Sign in →

Privacy notice

Version 1.6 · 24 September 2026

Eurosky Publisher reads a publication's feed and posts each new article to the publication's own account on the open social web, shows publishers how those posts were received, and gives outlets a page in the Eurosky app. This notice says what that means for personal data: for the publishers who use the service, for the outlets and journalists in our registry, for the people who react to an outlet's posts, and for anyone who visits this site.

1. Who we are

The data controller is Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands (RSIN 868779465). We run the service under the name Eurosky Publisher at https://publisher.news.eurosky.tech.

For anything about personal data, write to privacy@eurosky.tech. Our Data Protection Officer can be reached directly at dpo@eurosky.tech. For everything else about the service, write to support@eurosky.tech.

You can also complain to a supervisory authority. Because we are established in the Netherlands, the lead authority is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); if you live in another EU or EEA state, you can also complain to your own national authority.

2. What this notice covers, and what it does not

It covers what this service does with personal data. It does not cover:

3. If you publish through this service

When you sign in, we create an account here for the account you signed in with. We hold:

We process this to provide the service you asked for (Article 6(1)(b) GDPR); to keep the service and the network it posts to free of abuse, which is our legitimate interest and every other publisher's (Article 6(1)(f)); and, where the law requires it, to comply with a legal obligation (Article 6(1)(c)).

4. Signing in, and signing up

Signing in happens at your own server, over the standard atproto OAuth flow. Your password is entered there, not here; we never see it. What we receive is an authorisation bound to this service, which we store encrypted. It lets us create posts and upload images on your account, follow and block the Mastodon bridge account if you switch the bridge on, and change your handle if you ask us to move it to your own domain. It lets us read the email address on your account only if you granted that, and we use that address for nothing but the mail described in section 11. A server that does not yet offer these fine-grained permissions can only grant a general one that would allow more; we use it for nothing beyond the above. We renew the authorisation daily, and you can withdraw it at your server at any time, without asking us.

If you arrive without an account, we create one for you on the Eurosky Personal Data Server (eurosky.social). The handle and email address you choose and the password you set go from this site to that server; we do not keep the password. The signup form carries an hCaptcha widget, because that is what stands between this service and automated signups: hCaptcha is provided by Intuition Machines, Inc. (United States), which sees your network address and browser details to decide whether you are a person, under its own privacy policy. We pass the solved captcha to the server's gatekeeper and nothing else. From then on the account is a Eurosky account, governed by the Eurosky documents named in section 2, and you sign in with it as above.

To keep the signup door from being used by scripts, we record every attempt: the outcome, the domain of the email address and of the handle, and a keyed hash of the network address it came from, which cannot be turned back into the address. These records are deleted after 30 days.

5. Your feed, and the posts we make

We fetch your feed on the schedule you set, and for each new article the page it links to, to find an image for the post. Each post is written into your own account on your own server, under your name, and is public there like everything else you post. From then on it is carried by the network: relays, indexes and applications we do not run read it, and deleting it is something you do at your server.

If you switch Mastodon on, we follow the bridge account of Bridgy Fed from your account, and from then on Bridgy Fed carries your posts to the fediverse. Bridgy Fed is a free service run by somebody else, not by us, in the United States; it reads your public posts and profile like any other participant on the network, under its own policy. Switching it off deletes the follow and blocks the bridge instead, and is in your dashboard.

We read your articles for nothing other than composing the post they become and, if you switch it on, showing them on your outlet page in the app.

6. Vetting: what we look up about you

A person approves every publisher. To help them decide, we gather from public sources what anyone could find out: when your domain was registered and where, from the registry data at rdap.org; whether your site carries a legal notice, by reading the pages where one usually is; whether your domain proves it belongs to your account, by the standard record on it; and how often your feed publishes and for how long it has. This becomes a short dossier with a score, which our operators see and can refresh. Nothing is decided by the score: it orders the queue, and a person reads the application.

Our operators may also keep notes on your account and your outlet, so that whoever answers next knows what was said. You can ask to see them (section 15).

7. Your outlet page, and the registry

We keep a registry of news outlets: name, handle and identifier, website domains, avatar, an accent colour, categories, the journalists who work there, and which feeds appear on the outlet's page. Some entries we made ourselves, from what the outlet publishes about itself, before anyone there had heard of us: a newspaper's public account is public information, and listing it is how the app can show a page for it. An outlet that signs in takes its entry over; corrections it proposes are applied by an operator.

