Open Lab is an index, not a host. When you write a post or comment, the record is stored in your ATProto data repository on your PDS provider (for example your Bluesky data server). This site keeps a local copy of those public records (title, text, author DID, timestamps, vote counts) purely to render pages like the frontpage and post views.
Sign-in uses ATProto OAuth: we never see your app password. The site sets one session cookie containing your DID so you stay logged in; it is not used for tracking and never shared. We do not run analytics, advertising, or third-party trackers. Server logs are kept only for operational debugging.
Public content you publish here is, naturally, public: visible to anyone reading this site and any other app that indexes the ATProto network. To remove content from Open Lab, delete the record at the source (your PDS); the index follows. If something indexed from your repository should not be here at all, email research@protocol.ai and we will exclude your handle from the index.