bskyplus
This repository has no description
Star
Fork
Watch
bskyplus PRIVACY.md
6.6 kB
Markdown
at main

Bsky+ — Privacy Practices & Permission Justifications #

Bsky+ adds browser-side features to Bluesky. Its preferences are kept in the browser profile, except local bookmark snapshots, which are kept in the bsky.app site database. Some optional features make network requests to Bluesky, a destination the user selects, or a public repository the user asks to import. Those requests expose ordinary connection and request metadata to the contacted service; Bsky+ does not anonymize or proxy general network traffic.

Data stored and sent #

  • Extension settings and themes: Feature preferences, display settings, selected AppView/CDN, theme library, and LLM endpoint settings are stored with the browser extension's storage.local API. This storage is local to the browser profile and is not browser-synced. LLM settings can include an endpoint URL, model name, API key, and custom prompt. Clearing the endpoint and saving disables +LLM, but retains the model, key, and prompt. Clear each field separately and save to remove it. Clearing the endpoint also does not revoke a previously granted site permission; remove that in browser settings if desired.
  • Local OCR: OCR uses the bundled Tesseract.js worker and WebAssembly in the browser. Bsky+ does not send the image to an OCR provider. The browser may still retrieve the image from its existing Bluesky image URL.
  • Optional +LLM: After an endpoint is saved and the user clicks +LLM for an image, Bsky+ sends that selected image and the active system or custom prompt to the saved OpenAI-compatible chat/completions URL. If configured, the model name is included in the request and the API key is sent in an Authorization header. The request does not add composer post text or other attached images. HTTP and HTTPS endpoints are accepted; use HTTPS for non-local endpoints. The endpoint operator may process or retain the request under its own practices. A localhost endpoint can keep model processing local.
  • Local bookmarks: When enabled, Bsky+ downloads saved-post views through the signed-in Bluesky session and stores them in the bskyplus-bookmarks IndexedDB database on the bsky.app origin. Snapshots are keyed by account DID and bookmark AppView. They can include post text, author and embed data, image descriptions, and media URLs; media files and session credentials are not persisted. The data is local to that browser profile, is visible to code running on the bsky.app origin, and is not browser-synced. Disabling local bookmarks disables local caching and clears all account and AppView snapshots in that browser profile, including caches created with previously selected providers. Clearing bsky.app site data removes the database.
  • AppView and image CDN: An alternative AppView receives the feed and social API traffic routed to it. Authenticated requests remain addressed to the account's PDS with an atproto-proxy header naming the selected AppView; public GET requests to a known AppView may be sent directly to that host without browser credentials. Bsky+ does not redirect account settings, posting, chat, or video-upload requests to an alternative AppView. The optional image CDN redirects only Bluesky feed-thumbnail, full-size, and avatar image URLs to the selected HTTPS hostname. Operators of the PDS, AppView, original CDN, or selected CDN receive ordinary metadata for requests they handle.
  • WitchSky theme import and post editing: Importing a public WitchSky theme resolves the DID (plc.directory for did:plc, or the named host for did:web) and fetches its public theme record from the repository's PDS. These requests omit browser credentials and the referrer. The imported theme is saved locally. When the user saves an edited post, Bsky+ uses the current Bluesky page session to read the record and submit the changed record to the signed-in account's PDS. It does not store a copy of the session token.
  • Page features: Features such as theme rendering and thread unrolling change the Bluesky page in the browser. Bsky+ has no analytics endpoint or developer-operated data collection server. Its JavaScript and OCR code are packaged with the extension; responses from LLMs and public theme services are handled as data, not executed as remote code.

Chrome permission justifications #

The Chrome manifest explicitly declares https://bsky.app/* in host_permissions. Its content scripts separately match *://bsky.app/* and *://*.bsky.app/* so the page features can run on Bluesky hosts. These scripts add composer and settings controls, apply page preferences, and support bookmarks, post editing, AppView routing, and display features.

  • storage: Saves extension settings and preferences in storage.local.
  • offscreen: Hosts the bundled Tesseract OCR worker when the user runs local OCR; it does not provide a remote OCR service.
  • declarativeNetRequestWithHostAccess: Applies packaged settings-page redirects and the optional image-CDN redirect rule. The CDN rule is limited to the listed Bluesky image URL paths and runs only while the user-selected source and destination host permissions are granted.
  • Optional HTTP/HTTPS hosts: The manifest allows Bsky+ to ask for access to a user-configured LLM endpoint or image CDN when needed. The LLM request goes to the saved URL; the CDN feature asks for the Bluesky image host and chosen CDN host. Public theme import can also contact the domains named by the imported DID and PDS record.

Firefox permission justifications #

The Firefox manifest has the same explicit https://bsky.app/* host permission and the same separate content-script match patterns as Chrome. It declares storage, webRequest, and webRequestBlocking. The two webRequest permissions support the optional image-CDN redirect; its listener is limited to the feed-thumbnail, full-size, and avatar paths on cdn.bsky.app. The manifest also declares optional HTTP/HTTPS host permissions for user-selected network destinations such as an LLM endpoint or image CDN.

Firefox declares no required data-collection types and the optional types websiteContent and authenticationInfo. On Firefox desktop 140+ and Android 142+, saving an LLM endpoint requests websiteContent consent, plus authenticationInfo if an API key is saved. Bsky+ checks the applicable consents and endpoint host access before sending each request. Older Firefox versions request endpoint host access without the built-in data-consent prompt.