Privacy Policy

Updated September 4, 2026

Deck³ is published by Rafacst. This policy covers the Deck³ apps for macOS and Windows and the deck3.app website. Other apps published by Rafacst have their own policy at apps.rafacst.me/privacy.

Deck³ is a third-party client for Bluesky. It is not official, and it is neither affiliated with nor endorsed by Bluesky.

1. Bluesky accounts and content

Deck³ connects directly to Bluesky and to the Personal Data Server (PDS) selected by your account. Those services process your profile, posts, messages, media, preferences, and moderation data under their own policies. Rafacst does not host a separate copy of that content.

Content you write stays on your device until you publish or send it. At that point the app transmits it to your PDS and to the AT Protocol services you use, at your direction and to nowhere else.

2. Credentials and tokens

Rafacst does not receive your Bluesky password, app password, OAuth token, or session token. A handle or email address and an app password are sent over HTTPS directly to the PDS you select, to establish a session, and the app password is not retained afterwards.

The resulting session and OAuth credentials are stored on the device and protected by the operating system: the Keychain on macOS, the Data Protection API (DPAPI) on Windows. These tokens never reach a Rafacst server. Removing an account from the app deletes its tokens from that device.

3. Anonymous usage data

Deck³ can send limited product events to an analytics service that Rafacst runs itself. The address and the project key are fixed in the app, no code path can point them elsewhere, and an address that is not HTTPS is refused.

The app sends these kinds of event, and no others:

• app started: how the deck was set up, meaning how many columns and how many accounts, and the navigation, layout, and live-streaming choices in use.
• column focused: which kind of column received focus, and the deck shape it was used in.
• screen viewed: which fixed app screen was opened, with no target or content attached.
• column error: which kind of column failed to load. The message you are shown never leaves the machine.
• account setup result: whether adding an account succeeded, without the account itself.

Every event also carries the app version, the operating-system version, the language and region, layout choices, counts, and whether the build is a debug build.

Events never include the text of a post or message, a handle, an email address, a DID, an app password, a session token, a server address, a search term, a URL, a draft, a contact, a location, or an account or advertising identifier. Rafacst does not use this data for advertising or cross-app tracking, and does not sell it. There is no autocapture, no screen recording, and no crash reporting. A demo or screenshot run sends nothing.

Each launch is given a random session identifier that is never written to disk, so two launches cannot be joined together into a person or an installation.

Usage data is on by default and can be switched off at any time in the app's privacy settings. Switching it off takes effect immediately and empties anything still waiting to be sent.

4. Optional features you start yourself

Some features send data off the device only when you use them. None of them runs on its own.

• GIF search in the composer. KLIPY receives the search term you type and an anonymous per-installation identifier, and serves the GIF media shown. This feature exists from version 1.1.0.
• Translation. Choosing to translate a post opens Microsoft Bing in your browser with the text to translate.
• Link previews. Your device requests the preview directly from the linked website.

5. Crash files

Deck³ sends no crash report to Rafacst or to any processor. On Windows the app writes a description of a crash to last-crash.txt, in its own folder under %LOCALAPPDATA%, and leaves it there. Nothing sends that file anywhere, and Rafacst never reads it. It exists so that you can attach it to a support request if you choose to. Uninstalling the app removes it.

Separately, your operating system's own crash reporting, Apple's or Microsoft's, may deliver crash data to Rafacst in aggregated form if you enabled it in your system settings. That choice is yours and is made outside the app.

6. Support and this website

If you email support, Rafacst receives the address and the information you choose to send. Cloudflare delivers this website and processes the ordinary request data needed for security and delivery.

The deck3.app website uses Google Analytics, loaded through Google Tag Manager, to count visits and learn which pages help. The measurement writes Google cookies in your browser and sends the page address, the language, where the visit came from, and technical browser data. This website carries no ads: advertising storage, ad user data, and ad personalisation stay denied at all times, and nothing feeds an advertising profile.

Measurement starts on, under legitimate interest. The notice on your first visit carries a Turn measurement off button, and thePrivacy button reopens the choice on any page. Your choice stays in your browser, and turning measurement off applies from that moment, without affecting what was already collected. The Deck³ app does not use Google Analytics; section 3 covers the app's usage data.

7. Processors and third parties

Deck³ relies on a small number of vendors. Each handles data under its own privacy policy and only for the purpose stated here.

8. Sharing

Rafacst does not sell, rent, or share your personal data for marketing. Data may be processed by the vendors listed above, as needed to run the app, and may be shared where required by law or by order of a competent authority.

9. International transfers

Several of the vendors above handle data outside Brazil. The country or region of each is in the last column of the table, so that you can see which transfers occur. Those transfers are made under the safeguards that applicable data protection law permits.

10. Retention and deletion

Data kept on your device remains for as long as you keep it. You can delete it in the app or by uninstalling. On Windows the app keeps its local data in the package's isolated folder under your user profile: updates keep that folder, and uninstalling removes it, including the crash file and the encrypted sign-in tokens.

Usage events arrive without a name, a handle, an account identifier, or anything you typed, and are kept only as the aggregate product counts described in section 3.

Data held by Bluesky, by your PDS, or by a store is subject to that service's own retention and deletion rules, and must be managed through its own controls. Signing out of or uninstalling Deck³ does not delete content you published there.

A support message is kept for as long as needed to answer it and to keep a record of the exchange, and is then deleted.

11. Security

Rafacst adopts reasonable measures to protect data, including system-protected local storage, encryption in transit (HTTPS/TLS), and a fixed analytics endpoint that refuses a non-HTTPS address. Even so, no system is completely immune to failure. Keep your devices and credentials protected.

12. Children and adolescents

Deck³ is not directed at children or adolescents, and Rafacst does not knowingly collect their personal data. Because the app is not aimed at this group, Rafacst does not seek a parent's or guardian's consent and instead does not knowingly process the data at all. The minimum age is in the Terms of Service. If you believe a child or adolescent has provided personal data, contact the data protection officer below and it will be deleted.

13. Controller, contact, and data protection officer

The controller is Rafacst. For a privacy question or to exercise your rights, email the data protection officer at dpo@rafacst.me. For anything else, email support@rafacst.me.

14. Changes

This policy may change to reflect changes in the app, in legal requirements, or in operational practice. The version on this page is the one in force, and its date is at the top. Where a change materially affects how your data is processed, notice is given by a means reasonably likely to reach you, which may include a notice in the app or in the store listing.