This policy covers the 2nd screen app, website, sports, verification, sign-in, notification and public game-chat services, and the limited account-hosting beta at pds.2ndscreen.social operated by Welkin Labs PBC. We are responsible for the purposes and handling of information in those services. Your AT Protocol host, Bluesky, independent feed generators, and other services you choose remain responsible for their own processing.
Updated October 13, 2026: this notice now explains hosted-account sign-in, public game chat, fan-record indexing and the current notification storage. Publishing this update does not enable optional notifications or change your account permissions.
1. What is public
Posts, replies, profiles, likes, follows, public rosters and their membership, and public block records can be retrieved from the open AT Protocol network. 2nd screen’s sports stars and profile fan-badge choices are public records too, even when you do not display a badge on your profile. Verification attestations identify an issuer and a subject publicly.
Other apps, search engines, archives, or individuals can collect public records without asking us. Removing a post or account at its host may not remove every copy elsewhere. A setting asking apps to limit discovery is a request to those apps, not a way to make a public record private.
2. Information used to provide the app
- Account and session information: account identifiers, handle, profile, credentials or authorization tokens used during sign-in, and session state needed to make requests you authorize. Authentication is handled with your selected account provider. With secure browser sign-in (OAuth), you authorize 2nd screen at your provider. Our Cloudflare-hosted sign-in service stores the resulting credentials encrypted, together with your account identifier and session timestamps. For accounts hosted at pds.2ndscreen.social, supported signup and password sign-in flows also pass through this service: for signup it receives your email address, handle, invite code, date of birth and password; for sign-in it receives your password and any required sign-in code. It uses these to create or authenticate the account with our host, then stores the resulting session credentials and account metadata such as email and handle encrypted. The app-session store holds the resulting credentials rather than your password. Native apps keep a separate access credential in protected device storage; the web uses a browser session cookie. Older direct password sign-in flows can keep the provider session on the device instead. If we are your account host, we also hold the email address, password hash, account identifiers, authorization/session records, public repository, private account preferences (including a declared birth date where stored), and identity/signing keys needed to operate that account. Signup and age-related features process the date of birth or age information you provide; it is not a public profile field by default. Do not send passwords or session tokens to our support inbox.
- Content and requests: posts, media, searches, feed choices, messages, reports, and actions you submit are processed by the services that deliver those features. Our app handles them to show content and carry out your requests. Public content may also be cached by our sports and verification services.
- Local preferences: appearance, content settings, game-alert choices, and other device settings. Some standard network preferences are saved with your account provider. Game-alert choices stay on your device until you enable our notification service, which also stores the selected categories, individual games, teams, leagues and account-post subscriptions needed to deliver alerts. Our recent-viewing records stay on the device.
- Connection information: our hosting and delivery providers receive information such as IP address, requested URL, time, browser/device information, and errors to deliver pages, protect services, and diagnose failures. Public scores may be fetched through our sports service or directly from a sports-data provider.
- Correspondence: when you email us, we receive your address, message, attachments, and the identifiers you provide. Reports and verification inquiries may include information about other people. Share only what is relevant.
You can browse some public content without signing in. Features such as posting require account information. Refusing optional device permissions limits the associated feature rather than granting us permission to collect something else.
3. Viewing history and feed feedback
To bring fresh material forward, the app keeps up to 1,000 recent post identifiers and times in a history for each signed-in account on that device. Browsing while signed out uses a separate device-local post history with the same limit. Highlights keeps up to 5,000 video identifiers and times for each signed-in account. Highlights records qualifying active playback rather than merely showing a thumbnail. In-memory playback state can also remember your place during an app session. Matching identifiers or the same media file helps reduce repeats; it does not identify every alternative edit of the same sporting moment.
Records older than seven days stop counting when history is read; stored records are pruned on later writes. This is not a scheduled deletion process when the app is closed. These histories are not uploaded to our sports API or synchronized between devices. Clearing the app’s site data or device storage removes them, along with other local settings and sessions. Signing out alone should not be treated as erasing all local data.
Feed-provider feedback is separate. When a signed-in feed supports interactions, the app can send post identifiers, viewing events, feedback such as “show more” or “show less,” and interactions such as replies or likes to that feed provider through the network. Supported Bluesky feeds may accept additional engagement events. Providers also receive the requests needed to supply a feed. Their policies govern that information; local history being private does not mean feed viewing is invisible to those providers.
