You’ve felt it. That sinking feeling when you realize the protocol you’ve been building on doesn’t care about your users’ privacy. You’re not building a broadcast channel. You’re building a community. A club. A place where people can be vulnerable, share secrets, and connect without performing for the world.
But ATProto — the foundation of Bluesky and the dream of a decentralized social web — has one simple, ruthless rule: all data is public by default.
It’s not a bug. It’s the architecture. And it’s a silent killer for any app that needs private spaces.
Let me introduce you to a builder I’ll call Alex. He’s been working on a board game community on ATProto for six months. The idea: recreate the feeling of a local game club online. Clubs, not feeds. Intimate groups, not global influencers. He wanted the landing page to say ‘Join a Club,’ not ‘Play Now.’ But every time he tried to add a private discussion thread, a members-only event, or a hidden game room, the protocol pushed back. Data is world-readable. Permissions are an afterthought. The design is hostile to anything that isn’t a public broadcast.
This isn’t just a technical limitation. It’s a sociological filter. ATProto doesn’t just allow public data — it actively selects for the kind of content that thrives in public: hot takes, viral moments, influencer drama. It’s a protocol that rewards the loudest, not the closest.
You’ve probably heard the rebuttal: ‘We can add a layer of encryption on top!’ Or ‘You can put the private data somewhere else!’ But that’s like building a house on a floodplain and then blaming the water. The protocol’s first principles are baked into every decision. The data model assumes a world where everything is shared. The repository structure, the sync protocols, the federation — all optimized for a single use case: public, broadcast social media.
Look at the comment from another developer on the original article: ‘Reading articles like this one, I do think people are trying to put a square peg (their applications) through a round hole (ATProto).’ Exactly. The square peg is private community. The round hole is public broadcast. And no amount of ‘we can fix it with middleware’ changes the shape of the hole.
So what’s the real cost? Time. Money. The frustration of your users who expect privacy and get a firehose. Every week you spend trying to retrofit private data onto ATProto is a week your competitors are building on protocols that actually respect boundaries.
If you’re building a social app, answer this one question: Will your users want to share their posts, photos, and conversations with the entire world? If the answer is no — if they want clubs, dating, therapy, support groups, or any kind of intimacy — then ATProto is not your friend. The protocol was designed for a very specific vision: a public commons. That’s beautiful for some use cases. But it’s not a universal platform.
I’m not saying ATProto is bad. I’m saying it’s opinionated. And that opinion is: everything is public. If you try to force it into a private shape, you’ll end up with a brittle, complex, and ultimately unsatisfying experience for your users. The best protocol is the one that doesn’t fight your use case. Choose another one.
FAQ
Q: Can't you just add encryption on top of ATProto to make data private?
A: Technically, yes. But you'd be fighting the entire data model. The protocol assumes all data is public at every layer — from storage to sync to federation. Encryption adds massive complexity, breaks discoverability, and doesn't solve the fundamental problem: the protocol's invariants are built around public data. You'd be better off starting with a protocol that treats privacy as a first-class citizen.
Q: What's the practical implication for a founder deciding on a tech stack?
A: If your app needs private groups, closed communities, or any kind of permissioned data, do not build on ATProto. The cost of retrofitting privacy will eat your engineering budget and degrade user experience. Instead, consider protocols like Matrix (for chat) or ActivityPub (with privacy extensions), or build your own simple backend. ATProto is great for broadcast social; terrible for anything else.
Q: Isn't the whole point of decentralization to avoid walled gardens? Doesn't private data contradict that?
A: Not at all. Decentralization means no single entity controls your data. It doesn't mean everyone can read it. You can have a decentralized protocol where users own their data and grant access explicitly. The false dichotomy is 'public vs. walled garden.' There's a middle ground: user-owned, permissioned data. Protocols like Solid and Secure Scuttlebutt show it's possible. ATProto simply chose a different philosophical path.