Privacy Policy

Last updated: September 28, 2026

This is a translation. If it differs from the Japanese version, the Japanese version prevails.

1. Introduction

uchu.social (the "Service") respects your privacy and works to protect personal information. This Privacy Policy explains how the Service handles information.

2. Information we collect

• Email address (required): used to verify sign-up, for sign-in codes, password resets and important notices.
• Password: stored only in a form that cannot be reversed (a hash); the password itself is never stored.
• Account information: your DID, handle and account signing key. The private signing key is kept on the Service's servers.
• Content: data stored in your account's repository — posts, images, videos, profile and so on — data stored in Spaces, and app settings (preferences stored privately).
• Security settings: two-factor authentication settings, app passwords, and the permissions you granted to connected apps.
• Access information: IP address, browser or app type, and access times. Used to prevent fraudulent sign-ups and sign-ins, to enforce rate limits and to investigate problems.
• Cookies: used to keep you signed in on the authorization screen of connected apps, and to protect the sign-up form from tampering.

3. How we use it

• Providing and operating the Service (hosting accounts and data, distributing it over the AT Protocol network)
• Identity verification, authentication and session management
• Sending the email needed to provide the Service, such as verification codes and notices (we do not send advertising email)
• Dealing with spam, unauthorized access and violations of the Terms
• Complying with the law
• Improving the Service

4. Information public on the network

Because of how the AT Protocol works, the following is public on the network:

• DID document: your handle, the location of the PDS hosting your account, and public keys. It is recorded in the PLC directory (plc.directory) and cannot be deleted, including its history.
• Repository content: posts, images, profile and so on. Third parties such as relays and AppViews (for example, those run by Bluesky Social PBC) fetch, copy and store it.

Your email address, password, app settings and Spaces data are not public.

5. Sharing and processors

We do not share your personal information with third parties except:

• with your consent, or where required by law;
• information made public by the AT Protocol, as described in section 4;
• Connected apps: we provide information to connected apps within the permissions you grant. Your email address is provided only if you allow an app to see it;
• Relaying requests: some requests from connected apps are relayed to services such as Bluesky's AppView, and your DID is sent with them;
• Processors: the following companies handle information on our behalf, to the extent needed to provide the Service:
  • Railway Corporation (United States): servers and data storage. Data is stored in a data center in Singapore
  • Resend, Inc. (United States): sending email. Handles recipient addresses and message contents
  • Cloudflare, Inc. (United States): domain name (DNS) management

These processors are located outside Japan. Each takes measures to protect information under its own privacy policy.

6. Retention

• Account information and content are kept while the account exists.
• After an account is deleted, data left on the Service's servers is erased promptly, and removed from backups within a set period.
• Sign-up and sign-in codes are erased once they expire (after at most a few tens of minutes).
• Access logs are erased according to the hosting provider's retention period.

7. Security

We take measures against leaks, tampering and loss, including encrypted connections (HTTPS), password hashing and restricted access to administrative functions.

8. Cookies

The Service uses only the cookies needed for the purposes in section 2. We use no analytics or advertising cookies.

9. Your rights

• You can edit and delete content, and delete your account, through connected apps and similar means.
• You can download your repository and move your account to another PDS.
• To request disclosure, correction or suspension of use of the personal information we hold, contact us.

10. Age

The Service is not intended for people under 13. If we learn an account belongs to someone under 13, we will delete it.

11. Changes to this policy

We may change this Privacy Policy when needed. We will post any changes on the Service.

12. Contact

biz[at]spuit.tech