Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/improsocial/impro
An extensible Bluesky client for web impro.social
Something went wrong. Try again.
HTML
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131<!doctype html><html lang="en"> <head> {% include "head.html" %} </head>
<body> <main class="plain-text-page"> <h1>Privacy Policy</h1> <p><em>Last updated: September 12, 2026</em></p> <p> Impro is a third-party web client for Bluesky. It is not affiliated with Bluesky PBC. This policy describes the web client. The services you connect to and any community plugins you enable have their own data practices. </p>
<h2>Data collection, hosting, and analytics</h2> <p> We do not collect or store personal data on our servers. This statement does not mean that using Impro involves no third-party processing: hosting, analytics, account services, and the features described below involve requests to other providers. </p> <p> Impro is hosted on Cloudflare and uses Cloudflare Web Analytics, which does not use cookies or track individual users. Cloudflare may process technical data, such as country-level location and device type, as described in Cloudflare's Privacy Policy. </p>
<h2>Authentication and account access</h2> <p> Impro uses Atproto OAuth to authorize access to your account. Session credentials are stored in your browser's local storage and used to make authenticated requests to your account's services. Impro requests permissions for a full social client, including reading and publishing posts, managing follows and blocks, accessing preferences and bookmarks, and reading and sending chat messages. Review the permissions shown when authorizing Impro. </p> <p> Where server-signed OAuth client assertions are enabled, your browser also sends the authorization server's address to Impro's signing endpoint. That request is used to obtain a client assertion; it does not contain your account's access or refresh tokens. </p>
<h2>Browser storage and account services</h2> <p> Impro stores session information, device settings, and some plugin data in your browser. Clearing Impro's site data removes browser-held data; it does not delete posts, messages, preferences, or other data held by your account's services, or revoke server-side authorizations. </p> <p> Account actions and data requests are sent to the relevant services, including your account host, the selected feed and profile service, and the chat service. Bluesky-operated services are governed by Bluesky's Privacy Policy. If you use another account host or select an alternative service, that provider's practices also apply. </p>
<h2>Additional lookups and embedded content</h2> <p> Impro uses Microcosm's Constellation service to look up records linking to a subject, including replies used to restore thread context. These requests include the subject identifier and the type of link requested. Impro also uses Microcosm's Slingshot service for identity resolution and plugin-accessible record lookups. Those requests include the handle, account identifier, or record identifiers being looked up. </p> <p> These requests go from your browser to the service, which receives the query and connection information such as your Internet Protocol (IP) address. They do not include your Bluesky session tokens. </p> <p> Loading media and other external resources involves requests to their providers. For example, playing an embedded YouTube video loads a player from YouTube's privacy-enhanced domain. The provider's own privacy practices apply when its content is loaded. </p>
<h2>Community plugins</h2> <p> Community plugins are optional third-party code. Browsing the plugin registry and downloading plugins involves requests to their hosting providers, including GitHub or Tangled repositories. </p> <p> Plugins run in a sandbox, with network requests mediated by Impro's permission system. Access to private account data, such as mutes, bookmarks, notifications, and preferences, requires permission. Plugins can also store data locally or in account preferences. </p> <p> A plugin with permission to access data and contact an external destination may send that data to the destination. The sandbox does not guarantee how a plugin uses permissions you grant. Review each plugin's permissions and its developer's data practices before enabling it. </p>
<h2>Optional push notifications</h2> <p> Push notifications require selecting a notification service and enabling notifications. Setup registers your browser's push subscription with the selected service. If the service requires a separate authorization step, Impro sends it your account identifier, a return address, and whether you requested chat previews. </p> <p> The notification service and your browser's push provider are additional parties involved in delivery. Review the selected service's permissions and privacy practices, particularly before enabling chat previews. You can disable push notifications in Impro's settings. </p>
<h2>Contact</h2> <p> For questions about this policy, contact the project through <a href="https://github.com/improsocial/impro/issues">GitHub</a>. GitHub issues are public; do not include passwords, session tokens, private messages, or other sensitive account information. </p> <br /> <a href="#" onclick="window.history.back()">Go Back</a> </main> </body></html>