition to the principles in §11, the following retention rules apply to mu:

Cached content for performance and reliability is retained for short periods only and is purged on the cache rotation cycle.
Reports and appeals are retained for as long as necessary to enforce decisions, defend further challenges, and comply with the DSA's transparency-reporting obligations.
Service-interaction data that drives recommender feeds is retained in aggregate; per-user signals used to personalize your feeds are kept while your account is active and can be reset from your settings or by ending your relationship with mu (Terms of Service §28).
Notification delivery records are retained for a short operational window (typically 30 days).
Push tokens are deleted when you disable push notifications, sign out, or the platform reports the token as expired (§22.8.1).
Crash and diagnostics data is retained only as long as needed to diagnose and fix the problem it describes, and no longer than 90 days in identifiable form.
Aggregate analytics signals (§22.5) are retained in their aggregated form indefinitely, because by design they cannot be tied back to an individual.

27. Ending your relationship with mu

The mechanics of ending your relationship with mu and ending your Eurosky account are set out in Terms of Service §28 (mu) and §21.3 (Eurosky account). For privacy purposes:

when you revoke mu's OAuth authorization, mu loses the ability to act on your behalf from that moment, and the mu-side caches of identifiers and preferences associated with your account are deleted on the retention timelines described in §26;
when you deactivate your Eurosky account (where applicable), the data stored under your account stays in place but is paused: it is not served on the network, your handle is held for 30 days, and you can reactivate within that window (see §20 retention). If you reactivate, processing resumes; if you do not reactivate within 30 days, the handle is released, and the account remains in its deactivated state until you reactivate, fully delete, or the additional retention period set out for deactivated accounts expires;
when you delete your Eurosky account (where applicable), we begin deletion of Your Content from the Eurosky PDS in accordance with §20;
when you migrate your Eurosky account to another PDS provider, Part 3 of this Privacy Policy stops applying to you, and your new PDS provider's privacy notice governs the hosting layer from that point; Part 4 continues to apply if you keep using mu.

Federation runs both ways. Even after you stop using mu, public content involving you may continue to appear on mu, because mu fetches content from across the AT Protocol network rather than only from people who actively use mu. We described this in §13. It means that ending your mu relationship deletes your mu-side data and revokes our access to your account, but it does not prevent public content involving you that lives elsewhere on the network from being displayed on mu.

We retain what we are required to keep for legal or trust-and-safety reasons (§11).

Contact

For all privacy-related questions: privacy@eurosky.tech.

For Data Protection Officer correspondence: dpo@eurosky.tech.

For data subject access, rectification, erasure, restriction, portability, and objection requests: privacy@eurosky.tech. You can also use the in-product settings for the relevant service where available.

For postal correspondence: Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands.

To lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl. You can also complain to your own national supervisory authority if you live in another EU or EEA Member State.