Privacy Policy

This Privacy Policy describes how dummy.cafe ("we," "us," "our") collects, uses, stores, and shares your personal data when you use the dummy.cafe hosting provider — the service that hosts your Atmosphere account on the AT Protocol (ATProto) network.

We are committed to being transparent about what we collect and why. We are a small operation, not a large company, and we try to collect only what we need to run the service.

1. Data We Collect

1.1 Data You Provide

Account information. When you create an account, we collect:

• Your email address
• A password (stored only as a salted, one-way hash — we never store your password in plain text)
• Your chosen handle (e.g., you.dummy.to)

Your account is associated with a DID (Decentralized Identifier) — a permanent, portable identifier for your identity on the Atmosphere network. If you are creating a new account, a DID is generated for you. If you are migrating from another hosting provider, you bring your existing DID with you.

Your content. Everything you create through your account is stored in your data repository on our servers. This includes posts, likes, follows, profile information, and any other records defined by the applications you use. Media you upload (images, videos, and other files) is stored as blobs alongside your repository.

User preferences. Applications on the Atmosphere may store preferences in your account. These may include settings such as content filters, feed preferences, or personal details like a birth date (used by some applications for age-gating features).

Invite codes. If you created your account using an invite code, a record of which code was used and when is stored.

App passwords. If you create app passwords for third-party applications, the password hashes and the names you assign to them are stored.

Communications. If you contact us by email or other means, we retain the content of those communications to provide support.

1.2 Data Collected Automatically

Device and session information. When you sign in using the OAuth authorization flow, we store:

• Your IP address
• Your browser's User-Agent string
• A device identifier and session identifier
• Timestamps of when the session was created and last used

This data is associated with your account for as long as the session remains active.

Server logs. Our servers log HTTP requests for security and debugging purposes. These logs may include your IP address, the request path and method, HTTP headers (with authentication credentials redacted), and timestamps. Server logs are retained for up to 90 days and then deleted.

Rate limiting. We use your IP address to enforce rate limits that protect the service from abuse. Rate-limiting data is held transiently in memory and is not stored persistently.

1.3 Data We Do Not Collect

We do not use cookies, analytics, or tracking technologies on the hosting provider itself. We do not collect your location, device identifiers, or browsing history beyond what is described above. We do not serve ads and do not build advertising profiles.

2. How We Use Your Data

We use your data for the following purposes:

• Providing the service. Storing your account, content, and blobs; authenticating you; syncing your data to the Atmosphere relay network so it is accessible to applications and other people on the network.
• Backups. Making regular backups of your data to protect against data loss (see Section 5).
• Security and abuse prevention. Enforcing rate limits, detecting and preventing unauthorized access, investigating potential violations of our Terms of Service.
• Communication. Sending you transactional emails (password resets, email confirmation, account deletion confirmation), sending service-wide announcements relevant to all users (such as policy changes or infrastructure migrations), and responding to your support requests.
• Service operations. Monitoring uptime, debugging issues, and maintaining the infrastructure.

We do not use your data for advertising, profiling, automated decision-making, or any purpose unrelated to operating the hosting provider.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your personal data on the following legal bases:

• Performance of a contract. Processing your account data, content, and authentication information is necessary to provide you with the hosting service you signed up for (our Terms of Service).
• Legitimate interests. We process server logs, IP addresses, and device information for security, abuse prevention, and service reliability. We process backup data to protect against data loss. These interests do not override your fundamental rights and freedoms — we collect only what is necessary and retain it only as long as needed.
• Legal obligation. We may process data to comply with applicable law, such as responding to lawful requests from authorities.
• Consent. Where required by law and not covered by the bases above, we will ask for your consent before processing.

4. Data Sharing

4.1 The Atmosphere Network

Your account data and content are synced to the Atmosphere relay network as part of normal service operation. This is fundamental to how the protocol works — it is what makes your account accessible to Bluesky and other applications on the network. Data published to the relay network is publicly accessible and may be cached, indexed, or displayed by any service or person that accesses it. We have no control over how third parties use data they receive from the network.

4.2 Third-Party Applications (OAuth)

The Atmosphere supports an OAuth-based authorization flow that allows third-party applications to request access to parts of your account. When you sign in to a third-party application using your Atmosphere account, you will be shown a consent screen describing what data the application is requesting access to (such as your profile information or email address). Data is only shared with the application if you approve the request. You can revoke an application's access at any time.

