Privacy and terms
What this is
This broker holds an AT Protocol OAuth session for a device that cannot hold one itself. The device asks it to write a record; the broker signs the request and sends it to your PDS. Access and refresh tokens never leave this server.
What it stores
- Your OAuth session: access token, refresh token, and the key that binds them.
- One token per paired device.
- While you sign in, a pending login and a sign-in code. Both expire in ten minutes.
- A count of wrong sign-in codes, to limit guessing. It is stored against a one-way hash of the address it came from, never the address itself, and expires in ten minutes.
All of it is encrypted before it is written, with a key held only by this server.
What it does not store
Your password: you sign in at your own provider, and this broker never sees one. The records you write, which go to your repo. There is no analytics, no logging of what you publish, and nothing is shared with anyone.
What it can do
Within the permissions you grant, this broker can create records in your repo whenever your device asks, without you being present. Naming collections when you sign in limits it to exactly those. You can review or revoke the grant at your account provider at any time.
Who else is involved
Cloudflare runs this and stores the encrypted rows. Your PDS and its authorization server receive the requests. A public identity service is used to turn a handle into a DID.
Removing yourself
Remove my account revokes this broker's access at your provider, unpairs every device and deletes the stored session.
Terms
Provided as-is, with no warranty and no promise that it keeps running. You are responsible for what you publish through it. The operator may remove any account.