Privacy Policy

Last updated: 11 October 2026

This Privacy Policy explains how Luke Cashion-Lozell ("we", "us", "I") collects and handles personal information when you use the did:pic mobile app, the did:pic AppView service, and the didpic.app website (together, the "Service"). We're based in Queensland, Australia. This policy follows the Australian Privacy Principles ("APPs") under the Privacy Act 1988 (Cth). If you're in the EU, UK, or California, additional protections may apply - see "Your rights" below.

What we collect

From your PDS

When you sign in with AT Protocol, you choose a provider (Bluesky, Blacksky, Eurosky, or another) to host your account. Your actual records - profile, posts, comments, likes, follows - live on that provider's PDS. We don't host them. We read the public records from the AT Protocol firehose (a public stream of records) and cache them in our AppView so the app is fast.

Specifically, we cache the following public data about you:

• Your DID (such as did:plc:... or did:web:...)
• Your handle (e.g. alice.bsky.social)
• Your display name, bio, avatar, and banner
• Your posts, including image references, captions, and timestamps
• Your likes, comments, follows, and self-applied content labels (e.g. NSFW)
• Counts derived from the above (followers, likes received, etc.)
• Your follow graph on Bluesky, used as a discovery ranking signal

All of this is public on AT Protocol by design - anyone with access to the firehose can read it. We don't store private records.

From your device

• Push notification tokens, only if you grant notification permission. Used to deliver pushes via the Expo Push service. Stored against your account so we know where to send.
• Notification seen state - a timestamp marking how recently you've checked your notifications.
• Account preferences stored on our AppView (content-label preferences, last-viewed feed, alt-text prompts and filters). Keyed to your DID and auth-gated - only readable and writable by you. We'd happily put these in the AT Protocol preferences blob on your PDS, but the PDS rejects any preference shape not in the app.bsky.* namespace, so for now they live with us.
• On-device only - theme and text-size preferences stay local.
• Cached blob images stored in your device's app cache. Deleted when you clear the cache or uninstall.

Direct messages

If you send a direct message, we store it - including any photo - on our servers so it can be delivered and read by you and the recipient. Unlike your posts, messages are not public and are not stored on your PDS.

Sign-in

OAuth-only. You authenticate with your PDS; your PDS issues a token that lets the app act on your behalf. Signing in never shares your password with us. The one exception: deactivating or deleting your account asks for your password once, and the app sends it directly to your PDS provider - it never touches our servers and is never stored.

Newer versions of the app hold that sign-in session on our server rather than on your device. This lets the app read and post on your behalf without your device needing to hold the underlying credentials itself. That session is stored against your DID and used only to operate the Service for you - we don't use it for anything else, and we don't share it with anyone. It's deleted when you sign out, when it's no longer needed to keep your session going, or when you delete your account.

NSFW content settings

NSFW content is hidden by default. Your choice of how to handle it (hide, blur, or show) is stored as a preference on your account. The first change must be made on the didpic.app website; after that you can manage it in the app. We never collect your age or date of birth.

Usage analytics (Google Analytics)

To understand how did:pic is being used (how many people are active, when, and on what platform), the app sends a small set of usage events to Google Analytics, via the Firebase SDK: app opens, screen views, signups, posts, likes, comments, follows, subscriptions, and blocks. No event contains the content of a post, the text of a comment, or your DID, handle, or any other identifying detail in cleartext.

Each event carries:

• A timestamp and event name (e.g. post_created)
• A hashed user identifier - the same person across sessions gets the same identifier (so distinct users can be counted), but the identifier itself doesn't carry your DID, handle, or any other identifying detail.
• Your approximate location, platform (iOS or Android), and app version, determined automatically by Google Analytics.
• For some events, a small set of flags (e.g. whether a post included alt text).

Google processes this data on our behalf under its own privacy policy, and it's retained according to our Analytics property's configured retention window.

On account deletion: we don't delete your past analytics events - the identifier on each event is a one-way hash, so they no longer relate to you once your account is gone. Keeping them lets us preserve accurate historical aggregates (DAU, platform mix).

Server-side moderation labels

Our moderation team may apply content labels (such as nsfw) to specific posts or accounts that violate our Community Guidelines. These labels are public - they're served alongside the relevant posts and accounts in the AppView's responses.

How we use it

• Operating the Service (showing you posts, delivering notifications)
• Responding to your support enquiries
• Enforcing our Community Guidelines and Terms of Service
• Complying with legal obligations
• Preventing abuse, spam, and security threats

Who we share it with

• Your chosen PDS provider - your actual data lives with them. Their privacy policy applies to that data.
• Expo Push (expo.dev) - push notification delivery service. Receives push tokens and notification payloads (title + body + minimal metadata).
• Google Analytics (Google) - usage analytics. Receives hashed user identifiers and the anonymous usage events described under "Usage analytics" above.
• Cloudflare Pages - our website host. Standard request logs only.
• Apple App Store and Google Play Store - they distribute the app. Their privacy policies apply to app-store interactions.
• Australian or foreign government / law enforcement, if compelled by a valid legal request.

We do not sell your personal information.

How long we keep it

• AppView cache: as long as it's on the firehose and your account is active.
• Push tokens: until you sign out, change accounts, or your device's token expires / gets reported invalid.
• Server-held sign-in session (newer app versions): until you sign out, it's no longer needed to keep your session going, or you delete your account.
• Local device data: until you uninstall the app or clear app storage.
• Direct messages: until deleted by the sender, or your account is deleted.
• Server-side labels: until the underlying content is removed or the label is revoked.
• Usage analytics events: retained in Google Analytics per our property's configured retention window.

Your rights

You have the following rights under the APPs and (where applicable) GDPR, UK GDPR, and CCPA:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and the data we cache - see Account Deletion
• Withdraw consent, e.g. revoke notification permission via OS settings
• Complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these, email [email protected]. We aim to respond within 30 days.

Age requirement

did:pic is for adults. You must be 18 years or older to use the Service. We don't knowingly collect data from anyone under 18. If you believe a minor has signed up, contact [email protected] and we will close the account. See our Minors Policy for more.

Changes to this policy

If we make material changes, we'll update the "Last updated" date and post a notice in the app and on this page. Continued use after changes constitutes acceptance.

Contact

• Privacy email: [email protected]
• Operator: Luke Cashion-Lozell, Queensland, Australia