Listed outlets are published through a public, read-only interface that the app reads to render an outlet's page, and that anybody can read: the registry entry, and the articles of the feeds the outlet put on its page. Nothing about a publisher's account, authorisation or email address is ever part of it.

Journalists on an outlet's staff list are recorded by identifier, handle, display name and avatar, with whether a verifier vouches for them. They are added by the outlet or by us and approved by us; a journalist who does not want to be listed can ask either of us to be removed.

For every outlet in the registry, whether or not it has signed in, we record the posts its account makes (the post's address, its text, and when it was made) and how many likes, reposts, replies and quotes each one collects. That is what the statistics are drawn from. We watch a post as it happens for 180 days after it was made; for a post older than that, including one made before the outlet was in our registry, we ask a public index once what it collected (section 8). A post its author deletes stops counting.

If you answer a reply from your dashboard, we store what you wrote, send it from your account, and keep it with the address of the post it became — so the screen can show what you said and so a failed send can be told from a successful one. We keep it for as long as your outlet is in our registry. It is your post: it lives on your own server like everything else you publish, and deleting it there removes it from the network.

8. If you reacted to an outlet's post, or follow an outlet

This section is for people who may never have used this service: everyone who likes, reposts, replies to or quotes an outlet's post, or follows or unfollows its account. We record those actions, because they are what an outlet asks about first.

What we record: which account did it, which of that account's records it was, what kind of reaction, when it happened, and when it was taken back. All of this is public on the AT Protocol by design (a like is a record you publish to the network), and it reaches us in three ways: from the stream of network events we read as they happen; from Constellation (constellation.microcosm.blue), a community-run index of what links to what, which we ask about an outlet's posts to fill in what happened before we were watching; and from an outlet's own repository, which lists the posts we then ask about. We read that repository from the outlet's own server, or from Hubble (hubble.microcosm.blue), a community-run public copy of the network's repositories, kept by the same people as Constellation. Constellation is asked about an outlet's posts whenever they were made. One more way, for follows alone: who already followed an outlet when we started watching it, and the key of each of those follows, we read once from our own AppView (api.eurosky.network).

If you replied to or quoted an outlet's post, we also store what you wrote. A reply is a post you published to the network, and it is the one reaction that says something rather than counting something — an outlet reads its replies the way it used to read its comment section. We keep the words for 90 days, which is the longest period any of our screens can show, and then delete them; the fact of the reply stays, so it goes on counting towards the totals. Delete your reply on your own server and it stops being shown here. We also record what the moderation services we follow have said about your reply or your account, which we ask for at the same time as the words: it is what keeps a labelled reply behind a "show" rather than on the screen unasked.

What you attached to a reply — pictures, a link, a post you quoted — we keep as the network publishes it: the addresses where the pictures are, their descriptions, the link's title and description, and the quoted post's author and words. Not the pictures themselves, and nothing attached to a quote. It is kept exactly as long as the words, 90 days, and deleted with them.

To show a name rather than an identifier, we look up the public profile: handle, display name, avatar, description, how many accounts follow it and how many it follows, how many posts it has made, when it was created, and whether a verifier vouches for it. We ask our own AppView (api.eurosky.network) and, for the verification mark only, Bluesky's public API (public.api.bsky.app, run by Bluesky Social, PBC in the United States). The profile is refreshed after 30 days.

What the outlet sees: totals over a period, a chart of reactions per day, the posts that did best, the number of new and lost followers, how many of its followers also follow each other outlet in our registry and how many moved from one to the other, and the twelve accounts that reacted most, by handle and name. Our operators see the same page for every outlet. Nobody is shown your name because you followed or unfollowed an outlet, or follow more than one; only the count.

We do this in our legitimate interest and the outlet's (Article 6(1)(f) GDPR): to tell a publication how the things it publishes are received, using only what you chose to make public, without building a profile of you for any other purpose, and without it deciding anything about you. You can object at any time by writing to privacy@eurosky.tech: we will remove the records that name you, and the outlet's totals are recomputed without them.

We keep these records for as long as the outlet is in our registry, so that its history stays readable, or until you object.

9. Labels and verification marks

A label is a moderation decision published by a labelling service, and a label on an outlet's post is the likeliest explanation for a post that went nowhere. We ask Bluesky's moderation service, and any other labeller we are configured to follow, what it currently says about an outlet's account and posts, and keep a copy: the label, what it applies to, when it was applied, and when it was lifted.

A verification is a record a verifier publishes naming the account it vouches for. We keep a copy of those issued by the verifiers on the list the app trusts, read from the verifiers' own repositories: who verified whom, the handle attested, when, and when it was withdrawn. It is how an outlet, a journalist or a reacting account gets its mark.

