Privacy policy

Updated November 1, 2026.

The short version

AeroSloth is an app for the GoToSocial, Mastodon, and Bluesky accounts you already have. There is no AeroSloth account, and the app has no advertising, tracking, or built-in analytics or crash reporting. AeroSloth’s developer does not operate a service that receives your posts, messages, or sign-ins, and does not sell your information.

Your device connects directly to the servers you sign in to. Beyond those servers, a small number of other services are contacted when a feature needs them. Those services, and what each one receives, are described below.

Your social accounts

When you add an account, AeroSloth signs in directly with the server you choose. Mastodon and GoToSocial use that server’s sign-in page in a system window. Bluesky uses an app password that you create, which goes only to the Bluesky or self-hosted server you enter.

What you read, post, like, boost, bookmark, follow, or report, and any messages you send, go through your server and, depending on a post’s visibility, on to the wider network. Your server also sees your IP address and normal connection details, and the app identifies itself as AeroSloth. Its operator decides what is logged and how long it is kept, and that server’s own policy applies.

Removing an account from AeroSloth does not delete the account or its posts. That has to be done on the server. You can also revoke AeroSloth’s access there, in the account’s list of authorized apps or app passwords.

What stays on your device

Sign-in tokens, app passwords, device pairing keys, and the key for AeroSloth’s cache are kept in your device’s secure storage: the Keychain on Apple devices and Keystore-backed storage on Android. They are not synced between devices.

Feeds, notifications, settings, and drafts are kept in an encrypted cache so the app can work offline. Cached images stay in that same encrypted cache, limited to the most recently used 150 MB and at most 30 days. Photos and videos attached to saved drafts are kept as files in the app’s private storage, outside the encrypted cache, until the draft is used or deleted.

The For you ranking and Who to follow suggestions are worked out on your device. AeroSloth does not send your interests, rankings, or like and boost history to any service to do this.

The Recent activity widget on iPad and Mac reads a small snapshot of your account handles and latest notifications from a private container it shares with the app. The widget never goes online and never sees a sign-in token.

AeroSloth turns off Android app backups. On iPad and Mac, device or computer backups may include AeroSloth’s data according to your settings.

Device permissions

AeroSloth asks for a permission when a feature needs it, and the rest of the app keeps working if you decline. The camera and microphone are used only while you take a photo or record a video for a post. The photo library is used to attach what you choose. Notifications alert you to activity on your accounts.

Location is used only while Add map is open, to center a map attachment. It is not sent to AeroSloth’s developer, and your followers see a place only if you post the map. Local network access is used to reach servers you sign in to on your own network and to find and sync with devices you pair.

Links, previews, and videos

When a post links to a website and its server has not supplied a preview, AeroSloth requests the page’s preview details once that post is showing. The request comes from your device, so the website sees your IP address and that the app is AeroSloth. It carries no account information or cookies, and no scripts from the page are run.

Links open in your default browser. YouTube, TikTok, and Instagram videos start as a poster image. Pressing Play loads that provider’s official player inside the app, and the provider then receives your IP address and viewing activity under its own policy.

Reading services such as WallHop, Skip the Paywall, and archive.ph stay off until you add one. If you choose one for a link, it opens in your browser and receives the article’s address, but not your accounts or the post’s text.

Maps

Add map lets you attach a map image to a post. Map tiles for the area you view come from OpenStreetMap’s tile service, which receives your IP address, normal connection details, and the app’s identifying User-Agent. Its policy governs logging and retention.

Searching for an address sends the words you enter to Apple’s map service on iPad and Mac or to Android’s geocoder, and only when you submit the search. AeroSloth keeps at most 50 recent searches in memory for up to 24 hours and does not save them to settings or logs.

Finding servers, people, and posts

Server suggestions come from Mastodon’s server directory and from FediDB. AeroSloth downloads those public lists and filters them on your device, so what you type is not sent to either one.

