Privacy

The short version: everything you write in your ordinary outline is public, a space is the one exception and it is not the default, the server can write to your repository while you are signed in, and none of that is a bug.

Everything in your ordinary outline is public

A bullet is a record in your own AT Protocol repository. Records in a repository are public by default, so every bullet, note, and title you create through this site outside a space is readable by anyone who asks your server for it. They do not need an account here. They do not need this site to be running. They do not need our cooperation in any way, and we could not withdraw it if we wanted to.

That is the product rather than a shortcoming, and it is worth being blunt about it because the interface looks like a private notebook. It is not one. Treat it the way you would treat a public post: do not put passwords, identifiers, other people's private information, or anything you would be unhappy to see quoted into it.

Deleting a bullet deletes the record from your repository, which is the real deletion — the copy on your own server goes away. What it cannot do is retract copies other people already took. The record was public and the network distributes public records; anyone running an index of their own may still have it, and that is outside anyone's control including yours.

A space is the one exception, and it is not the default

Bullets written inside a space are not published to the network and are not held here as public records. They are readable by that space's members, and whether somebody is a member is decided by the server hosting the space rather than by Bulleted — this application asks, and shows you what it is allowed to see.

Two things follow and both matter. A space protects you from strangers, not from its own members: anyone admitted can read everything in it. And the protection is enforced by your provider's implementation of the spaces plane, which means it is exactly as good as that provider is. That is a question to put to them rather than to us.

Sharing a space between several people is still being built. What works today is a private space of your own, so in practice a space currently has one member — you. The paragraph above is written for what a space is for, so that it is already true when it is shared rather than corrected afterwards.

While you are signed in, this server can write to your repository

Bulleted signs you in with OAuth and then keeps the resulting tokens itself, encrypted in a cookie your browser cannot read. Every write goes out from this server rather than from your browser. That design is what lets bullet ordering, record key generation, and link parsing have a single implementation instead of two that drift, and it keeps the tokens out of any script running in the page.

The cost is direct and should not be glossed: for as long as your session lasts, this server holds a credential capable of creating, changing, and deleting records in your repository. Not read access — write access. The permission we request is limited to the six app.bulleted.* record types and to image uploads, so it cannot touch your posts or your follows, but within that scope the capability is real and it is held here rather than by you.

Sessions last seven days and are shorter than they could be for exactly this reason. Signing out discards the tokens. You can also revoke Bulleted's access from your own server at any time, which works whether or not this site cooperates, and is the stronger of the two options.

Other people's outlines are indexed here, and search engines are allowed in

Bulleted keeps a local index of public app.bulleted.* records so that reading an outline is fast. That index is not limited to people who have signed in. Viewing any identity's outline causes Bulleted to fetch and index that repository, and following a transcluded bullet does the same for the repository it points into. Those outlines are then rendered on this domain, at a URL under /public/, whether or not their author has ever heard of this site.

Our robots.txt permits crawlers on those pages, deliberately. Refusing to be indexed would not make the records private. They would remain exactly as readable by anyone who queried the network directly; the only thing that changes is whether an ordinary person can find them. Pretending otherwise would be a courtesy to us and not to the people whose records these are.

If you would rather your outline not be rendered here, ask to be taken out of the index. Records are removed on request, no account and no explanation needed. Removal from the index is all we can do — the records themselves are in your repository, and you are the only one who can delete them.

Preview images can outlive their removal at a CDN edge

An outline may carry a preview image for link cards. Those images are served through a cache addressed by content hash, which means a given URL names one exact sequence of bytes forever and can never mean anything else. Responses are therefore marked immutable and cached for up to a year, which is what stops every link preview from re-fetching the image from your server.

The consequence is that deleting an image, or having one removed from this index, does not reach a copy already held at a content delivery network's edge. That copy can persist until its cache entry expires, which may be as long as a year. Bulleted's operator can purge it by hand and does so when a removal is for a reason that warrants it, but the purge is a manual step at the CDN rather than something the deletion performs by itself. Anyone who fetched the URL before the purge already has the bytes regardless.

What this site stores about you

Two cookies. One is the encrypted session described above, which your browser cannot read and which holds the OAuth tokens. The other holds your handle, your identifier, and your server's address, is readable by the page, and exists so the header knows who you are without a round trip. Neither is used for tracking, and there is no third-party script on any page here to do the tracking with.

Beyond that: the indexed copy of the public records described above, ordinary web server logs, and counters of how much work the server is doing. There are no advertisers, no analytics, and nothing is sold or shared. Nothing is sent to a model.

Getting in touch

Email security@bulleted.app. It is one address for reports of every kind, and it reaches the maintainer directly. Bulleted is built and run by one person, Nick Gerakines (@ngerakines.me). For a removal request specifically, Abuse and removal says what to include and what removal can and cannot do.