Both are public records, published for anyone to read. We hold them in our legitimate interest in explaining an outlet's numbers and in showing the same marks the app shows.

10. Visiting this site

Our web server records each request: the network address it came from, the browser, the time, and the page. These logs are used to keep the service running and to investigate abuse, and are kept for 30 days unless a specific incident requires longer.

One cookie, for your session: it remembers that you are signed in, which language you chose, the state of a sign-in in progress, and, while you are in the middle of signing up, the feed you pasted. It carries no identifier for anything else. Your choice of light or dark theme is kept in your browser's own storage and never sent to us. There is no analytics, no tracking and no advertising: no third-party script runs on any page of this site except the captcha on the signup form.

The typefaces come from Bunny Fonts (BunnyWay d.o.o., Slovenia). Serving a font means seeing the request for it, your network address and browser included, and Bunny Fonts states that it sets no cookies and keeps no logs.

Some screens show pictures as the network publishes them: the pictures and link previews attached to replies, and the profile pictures of accounts. Your browser loads these straight from Bluesky's image servers (cdn.bsky.app and video.bsky.app, run by Bluesky Social, PBC in the United States), which see the request for them, your network address and browser included, but not which of our pages it came from.

Pasting a feed address into the front page makes us fetch it, and the page it points to, to show a preview. The address is fetched from our server, not from your browser, and previews are rate-limited by network address, which is held in memory for the length of the limit and no longer.

11. Email we send

We write to a publisher's address to confirm it, to say they are approved, to say when publishing has stopped and why, to say that a sign-in has lapsed or a limit was reached, and for nothing else. Reminders can be switched off in settings; the messages that say publishing has stopped cannot, because the address is the only way we have of telling you. Mail is delivered by Mailjet (Mailjet SAS, France), which processes the address and the message on our behalf under a data processing agreement.

Our operators are mailed when an application, a listing request or a halted feed is waiting for them; that mail names the publisher and the feed.

12. Who else sees it

Only these, and only for the reason named:

We never sell personal data. We never share it with advertisers, advertising networks or data brokers, and we build no profile of anyone for advertising. We do not train AI models on your content.

13. Where data is kept, and transfers outside the EU

The service, its database and its logs run on EU infrastructure in Germany, and mail leaves through a provider in France. Five of the parties named above are in the United States: the atproto directory and Bluesky's public API, which we ask about public identifiers and profiles; Bluesky's image servers, from which your browser loads the pictures on some screens; Bridgy Fed, only if you switch it on; and hCaptcha, only on the signup form. Each receives what the request needs and no more, and each processes it under its own policy. The AT Protocol is an open network: what is public on it (posts, profiles, follows, likes) is read by relays, indexes and applications anywhere in the world, and that is a property of the network rather than of this service.

14. How long we keep it

We do not run scheduled backups of this database: your posts live on your own server, which is the copy that matters. A copy taken by hand for an upgrade stays on the same infrastructure and is deleted when the upgrade is done.

15. Your rights

You can ask what we hold about you, ask for it to be corrected or deleted, ask us to restrict what we do with it, ask for a copy in a machine-readable form, and object to anything we do in our legitimate interest. Write to privacy@eurosky.tech and a person will answer, normally within a month. We may need to check that you are who you say you are before answering a request for a copy or for deletion; for a publisher, signing in is usually enough.

A publisher can withdraw our authorisation at their own server at any time, which ends our ability to post without any request to us; write to support@eurosky.tech to have the account here closed as well.

If we decline a request we will say why, and you can complain to the supervisory authority named in section 1.

16. Security

Every connection to this site and from it is encrypted. The authorisations your server issues us are encrypted in the database, our operators sign in the same way publishers do, and every action they take on an account is recorded. No service connected to the internet is beyond reach; if a breach puts you at risk we will tell the supervisory authority within 72 hours and, where the risk is high, you.

17. Children

This service is for publications and the people who run them. It is not offered to anyone under 18, and we do not knowingly hold data about anyone under 18.

18. Changes to this notice

The version at the top of this page is the one that applies. If we start processing a new kind of data or process it for a new purpose, share it with a new kind of recipient, move it to a new country, keep it longer, or weaken any commitment made here, we will tell publishers by email or in their dashboard at least 30 days before the change takes effect, unless the law requires it sooner. Clarifications, a change of provider within the same role and under the same safeguards, and new features that use only data already described here for purposes already described here take effect when they are published.