Explore Fediverse reads public trending posts from the servers listed under its Sources, which you can change. Who to follow reads the public follow lists of people you follow. Other public lookups use Bluesky’s public service and Bridgy Fed to show quoted posts and connect bridged profiles. These requests are sent without your sign-in, but each server sees your IP address and normal connection details.

Translation, alt text, and writing help

Translation, alt text drafts, Check writing, and the filter for screenshots of other social sites run on your device. Post text and images are not sent to AeroSloth’s developer, your server, or a cloud AI service for these features. They use Apple’s system frameworks on iPad and Mac and Google’s ML Kit on Android. Language packs and models may download from Apple or Google when needed.

On Android, Google’s ML Kit may send SDK diagnostics to Google, including device and app identifiers, input image dimensions and format, processing timing, and errors. On-device processing does not mean these SDKs are network silent. Google’s ML Kit disclosure explains these diagnostics. Apple builds do not include ML Kit.

Spelling underlines come from your device’s own spell checker, under your device’s settings.

Device sync

Device sync is optional. It connects other Macs, iPads, and Android devices directly to a Mac hub on your own network, with no cloud account or server. You confirm each pairing by comparing a six-digit code, and messages between paired devices are end-to-end encrypted.

Settings, mutes, filters, links, reading services, saved drafts with their media, and Who to follow results can sync, and a device can hand its posting queue to the hub to publish. Sign-ins and tokens do not sync; each device signs in for itself.

People on the same network can still see some details: the Mac’s name and a random device ID, device names during pairing, and the size and timing of sync traffic. Use a network you trust. Removing a paired device ends its access.

Notifications and Wear OS

AeroSloth finds new activity by checking your servers, about every 5 minutes while the app is open and every 15 minutes in the background, then shows notifications on your device. It does not use a push service by default.

Settings includes optional Mastodon WebPush for people who run their own relay. AeroSloth does not provide one. If you connect a relay, it and Apple or Google receive your device’s push token, a routing identifier that can identify your account, and delivery timing. Alerts are generic, and the relay never receives your sign-in or readable posts.

The Wear OS companion shows lightweight copies of your notifications from your paired phone and sends quick actions back through Google’s Wear OS Data Layer. The phone keeps your sign-ins and does the network work.

Purchases, app stores, and beta testing

AeroSloth is sold through the App Store and Google Play. Apple and Google handle downloads and payments under their own policies. The developer may see the aggregate sales, usage, and crash statistics they provide, along with any reviews you publish.

TestFlight is operated by Apple. If you send beta feedback, crash reports, screenshots, or diagnostic attachments through TestFlight, Apple and the developer may receive that information. Include only what you intend to share.

Your choices and deleting data

Removing an account in AeroSloth deletes its sign-in, cached posts and notifications, posting queue, and follow suggestions from that device. Saved drafts stay until you delete them, and other devices keep their own data until you remove the account there too.

Deleting the app removes its local data on Android and iPad. On iPad, remove your accounts first, because Keychain items can outlast the app. On Mac, deleting the app alone can leave its sandbox container behind. Copies in device backups need separate removal.

The developer holds no copy of your app data, so requests to access, correct, or delete what a social server stores go to that server’s tools or its operator.

Children

AeroSloth is not directed at children. It needs an account on a social network, and that network’s minimum age and rules apply.

Contact and changes

AeroSloth is developed and published by Joe Steinbring. For privacy questions or app support, contact Joe through https://jws.dev/contact. Messages you send are used to answer you. This policy will be updated when relevant app behavior or service providers change, and the date at the top shows the latest version.

This website

This policy covers the app. The website at aerosloth.jws.app has no cookies, analytics, advertising, or third-party requests. If you choose a light or dark theme, your browser remembers the choice on your device, and it is never sent anywhere. The company that hosts this site may keep short-lived server logs, such as IP addresses and the pages requested, to run the service and protect it from abuse.