4. Services that receive information
Cloudflare delivers the app, sports API, sign-in service, notification service and public game-chat service, and Vercel hosts our marketing and policy website. They handle requests and operational information for those services. The landing page loads fonts from Google Fonts; Google receives the connection information needed for those requests. Our policy pages use system fonts and do not add a third-party font request.
Your selected account host stores account data and public records. The app currently uses Bluesky’s social content service (an “AppView”) for posts, profiles, feeds, and search, and Bluesky services for direct messages, media, and baseline moderation. Public game chat is a separate 2nd screen service, described below. Those services receive the requests and related account, content, and connection information needed for their features, even when your account is hosted on our server. Hosting an account with us does not keep its use of Bluesky’s services on our infrastructure. Custom feeds, including Graze-hosted feeds, receive the feed requests and supported feedback needed for their service. For our personalized sports feeds, requests can include your account identifier and public sports selections or derived feed preferences. Graze generates and ranks our For you and Highlights feeds; selected teams and sports influence recommendations alongside discovery content. Independent providers remain responsible for their own processing.
Our invitation-only account host runs on DigitalOcean. Resend delivers account-related email, such as confirmation and recovery messages, and receives the recipient address and message content. DigitalOcean stores host backups; encrypted off-host recovery archives are stored with Railway. Authorized recovery operators can decrypt those archives, which may contain account data, public records and signing keys. We do not describe these backups as anonymous or end-to-end encrypted against our operators. Our beta host currently limits individual media uploads to 5 MiB. The app can also display media supplied by other hosts.
Secure sign-in service: with OAuth or the hosted-account sign-in flows described above, authenticated app requests pass through our Cloudflare-hosted service to your account host, Bluesky or the relevant provider. These requests can include posts, messages and their recipients, uploads, searches, preferences and account information. The service processes their contents to carry out the requested action; it is not a separate message archive. Authorized service operators can access delegated credentials and request processing, so encrypting stored credentials does not make this end-to-end encrypted against us. Our service does not receive the password entered on an external provider’s OAuth authorization page; hosted-account password sign-in is different, as explained above. Signing in does not itself enable background notifications.
Direct messages use the connected chat provider. They are not public posts, but the Bluesky chat service is not end-to-end encrypted; its provider can access messages for operation and safety purposes. Reporting a message sends relevant information to the selected moderation service. An in-app report to Bluesky does not automatically email the 2nd screen team.
Public game chat: messages are sent to our Cloudflare-hosted service with your account identifier, game, message identifier and time, and any reply or reactions. Other people can read messages with the sender’s account identifier while the room is open, including without signing in. A reply can quote up to 100 characters from the original message and identify its author. These messages are not direct messages or public records in your AT Protocol repository. The service retains a bounded recent history and reaction state; it also holds private reports and room restrictions where submitted or applied. Reaction totals and active connection counts are public, but the service does not publish a list of viewers or of the accounts behind each reaction. A viewer count counts connections, not necessarily unique people.
Deleting your own game-chat message removes it from the visible room history. It does not erase a previously submitted report copy or copies others have made. The current app reports accounts through their profile’s reporting flow; that does not automatically give 2nd screen a copy of the game-chat message. Older clients can submit a message report to our game-chat service, where it remains separate from other moderation providers. To bring a game-chat issue to our team, use the support report instructions and include the game and relevant message details. A report does not mean an automated moderation system has reviewed the message.
Public fan records: our sports service periodically reads public sports stars and profile badge records and keeps a projection of account identifiers, relationship and badge references, record identifiers and synchronization state. This supports fan badges and sports features without storing your sign-in credentials in the fan index. Signing out does not delete public fan records. Removing a star or badge updates your public record; the index refreshes separately. The index withholds projections once it detects account deactivation or when its last verified snapshot becomes stale; temporary outages do not immediately erase the stored projection. Confirmed account deletion removes the indexed projection when detected. Contact us about information we retain separately.
