How the OAuth authorisation works
BskyDelete uses the official AT Protocol OAuth flow. You are redirected to your own Bluesky provider, you approve the request there, and the provider returns an authorisation code to BskyDelete. At no point do you type your Bluesky password into BskyDelete, and BskyDelete never asks for an App Password.
The client identity is public and inspectable
The OAuth client is identified by a metadata document published at a fixed URL on this domain. It declares the application name, the single redirect URL that authorisation codes may be returned to, the requested scope, and the supported grant types. Anyone can fetch that document and check it before approving the request.
Access tokens are bound to the browser that requested them
The client metadata enables DPoP-bound access tokens. In practice this means the token is cryptographically tied to a key held by your browser, so a token copied elsewhere is not usable on its own. This is a property of the AT Protocol OAuth implementation, not something BskyDelete adds on top.
The scope is the standard transitional scope
BskyDelete requests the transitional generic scope defined by AT Protocol. That scope is what allows the application to read your records and write deletions to your own repository. It does not grant access to other people’s accounts, and it does not give BskyDelete the ability to change your password, email address or account status.
One connected account at a time
BskyDelete works with a single connected Bluesky session. To work with a different account you disconnect the current session first and then authorise the next one. There is no shared pool of accounts and no background access to accounts you are not actively connected to.
Where the session is stored and how long it lasts
The OAuth session is created and managed by the official browser OAuth client library, not by code we wrote for this purpose. It lives on the device you authorised from.
The session stays in your browser’s own storage
The OAuth library keeps the session in IndexedDB in your browser. It is not copied to a BskyDelete server, and it is not synchronised between your devices. Authorising on a laptop does not sign you in on a phone.
What BskyDelete itself stores is only a set of flags
Alongside the library’s session, the application keeps a few simple markers in local storage so that pages know whether a connection exists, whether you signed out deliberately, and whether an authorisation round trip is in progress. These markers hold no tokens and no account content.
Session lifetime is decided by the provider, not by us
How long a session stays valid, and when it needs refreshing, is determined by the AT Protocol OAuth implementation and by your account provider. BskyDelete does not promise a fixed session duration, and clearing your browser storage ends the local session immediately.
What our servers receive
Every read and every deletion happens directly between your browser and your Bluesky provider. When you delete posts, likes, reposts or follows, your browser calls the AT Protocol repository endpoint itself and the records are written against your own repository.
There is no BskyDelete server component that receives, relays, inspects or stores your posts, likes, reposts, following list or access tokens. CSV exports are also assembled in the browser and downloaded from there; the file never passes through a server of ours. This is a property of how the application is built, not a policy we ask you to trust.
What our infrastructure does handle is ordinary website operation and, separately, your BskyDelete account and subscription record. Those are described in the privacy policy.
How to revoke access
You can withdraw BskyDelete’s access at any time, and you do not need our cooperation to do it.
- 1
Disconnect inside BskyDelete
Signing out of Bluesky inside the application does not merely clear a local flag. It calls the OAuth client’s revoke method for the connected account, which asks your provider to invalidate the session, and then clears the local markers.
- 2
Revoke from your Bluesky account
You can also revoke the authorisation directly from your Bluesky account settings, which is the authoritative place to do it. This works even if you no longer have access to the browser you authorised from, and it does not depend on BskyDelete being reachable.
Bluesky occasionally changes where these controls live in its interface, so we do not reproduce its exact menu labels here. Their current documentation and support entry point is available at the official Bluesky support page.
What deletion can and cannot reach
Deleting a record removes it from your own repository. That is a real and meaningful action, but it is not the same as erasing the content from the internet, and no tool can honestly claim otherwise.
Your own records are removed
Posts, likes, reposts and follows that you select are deleted from your repository, and they stop being served from it. Deletion is not reversible from within BskyDelete.
Other people’s records are not yours to delete
If somebody quoted, replied to or reposted your content, their record belongs to their repository. Removing your post does not remove their post, and BskyDelete cannot act on accounts you have not connected.
Federated copies and caches are outside our control
Content that has already been distributed to other services, indexes, feed generators or caches may persist for a period that neither BskyDelete nor you control. Propagation timing is decided by those systems.
Screenshots and archives cannot be recalled
Anything that was screenshotted, copied or archived by a third party before deletion stays with whoever holds it. No deletion tool can reach that material.
Because deletion cannot be undone, export the rows you care about before you delete them. The data export page explains exactly which columns each export contains and why an export is not a restore point.
Reporting a security problem
If you believe you have found a security issue in BskyDelete, please report it by email before disclosing it publicly, and include enough detail for us to reproduce it. We will confirm that we received your report.
Please never include a password, an OAuth token, a recovery code or payment card details in a report or in any other message to us. We never need them, and we will ask you to rotate anything you send by mistake.
Common questions
Does BskyDelete need my Bluesky password?
No. Authorisation happens through AT Protocol OAuth on your provider’s own page. BskyDelete never receives your password and does not use App Passwords.
Do you store my posts on a server?
No. Reads, deletions and CSV exports all run in your browser against your provider. There is no server component of ours that receives your account content.
Can you guarantee content disappears everywhere?
No, and neither can anyone else. We can delete records from your repository. Copies held by third parties, caches or screenshots are outside the reach of any deletion tool.
Have you been independently audited?
No. We do not claim any external security certification or audit. What this page describes is how the application is built, and the OAuth behaviour can be verified against the published client metadata.
Related reading
For a longer walkthrough of the same topics, see our security overview. For account-wide privacy decisions, see the Bluesky privacy guide. If a deletion did not behave as you expected, the deletion troubleshooting guide covers the observable causes.