We do not control what third-party applications do with data you authorize them to access. Review each application's own privacy policy before granting access.

4.3 DID Resolution Infrastructure

Your DID is resolved through public infrastructure (the PLC directory for did:plc identifiers, or DNS for did:web identifiers). This is a core part of the AT Protocol and is necessary for your identity to be discoverable on the network.

4.4 Service Providers

We use the following third-party service providers to operate the hosting provider. These providers process data on our behalf and only as necessary to provide their services:

4.5 Law Enforcement and Legal Requests

We may disclose your data if required by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect the safety of any person, or prevent illegal activity. Where permitted by law, we will notify you of such requests.

4.6 No Sale of Data

We do not sell, rent, or trade your personal data to anyone, for any reason.

5. Backups

We maintain two types of backups to protect your data against loss:

Disk-level backups. Our cloud provider takes full disk backups of the primary service daily. These are retained for 7 days and are used for disaster recovery.

Offsite backups. We run a separate backup service that periodically archives your data repository (as point-in-time snapshots) and your blobs to a separate location in Spain. These backups contain only data that is already publicly accessible on the Atmosphere network — your repository and blobs. They do not include private account data such as your email address, password, or authentication sessions.

Repository snapshots are kept according to a retention schedule: all snapshots from the last 7 days are retained, and for older periods, two snapshots per week (the earliest and latest) are kept. Older snapshots are pruned — the files are deleted, but a record that the snapshot existed is retained for operational purposes. Blobs are archived once and retained indefinitely as long as your account is active.

The offsite backup system maintains a record of your DID, handle, hosting provider endpoint, and account status. This information — along with aggregate backup statistics — is visible on a publicly accessible dashboard. All of this data is already publicly available on the Atmosphere network; the dashboard does not expose any private information.

If your account is deleted, all backup data (repository snapshots, blobs, and associated records) is permanently removed.

If your account is deactivated or otherwise becomes inactive on the network, your existing backup archive is frozen in place — no new backups are taken and no existing backups are pruned — until the account becomes active again.

6. Data Retention

When you delete your account, we remove your account data, content, and blobs from the primary service and from our backup systems. Some data may persist briefly in disk-level backups until those backups are rotated out (up to 7 days).

Data that has already been synced to the Atmosphere relay network or cached by third-party services is outside our control and may persist independently of your account deletion.

7. Your Rights

If you are in the EEA or otherwise covered by the GDPR, you have the following rights regarding your personal data:

• Access. You can request a copy of the personal data we hold about you.
• Rectification. You can ask us to correct inaccurate data.
• Erasure. You can ask us to delete your personal data. For most data, you can do this yourself by deleting content or your account.
• Portability. You can export your data repository and blobs at any time using standard AT Protocol tools. You can also migrate your entire account to another hosting provider.
• Restriction and objection. You can ask us to restrict or stop processing your data in certain circumstances.
• Withdraw consent. Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, email us at hi@dummy.cafe. We will respond within 30 days.

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority in your country of residence. A list of EU data protection authorities is available at edpb.europa.eu.

8. International Data Transfers

Your data is processed and stored within the European Union (Finland and Spain). Our email provider, Migadu, is based in Switzerland, which is recognized by the European Commission as providing adequate data protection.

Cloudflare, which proxies traffic to our service, operates a global network. Cloudflare processes request data (including IP addresses) in transit and may do so outside the EEA. Cloudflare complies with the GDPR and uses Standard Contractual Clauses for international data transfers. For details, see Cloudflare's privacy policy.

9. Children's Privacy

Our service is not directed at children under 14 years of age, and we do not knowingly collect personal data from children under 14. If you believe a child under 14 has created an account, please contact us at hi@dummy.cafe and we will take steps to delete the account.

10. Security

We take reasonable measures to protect your data, including:

• Passwords are stored as salted one-way hashes using scrypt. We never store or have access to your plain-text password.
• Authentication tokens are time-limited and automatically expire.
• Backups are stored on separate infrastructure from the primary service.
• Administrative access to infrastructure is secured and restricted.

No system is perfectly secure. We cannot guarantee the absolute security of your data, but we are committed to addressing any security issues promptly. If you discover a vulnerability, please report it to hi@dummy.cafe.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this document. If we make significant changes to how we handle your data, we will make a reasonable effort to notify you (for example, by email and/or an announcement on Bluesky).

12. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at:

Email: hi@dummy.cafe