Supersky is a browser extension that lets you post to Bluesky, share pages, and keep up with your notifications from your browser toolbar. This page explains what data the extension handles and where that data goes.
The short version: Supersky has no servers, no analytics, and no tracking. Your credentials, drafts, and settings stay in your browser. Data only ever travels to Bluesky's own services (your Personal Data Server, plus Bluesky's link preview and image services), and only when you ask the extension to do something, like publish a post.
Who this policy covers
This policy covers the Supersky browser extension as distributed through the Chrome Web Store and similar extension stores. It does not cover Bluesky itself or any Personal Data Server (PDS) you connect to. Those services have their own policies; for how Bluesky handles the content you publish, see the Bluesky Privacy Policy.
Data the extension handles
Supersky handles the data below to do its job, nothing more. Unless a row says otherwise, the data is stored locally in your browser with the extension storage API. None of it is sent to us. There is no server on our side to send it to.
| Data | Why it's handled | Where it's stored / sent |
|---|---|---|
| Bluesky login & authentication information | You sign in with your Bluesky handle and an app password. The app password goes to your Personal Data Server to create a session, and the session tokens it returns are used to post and read notifications on your behalf. | Sent to your PDS (default bsky.social) to authenticate. Session tokens are stored locally in your browser only. |
| Account profile (handle, DID, display name, avatar) | Shown in the composer and account switcher so you always know which account you are posting as. | Fetched from your PDS; a snapshot is cached locally in your browser. |
| Post content you create (text, images, GIFs, alt text, language, interaction settings) | This is the post you choose to publish. It is uploaded to Bluesky when you press Post. | Sent to your PDS to publish. Unsent drafts (including any attached images) are saved locally in your browser and cleared once posted or deleted. |
| Videos you attach | Bluesky videos are processed by Bluesky's own video service before they can appear in a post. | Uploaded to video.bsky.app (a Bluesky service) when you attach one, using a short-lived token from your PDS. Videos are not kept in local drafts. |
| GIF search terms | Typing in the GIF picker searches Bluesky's GIF service so you can attach an animated GIF. | Sent to gifs.bsky.app (Bluesky's GIF proxy, backed by Klipy). Search terms are not stored. |
| Current page information (URL, title, selected text) | When you use a share action or open the composer, the extension reads the active tab so it can pre-fill your post and build a link preview. | Read from the active tab only when you trigger it, and included in a post only if you publish it. Never logged or tracked. |
| Posts you publish on X (text, attached images, and video) | With the optional cross-post suggestion on, publishing a main post on x.com pops a small "Post this on Bluesky too?" card pre-filled with that post. | Read locally in your browser, only at the moment you publish on X, and only for main posts (never replies, quotes, or messages). Sent to Bluesky only if you confirm (videos upload to video.bsky.app for processing); discarded otherwise. The suggestion can be turned off in settings or from the card itself. |
| Link URLs (for previews) | To show a rich link card, the first URL in your draft is sent to Bluesky's card service. | Sent to cardyb.bsky.app (a Bluesky service) to generate the preview. |
| Extension settings | Theme, accent color, default post language, and notification preferences. | Stored locally in your browser only. |
Who your data is shared with
We do not sell, rent, or share your data with anyone for advertising, analytics, or anything else. Your data only travels to the Bluesky services needed for the action you asked for:
- Your Personal Data Server (PDS):
bsky.socialby default, or another server if you enter one. Used to sign in, publish posts, and read your notifications and profile. cardyb.bsky.app: Bluesky's link card service. It fetches the title, description, and thumbnail for links you include in a post.cdn.bsky.app: Bluesky's content delivery network. It serves the author avatars shown inside desktop notification banners.gifs.bsky.app(and its media subdomains): Bluesky's GIF search proxy, backed by the Klipy GIF library. Used only when you open the GIF picker.video.bsky.app: Bluesky's video processing service. Videos you attach are uploaded there to be transcoded before posting.
These interactions fall under Bluesky's own terms and privacy policy. Supersky runs no backend, receives none of your data, and loads no third-party code.
What we do not do
- No analytics, telemetry, tracking pixels, or fingerprinting.
- No ads and no sale of data.
- No collection of your browsing history. The extension reads a page only when you invoke a share action, open the composer, or (if the cross-post suggestion is on) publish a post on x.com.
- Nothing is ever sent to the developer. There is no server on our side.
Where your data lives and how long it stays
Session tokens, drafts, cached profiles, and settings live in your browser via the extension storage API. They stay there until you sign out, clear them, or uninstall:
- Signing out of an account removes its session tokens and cached profile from your browser, and asks your PDS to revoke the session.
- Uninstalling the extension removes all locally stored data.
- You can also cut off Supersky's access at any time from your Bluesky app password settings, with or without the extension installed.
Permissions
Supersky requests only what its features need: storage and unlimitedStorage (save settings, drafts — including their images — and sessions locally), alarms (check your unread notification count in the background), contextMenus (the right-click "Share on Bluesky" items), activeTab (read the current page's URL and title when you share it), notifications (desktop banners for new activity), and host access to cardyb.bsky.app, cdn.bsky.app, gifs.bsky.app, and video.bsky.app (Bluesky's link preview, image, GIF, and video services). The cross-post suggestion additionally runs on x.com and twitter.com only, solely to notice when you publish a main post there and offer to share it on Bluesky. There is no blanket access to other pages you visit; the extension only touches a page at the moment you share or publish from it.
Children's privacy
Supersky is not aimed at children under 13 (or the minimum age of digital consent where you live) and does not knowingly collect their data. Bluesky account eligibility is governed by Bluesky's own terms.
Changes to this policy
If this policy changes, the "Last updated" date above will change with it, and meaningful changes will be noted in the extension's release notes.
Contact
Questions about this policy or your data? Email bhandariankit2075@gmail.com. The source code is public at github.com/Nester-xyz/Supersky.