Embedded media, GIF search, video delivery, broadcaster links, and other external resources can connect your device to their providers. Those providers can receive your IP address, requested resource, and related connection information. Device and browser privacy controls may limit some of these connections. Translation can use the device’s supported translation service; choosing an external translation fallback sends the selected text and language information to that provider, such as Google. Camera and photo access are used for the action you request. Where regional age rules require location information, the app can use region information from network services or ask for a device location check; a location permission request is distinct from permission to publish your location.
We also use providers for email and business operations. Access is limited to what is needed for the task. We may disclose relevant information to comply with a valid legal obligation, address a serious safety or security issue, defend a claim, or complete a business transfer with appropriate confidentiality protections. We do not sell personal information or share it for cross-context behavioral advertising.
For reports emailed to us, we may share the relevant content or account links and the details needed for a hosting, moderation, safety, or legal response with the provider able to act, including Bluesky. We limit disclosure to what is needed for that purpose and do not routinely forward the whole email or unnecessary contact information. If sensitive evidence is needed, we will explain an appropriate way to provide it. Copyright notices and counter-notices can require disclosure to an affected party as explained in our IP policy. Email reports are assessed manually; they are not automatically copied to every moderation provider.
Optional contact matching: where Find and invite friends is available, choosing it provides your phone number to Bluesky’s contact service and its verification provider, Plivo. With your permission, the app reads contact phone numbers and submits them to Bluesky to find people who also opted in. Matching can reveal your participation to those people. Bluesky processes matching hashes and account identifiers under its Find Friends privacy policy, which explains retention and opting out. We do not operate that matching service. You can use 2nd screen without contact import, decline contacts permission, and manage the feature in Settings. Personal invitations are drafts you choose to send; the app does not automatically message your contacts.
Links opened from posts and messages can use Bluesky’s link-safety redirect. That service receives the destination URL and connection information needed to open it. Our app-authored policy and support links open directly.
5. Device storage, statistics, and alerts
The app uses browser or device storage for sessions, settings, caches, drafts, and the viewing histories described above. Clearing that storage can sign you out and remove unsent drafts. Browser cookie controls do not necessarily clear local storage or storage on a phone.
Our release configuration does not enable the inherited app event-analytics, experimentation, or crash-reporting services. Hosting and delivery systems can still produce request logs and traffic or performance statistics, including Cloudflare’s web statistics where enabled. This is different from an absence of all data collection. We will update this notice before introducing materially different analytics or advertising and obtain consent where required.
Optional notifications: the gated notification service stores your account identifier, selected categories and subjects, device push token, and event identifiers, scan progress and delivery state needed to avoid repeats and handle retries. It reads authorized social notifications and chat activity from Bluesky, public activity from accounts you subscribe to, and game status from our sports service. It also reads relevant preferences and content to apply delivery and moderation checks. With service-backed app sign-in it uses a restricted internal read connection to your existing authorization; older builds can ask for a separate read-only authorization. Delegated credentials are encrypted at rest.
Expo and Apple/Google provide push transport. Our trial pushes use generic notification text, together with account and event identifiers used by the app to open the right destination; they do not include message text. Delivery is restricted to admitted beta accounts; a notification control being visible does not by itself grant enrollment. Public game-chat replies and mentions do not currently generate push notifications. Enabling a category in 2nd screen does not change Bluesky’s push settings, but Bluesky’s own notification visibility, availability and read-state rules can affect what our service can deliver. Starring a team alone is not permission to send pushes.
You can choose categories, pause delivery, disconnect notifications, or decline system notification permission. Signing out disconnects that device when the request reaches the service; an offline disconnect is retried when the app can reconnect. Disconnecting notifications does not revoke the authorization needed for an active app login. Uninstalling the app alone is not a request to delete a network account.
6. Purposes and legal grounds
We use account/session data and requested content to deliver the service you ask for; connection data to operate and secure it; public sports and identity information to organize feeds and show attestations; and correspondence to answer requests and investigate reports.
Where data-protection law requires a legal basis, necessary account and feature processing supports our contract with you. Security, limited service diagnostics, and responding to ordinary inquiries support our legitimate interests in running a reliable service, subject to your rights. Processing a legally required report or preservation request supports a legal obligation. We rely on consent for optional processing where the law requires it, and will explain how to withdraw it when requested.
Sports filtering and feed ranking select what appears in the app. They are not used by us to make decisions about credit, insurance, employment, or similar legal entitlements. An independent feed provider may personalize its own recommendations.
