BskyDelete connects to Bluesky through the official AT Protocol OAuth flow. It does not use Bluesky App Passwords and does not ask you to type your Bluesky password into BskyDelete.
What happens when you connect
You enter your Bluesky handle, continue to the authorization service discovered for your account, and approve access there. The browser-based OAuth client manages the session on your device. Authorized requests still send the required OAuth credentials to your Bluesky account provider so it can return or change data; “browser-based” does not mean no network transmission occurs.
AT Protocol requires protections such as PKCE and DPoP for OAuth clients. The official OAuth specification explains those requirements, and Bluesky provides an OAuth client implementation guide.
The authorization screen is the place to verify what the session can do. Check that you are on the expected account-provider domain, read the requested access, and cancel if the account or permissions are not what you intended. BskyDelete support will not ask you to email a password, OAuth token, recovery code, or authorization callback URL.
What remains in your browser
The browser OAuth client keeps the state it needs to restore an authorized session on that device. BskyDelete also uses small local browser flags to remember whether a connection was started or disconnected; those flags are not your Bluesky password. Anyone who can use an unlocked browser profile may be able to use an active session, so disconnect when you finish on a shared computer and clear the site's browser data if you do not control the device.
Signing out of a separate BskyDelete website account and disconnecting Bluesky are different actions. Use the Bluesky disconnect control when you want BskyDelete to call the OAuth client's revocation flow and clear its local connection markers. If revocation reports an error, stop using the session and review the applications or sessions available through your Bluesky account provider.
What BskyDelete does with Bluesky content
Posts, likes, reposts and following data are loaded for the action you request and processed in the browser. BskyDelete application servers are not designed to persist copies of that Bluesky content. Separate account, analytics and subscription providers may process the information described in the Privacy Policy.
There is no fixed promise that every OAuth session expires after 24 hours. Session lifetime and re-authentication are controlled by OAuth and the account provider. Disconnect the Bluesky account in BskyDelete or clear the site's browser data to remove the local session.
Public Bluesky records still travel between your browser and the Bluesky account provider when BskyDelete loads or changes them. Network services, your account provider, and browser extensions are outside BskyDelete's local application state. For the current description of analytics, account and payment providers, read the Privacy Policy.
What BskyDelete cannot guarantee
Deleting a record through the AT Protocol does not erase copies that someone else already made. Screenshots, quotations, third-party archives, search caches, replies, and externally embedded content may remain outside your account. Removing a repost removes your repost record, not the original author's post. Unfollowing changes your relationship from that point forward; it does not rewrite earlier notifications or third-party datasets.
BskyDelete also cannot guarantee that every API request will succeed. An expired authorization, provider outage, rate limit, or a record that has already changed can produce an error. Start with a small reviewed selection, read the result shown for each operation, and verify important changes directly in Bluesky afterward.
Use destructive tools carefully
Deletion and unfollow actions change your account and may be irreversible. Check the domain, review the authorization screen, preview every selection, export anything you need, and confirm only the records you intend to change.
Before a large cleanup:
- Export the records you may need later.
- Apply a narrow filter and inspect the selected items again after changing it.
- Test the workflow with one nonessential record.
- Confirm only the records you have reviewed.
- Open Bluesky after the operation and verify the result from your profile.
If you believe you found a security problem, do not include credentials, tokens, recovery codes, payment details, or private Bluesky content in the first message. Contact help@bskydelete.com with the affected page, the browser and operating-system versions, the approximate time, and steps that reproduce the issue without exposing secrets. General account and privacy questions can also be sent through the contact page.