What we keep, and who sees it
PuP.FYI is a Bluesky handle registry operated by Collr, the data controller for everything described here. Last updated 24 September 2026.
What we store
Claiming a handle writes one row to our database. It holds:
- the handle you claimed — the name and the domain
- your DID, the identifier your Bluesky account already publishes
- your email address
- the date of the claim and its current state
- the address you redirect your subdomain to, if you set one
- your Telegram username, if you gave one
- a moderator's note, if a human reviewed the claim
That is the whole record. There is no account, no password and no profile.
What is public
The handle, the DID, the claim state, the claim date and any moderator note can be
looked up by anyone on the status page, and recent handles appear on
the site. The mapping from your handle to your DID is served at
/.well-known/atproto-did — that file is the whole point of the registry, and it
is how Bluesky verifies the handle is yours.
Your email address and your Telegram username are never shown publicly.
What we do not do
No analytics, no advertising, no trackers, no profiling, and nothing is sold or rented to anyone. The site sets no cookie on visitors; the only cookies we issue are the session and CSRF cookies for staff signing in to the moderation panel.
IP addresses
Our server sees your IP address, as every web server does. We use it to rate-limit registrations and we pass it to Cloudflare Turnstile for the bot check. It is not written to the database. Web server logs may hold it briefly in the ordinary course of running the site.
Subprocessors
These are the third parties that process data on our behalf. We do not add one without updating this page.
Cloudflare, Inc.
Turnstile, the bot check on the claim and change forms. Receives your IP address and browser signals when the widget loads. Privacy policy
Bluesky Social, PBC
We resolve your handle to your DID through the public AT Protocol API, and send verification codes as a direct message from our bot account. Receives your handle and DID. Privacy policy
Telegram FZ-LLC
Moderators are notified through a Telegram bot when a claim needs review, and anything you send through the form below reaches them the same way. Those messages include the handle, the DID and the email address on the claim. Privacy policy
Hetzner Online GmbH
Hosting. The server and the database sit in Germany. Privacy policy
jsDelivr
A public CDN that serves the icon font on every page. Receives your IP address when a page loads. Privacy policy
Cloudflare, Bluesky and jsDelivr are outside the UK and EEA, so using this site means those transfers happen. They each run on standard contractual clauses or an equivalent safeguard.
How long we keep it
We keep the claim for as long as the handle is registered to you. Ask us to drop it and
the row is deleted, which also stops the /.well-known/atproto-did response, so
the handle stops verifying on Bluesky. Moderation history for a deleted claim is kept only
as long as it is needed to run the registry.
Your rights
You can ask for a copy of your record, ask us to correct it, or ask us to delete it. Use the form below — it reaches the same people a direct email would, and we do not print the address on the page for scrapers to harvest. If you are in the UK or the EEA and you think we have handled this badly, you can complain to your data protection authority.
The form sends your message to the people who run the registry, along with what you type here and nothing else.
Changes
If this policy changes, the date at the top changes with it. A new subprocessor is added to the list above before it starts processing anything.
The rules for using the registry are in the terms.
Back to the site