Loading...
Privacy Policy
Your privacy matters to us. This policy explains how atmopins collects, uses, and protects your personal data in compliance with the EU General Data Protection Regulation (GDPR).
Last updated: February 6, 2026
Data Controller
The data controller responsible for your personal data is:
atmopins
For privacy inquiries, data access requests, or to exercise your rights, please contact us at:
What Data We Collect
Account and Profile Data
- Your AT Protocol Decentralized Identifier (DID)
- Your Bluesky handle
- Display name and profile description
- Profile avatar URL
Content You Create
- Pins (images, titles, descriptions, source URLs)
- Boards (names, descriptions, privacy settings)
- Comments and likes
- Social interactions (follows)
Technical Data
- IP address (for security and abuse prevention)
- Browser type and version
- Device information
- Access timestamps
Data from AT Protocol / Bluesky
- Public profile information from your Personal Data Server (PDS)
- Your social graph (who you follow)
- Public posts with images from accounts you follow
How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Providing the atmopins service | Legitimate interest |
| Displaying your profile and content | Legitimate interest |
| Caching profile data for faster display | Legitimate interest |
| Enabling search and discovery features | Legitimate interest |
| Visual similarity search using AI embeddings | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Enforcing community guidelines | Legitimate interest |
AT Protocol & Data Architecture
atmopins is built on the AT Protocol (the technology behind Bluesky). This means:
- •Your data is stored in your Personal Data Server (PDS) - You own and control your primary data. atmopins reads from and writes to your PDS with your authorization.
- •We maintain a cache and index - To provide fast search, visual similarity, and discovery features, we cache profile information and maintain an index of pins and boards on our servers.
- •Content is public by design - Public pins and boards may be visible across other AT Protocol applications. This is inherent to the federated nature of the protocol.
- •Data portability is built-in - You can export your data from your PDS at any time and move to a different PDS provider while keeping your identity.
Data Sharing
We share your data with the following categories of recipients:
AT Protocol Network
Public content is shared across the federated AT Protocol network by design.
Infrastructure Providers
Cloud hosting and CDN providers that help us deliver the service. These providers act as data processors under our instructions.
Legal Requirements
We may disclose data when required by law, court order, or to protect our legal rights.
We do not sell your personal data to third parties for advertising or marketing purposes.
Data Retention
Account data: Retained while your account is active. Deleted within 30 days after you disconnect your account from atmopins.
Cached profile data: Synchronized with your PDS. Removed when you disconnect or delete from your PDS.
Content index: Maintained while content exists in your PDS. Removed when deleted from source.
Server logs: Retained for 90 days for security and debugging purposes.
Backup data: Removed within 30 days after primary data deletion.
Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct inaccurate personal data. You can update your profile directly or contact us.
Right to Erasure
Request deletion of your data from our servers. Note: To fully delete data from the AT Protocol network, you must also delete it from your PDS.
Right to Restrict Processing
Request that we stop processing your data while keeping it stored.
Right to Data Portability
Receive your data in a machine-readable format. This is already built into the AT Protocol - your data is portable by design.
Right to Object
Object to processing based on legitimate interests.
To exercise your rights: Contact us at privacy@atmopins.xyz. We will respond within 30 days.
Cookies
We use the following types of cookies:
Essential Cookies
Required for the platform to function. These include authentication session cookies and security tokens. No consent required.
Preference Cookies
Store your preferences such as theme settings (dark/light mode). These are stored locally in your browser.
We do not use third-party advertising or tracking cookies.
Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit (TLS/HTTPS)
- Encryption of data at rest
- Regular security assessments
- Access controls and authentication
- Secure development practices
In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay.
Children's Privacy
atmopins is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@atmopins.xyz and we will delete such data.
International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, such as:
- EU Standard Contractual Clauses with service providers
- Adequacy decisions by the European Commission
Note: The AT Protocol is decentralized, and your PDS may be hosted in any country. You control where your primary data is stored by choosing your PDS provider.
Supervisory Authority
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority in your EU member state. You can find your local data protection authority at edpb.europa.eu.
Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may also notify you through the platform or by email if you have provided one.