Mastodon vs Bluesky
Side-by-side comparison of the Terms of Service and Privacy Policy of Mastodon and Bluesky.
The service includes meaningful user protections like export, deletion, hashed passwords, SSL, optional 2FA, and a no-sale statement. The main concerns are the decentralized network design, which spreads content to other servers, plus limited support scope and some moderation opacity.
Mastodon.social presents a relatively user-friendly privacy posture for a social platform: it offers account deletion, content export, clear security measures, and says it does not sell personal information. Key tradeoffs come from federation: public, followers-only, and direct-message content may be copied or delivered to other servers, reducing practical control once shared.
Points of interest
-
negative ●●●●● privacyFederated content sharing
Because Mastodon is federated, your public content can be downloaded by other servers, and even followers-only or direct messages may be delivered to other servers. That limits practical control over where your content ends up.
-
negative ●●●●○ privacyDirect messages leave server
Direct messages are sent to recipients' servers when they are on other servers. Users should not assume DMs stay solely under mastodon.social's control.
-
positive ●●●●○ privacyNo sale of data
Mastodon.social says it does not sell or trade personally identifiable information. It may still share data with service providers or when legally required, which is common but worth noting.
-
positive ●●●●○ privacyAccount deletion available
You can permanently delete your account at any time. This gives users a clear exit path, though copies of distributed content on other servers may persist in practice.
-
positive ●●●●○ privacyStrong account security
The policy says sessions and API traffic use SSL, passwords are strongly hashed, and two-factor authentication is available. These are meaningful baseline protections for account access.
-
positive ●●●○○ privacyContent export offered
Users can request and download an archive of their content. This supports portability and backup before leaving the service.
-
neutral ●●○○○ privacyApps get broad access
Authorized apps may access substantial account data depending on the permissions you grant. The positive limit is that apps cannot access your email address or password.
-
neutral ●●○○○ privacyCookies for login/preferences
The service uses cookies to recognize your browser, connect it to your account, and save preferences. This appears functional rather than advertising-focused based on the provided text.
-
neutral ●●○○○ termsModeration outcome opaque
Reports are usually handled quickly, but reporters are not told whether punishment occurred, and some enforcement is not visible publicly. This helps moderation flexibility but reduces transparency for users who report abuse.
-
positive ●●○○○ termsClear operator identity
The service identifies the operating company and provides corporate registration details and contact information. That improves accountability compared with anonymous operators.
Documents
Bluesky offers useful privacy rights, clear account deletion, transparency about public-by-design data, and says it does not sell personal data for targeted advertising. However, broad content licensing, unencrypted DMs, long/indefinite retention tied to legal and safety purposes, arbitration with class-action waiver, and limited deletion in a decentralized network make the service only moderately user-friendly.
Bluesky presents itself as a decentralized social network with relatively transparent policies and some meaningful user rights, but it also imposes standard platform protections. User posts remain owned by users, yet broad licenses apply, most activity is public by design, direct messages are unencrypted, disputes generally go to arbitration, and deletion may be incomplete across the wider AT Protocol network.
Points of interest
-
negative ●●●●● privacyDMs stored unencrypted
Direct messages are not end-to-end encrypted and may be accessed for trust and safety purposes. Users should not treat Bluesky DMs as highly confidential communications.
-
negative ●●●●○ privacyMost activity is public
Posts, profile, likes, follows, and blocks are public by design. This makes social graph and activity data broadly visible rather than private by default.
-
negative ●●●●○ termsDeletion may be incomplete
Even if you delete your account, copies of your content may remain on other services using the AT Protocol. In practice, deletion across the decentralized network may not be fully enforceable.
-
negative ●●●●○ termsMandatory arbitration clause
Most disputes must go through a 60-day informal process and then binding individual arbitration instead of court. This usually makes it harder to bring claims publicly or use normal court procedures.
-
negative ●●●●○ termsClass actions waived
Users generally cannot participate in class or representative actions against Bluesky. That reduces leverage for small-value claims that are impractical to pursue individually.
-
positive ●●●●○ privacyNo targeted ad sales
Bluesky says it does not sell or share personal data for targeted advertising. That's a meaningful privacy-positive commitment compared with many social platforms.
-
positive ●●●●○ privacyAccess, deletion, portability rights
Depending on location, users can request access, correction, deletion, portability, restriction, objection, and review of automated decisions. These are substantial privacy rights, especially for users in stronger-regulation jurisdictions.
-
negative ●●●○○ termsBroad content license
You keep ownership of what you post, but grant Bluesky a worldwide, royalty-free license to reproduce, adapt, distribute, display, moderate, and promote that content. This is broad enough to cover product use and marketing uses.
-
negative ●●●○○ privacyLong retention discretion
Bluesky keeps data while your account is active and may retain it longer for trust and safety, disputes, audits, legal compliance, and claims. The policy does not give firm deletion deadlines for many categories.
-
negative ●●●○○ termsLiability capped at $100
If something goes wrong, Bluesky's financial liability is generally limited to US$100, except in narrow cases like fraud, gross negligence causing death or personal injury, or non-waivable statutory rights.
-
positive ●●●○○ termsClear account deletion option
The terms explicitly say you can delete your account at any time in settings. A built-in deletion flow is more user-friendly than requiring manual support requests.
-
positive ●●●○○ termsAppeal moderation decisions
If your account is suspended or restricted, you can appeal using an in-app tool or email within two weeks. EU/EEA users also retain access to out-of-court review and local courts.
Documents
Comparison is based on each service's published Terms of Service and Privacy Policy. Read the source documents linked above before relying on any specific clause.