7. Retention and deletion
Local sessions, drafts, preferences, and caches remain until replaced or cleared by the app or your device controls; recent-viewing limits are described above. Public records at your account provider remain subject to its retention and deletion rules. For accounts we host, active account data is retained while the account is provided, then removed or restricted when no longer needed, subject to security, legal preservation and backup retention. Recovery archives are rotated; deletion from live storage is not immediate deletion from a backup. A retained recovery copy is restricted to recovery, security and legal purposes. Contact us for a deletion request that needs to be carried through a recovery operation.
An incomplete OAuth sign-in ends ten minutes after its last step, at most about twenty minutes after it starts. Notification enrollments without a registered device expire after ten minutes. Service-backed app sessions expire after 90 days without device activity; background notification reads do not extend that period. Registered notification credentials also expire after 90 days unless renewed by an opted-in active device. When a service-backed app session ends through sign-out or expiry, we invalidate app access and schedule upstream revocation. If the provider cannot confirm revocation, encrypted credentials can be retained for retry and remain unusable through our signed-out app session. After the last device disconnects or expires, the notification service can retain account identifiers, preferences, subscriptions and delivery state for up to a further 90 days. Use Delete notification data in notification settings while connected, or contact support@2ndscreen.social to request earlier deletion. During service cleanup, in-app notification history is reduced to the newest 500 entries and entries older than seven days are removed. Pending event delivery normally expires after one hour; delivery receipts, deduplication state and provider records have their own cleanup rules. These limits do not promise immediate erasure from provider logs or backups.
The game-chat service keeps at most 100 recent messages and 200 private reports per room. Message history, reactions, reports and room restrictions are scheduled for removal 24 hours after the room’s most recent message; a new message extends that period. Finishing a game closes public access to its chat but is not immediate deletion of the retained room data. Fixture identifiers can remain after user data expires. Reports emailed to support are separate and follow the support-retention rules below. These service limits do not erase provider logs, backups or copies others made.
We retain support and report information for the time reasonably needed to resolve the matter, handle appeals, meet legal obligations, and address repeated abuse or related claims. Operational records and caches are kept only as needed for delivery, security, and troubleshooting. The appropriate period depends on the record’s sensitivity, purpose, unresolved issues, legal retention duties, and relevant claim periods. We do not promise an unverified fixed deletion period for every provider’s logs or backups.
Uninstalling 2nd screen does not delete your network account. Use your hosting provider’s controls to delete posts or the account, and contact us about records we hold separately. Other network participants may retain copies we cannot erase.
8. Choices and privacy requests
Email support@2ndscreen.social to ask about your information or request access, correction, deletion, or a portable copy. Depending on applicable law, you may also restrict processing, withdraw consent, use an authorized agent, appeal a denial, or complain to a regulator. We do not penalize you for exercising a legal privacy right.
Right to object: where applicable, you may object to processing based on our legitimate interests. Tell us which processing concerns you and we will assess the request under the applicable law.
Include your handle or other relevant identifier and enough detail to locate the records. We may request proportionate evidence of identity or authority; do not send identification documents unless we explain why they are needed and how to supply them safely. We respond within applicable legal time limits and explain a refusal and available appeal. Provider-held records may require a request to that provider.
People in the EEA may contact their local data-protection authority; people in the UK may contact the Information Commissioner’s Office. Other local privacy authorities may also have jurisdiction.
9. Security, location, and age
We use access controls, encrypted transport, and limited access to operational records. No system can guarantee complete security. Contact support if you suspect a vulnerability, without including other people’s private data.
We operate in the United States and use providers with international infrastructure. Requests and information may be processed outside your country. Public AT Protocol records are accessible worldwide. For nonpublic information, applicable transfer requirements must be met; contact us for information about the arrangements relevant to your request.
2nd screen is for people aged 16 or older, subject to higher local or provider requirements. A declared age is not independent identity verification. If you believe a younger child has supplied personal information to our service, contact us so we can assess and take appropriate action. A provider’s separate age-assurance process is governed by that provider’s notice.
10. Changes and contact
We will date updates to this notice and provide prominent notice of material changes. When a change requires consent, publishing a revised notice alone is not consent. Contact the operator below for questions or requests.