About Phlogiston

Phlogiston is an experimental reader for Bluesky. It is not a replacement for the Bluesky app. Expect missing features, rough edges and outages.

It is run by one person, unpingable, as a hobby project. There is no company, no advertising and no paid tier. The source code is public at github.com/unpingable/phlogiston. The running release is commit 0f7b19b40f99. The only address for this app is https://phlogiston.app; if someone sends you a different link, don’t sign in there.

Nobody has independently audited this code. Automated tests and AI-assisted review are not an audit.

What works

• Signed out: read the Cabinet, a community collection of public posts chosen by its moderator, and its public conversations.
• Signed in: your Following timeline, conversations, saved custom feeds, side-by-side and pinned reading panes, private personal feeds, and hiding conversations from your view here.
• Optional: muting or unmuting a conversation’s notifications in Bluesky, and submitting one of your own posts to the Cabinet for the moderator to admit or decline.
• Optional content interaction: after separate provider consent, create and undo public likes and reposts, and publish text posts and replies from your existing Bluesky account.
• Context: labels on accounts, from Labelwatch (run by the same operator). When it can’t be reached, coverage is shown as unknown, not as clean.

What doesn’t

• No following, notifications, direct messages or media upload. Composition is text-only; this is not a full Bluesky client.
• Only accounts hosted by Bluesky can sign in. Accounts on self-hosted or other providers are refused, not downgraded.
• There is no Phlogiston account signup. Signing in uses your existing Bluesky account, and nothing is created for you elsewhere. phlogiston.social is the operator’s test server and does not offer accounts.
• You can’t create your own community. The Cabinet is the only one, and the operator moderates it.

What signing in allows

Signing in uses Bluesky’s own authorization screen (OAuth). Phlogiston never sees your password and never asks for an app password. Don’t send your password to anyone, including in a DM that claims to be from this app.

The first sign-in asks Bluesky to let Phlogiston:

• read your Following timeline, conversations, your viewing preferences and the label services you subscribe to;
• create a community submission record in your account, and only when you press submit.

Later features ask again, each on a separate authorization screen you can decline:

• Saved feeds: read the custom feeds you have saved.
• Personal feeds: read the profile and public block list of the account a personal feed is built from.
• Conversation controls: mute and unmute a conversation’s notifications in Bluesky. This changes your Bluesky account.
• Content interaction: create and delete likes, reposts and text posts in your public Bluesky repository. It is off until you enable it in Settings through your provider’s consent screen. Disabling interaction disconnects this account in every browser and deletes Phlogiston’s stored tokens. Sign in again normally for reader permissions; public records remain until explicitly undone.

Without Content interaction, Phlogiston cannot post, reply, like or repost. The provider permission covers deleting any post, but Phlogiston itself limits deletion to an explicit undo for posts created through this app. Even with it enabled, Phlogiston cannot follow accounts, edit posts, change your profile, read your DMs or see your email. Text posts have no facets, so mentions and links are not linked.

Leaving

• Disable Content interaction (Settings) disconnects this account rather than silently narrowing a live grant. Reconnect normally for reader permissions. Interrupted operations can be checked in Settings before any explicit retry.
• Sign out (Settings) ends Phlogiston’s sessions in every browser and asks Bluesky to revoke its access.
• Delete my Phlogiston data (Settings) also erases everything Phlogiston keeps for your account. See Privacy.
• You can also revoke access from Bluesky’s side at any time, in Bluesky’s settings under app authorizations.

Reporting a problem

Report bugs, confusing behaviour and feature requests as issues on the source repository; issues are public. Report security problems privately through GitHub’s private vulnerability reporting. Data requests and moderation appeals: see Privacy and Terms. There is no support SLA; replies come when the operator can.