Pass Muster

Privacy

Plain words, kept short. Last changed October 5, 2026.

What Pass Muster does

You give it your handles. It finds who you follow on Substack, Bluesky and YouTube and shows their new work on one page, one card per person. It only reads what is public, or what you choose to share through Google.

What we read

• Your public Substack subscriptions, your public Bluesky follows, and your YouTube subscriptions (public ones by handle, or private ones only if you press "Bring in my YouTube subscriptions" and allow it on Google's page).
• The public posts, videos and profile links of the people you follow.

What is stored, and where

• Not signed in: your list, read marks, bookmarks and notes stay in this browser on this device. We do not have them.
• Signed in: your email address (to send sign-in links), plus your handles, your My Feed list and order, read marks, bookmarks and notes, people you removed, and the list of YouTube channels if you brought them in. Only you can read them. They exist so the same page shows up on your phone and your computer.
• A shared cache of public pages: to avoid asking Substack and YouTube the same question for every reader, we keep recent public posts, public profiles and channel details, and a count of how often each was asked for. When you look up a handle, the public subscription list for that handle is kept for 15 minutes. None of this is tied to your account.

Google

If you bring in your YouTube subscriptions, Google gives your browser a read-only key. Your browser uses it once to read the list of channels you subscribe to. The key is not sent to our server and is not kept. Only the list of channels is stored, as described above. Pass Muster's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can remove the access any time at myaccount.google.com/permissions.

What we never do

• No ads, no selling or sharing your data, no tracking cookies, no profiles of you for anyone else.
• We never ask for your Substack, Bluesky or YouTube password.

Who runs the machinery

The page is served by Cloudflare. Accounts, the shared cache and the fetcher run on Supabase. Both keep the standard technical logs any web service keeps (such as IP addresses of requests) for a short time.

Deleting

Signed in, open Settings (the gear) and press "Delete my account". That removes your account and everything synced to it. To clear what is in a browser, clear that site's data in the browser's settings.