Bluesky Firehose Explained: Real-Time Data Streaming with Jetstream & ATProtocol | Skyscraper
Posted by jpluimers on 2026/09/01
Discourage apps from showing my account to logged-out users Bluesky will not show your profile and posts to logged-out users. Other apps may not honor this request. This does not make your account private. Note: Bluesky is an open and public network. This setting only limits the visibility of your content on the Bluesky app and website, and other apps may not respect this setting. Your content may still be shown to logged-out users by other apps and websites.
Basically the “posts only visible only to people who are signed in.” is a suggestion to the BlueSky UI front-end, not to the protocols in the back-end that handle your data. Those protocols is what’s described in the above Firehose link.
It means that the new Attie AI scraper always has access to everything you published as it has access to the above Firehose and the BSKY APIs. Anything/anyone with access to that Firehose or the BKSY APIs can access all your data.
The whole “Logged-out Visibility” is just a suggestion, the actual underlying protocols and their access are very much not explained in this visibility post:
[Wayback/Archive] Post by @safety.bsky.app — Bluesky
Logged-out Visibility
Bluesky is a public network, but sometimes, added friction matters. If you don’t want Bluesky to show your content to logged-out users, opt out in the Moderation screen.
On the right I emphasised the privacy consequence in italic.
The Firehose and it’s risks aren’t at all covered in posts like [Wayback/Archive] Why I’m betting on ATProto (and why you should, too).
This is to different from the Fediverse of which Mastodon is the most well known social network, as described by [Wayback/Archive] Mastodon Migration: “How About Some AI With Your BlueSky…” – Mastodon
Mastodon Migration
@mastodonmigrationHow About Some AI With Your Bluesky?
A tale of two social networks.
Last week some enterprising Mastodon account was discovered to be scraping posts to feed to an AI for the purpose of helping people navigate the Fediverse. The response was swift. The alarm went out. The account was widely blocked and shunned.
Yesterday to great fanfare #Bluesky announced, as a new corporate feature, all posts would be scraped and an AI would now help users navigate the ATmosphere.
[Wayback/Archive] Bluesky leans into AI with Attie, an app for building custom feeds | TechCrunch
BTW: below is the [Wayback/Archive] Bluesky User FAQ – Bluesky where I emphasised the bits about public/private in italic as well.
Data Privacy
What is public and what is private on Bluesky?
Bluesky is a public social network. Think of your posts as blog posts – anyone on the web can see them, even those without an invite code. An invite code simply grants access to the service we’re running that lets you publish a post yourself. (Developers familiar with the API can view all posts regardless of whether they have an account themselves.)
Specifically:
- Posts and likes are public.
- Blocks are public.
- Mutes are private, but mutelists are public lists. Your mutelist subscriptions are private.
Why are my posts, likes, and blocks public?
The AT Protocol, which Bluesky is built on, is designed to support public conversations. To make public conversations portable across all sorts of platforms, your data is stored in data repositories that anyone can view. This means that regardless of which server you choose to join, you’ll still be able to see posts across the whole network, and if you choose to change servers, you can easily take all of your data with you. This is what causes the user experience of Bluesky, a federated protocol, to be similar to all the other social media apps you have used before.
Can I set my profile to be private?
Currently, there are no private profiles on Bluesky.
What happens when I delete a post?
After you delete a post, it will be immediately removed from the user-facing app. Any images attached to your post will be immediately deleted in our data storage too.
However, it takes a bit longer for the text content of a post to be fully deleted in storage. The text content is stored in a non-readable form, but it is possible to query the data via the API. We will periodically perform back-end deletes to entirely wipe this data.
Can I get a copy of all of my data?
Yes — the AT Protocol keeps user data in a content-addressed archive. This archive can be used to migrate account data across servers. For developers, you can use this method to export a copy of your repository. For non-devs, the tooling is still being built to make it easy.
Update: Technical folks can read more about downloading and extracting data in this developer blog post.
You can read our privacy policy here.
--jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment