Bluesky's screenshot watermark is a clever bit of iOS trickery, not magic

The mystery of the vanishing logo

Screenshot a post on Bluesky and there’s a little butterfly logo tucked in the corner. Look at the same post inside the app and the logo is gone, replaced by a “Follow” button. That oddity is what sent developer Tim Marinin down a rabbit hole, documented on his blog, and it’s since racked up nearly 400 points and over 250 comments on Hacker News.

His first guess was that Bluesky had built some kind of listener that detects the screenshot gesture and swaps the button for a logo at the last possible moment - the same trick some apps use to hide their content near an iPhone’s notch. But that theory fell apart when he tried screenshotting mid-app-switch: the Follow button was still there, logo nowhere in sight.

What’s actually happening

Because Bluesky’s app code is publicly available, Marinin could check rather than guess. The answer sits in a file candidly named GrowthHack.tsx, added by a Bluesky developer in January 2026. It leans on a small package called expo-privacy-sensitive, also built in-house.

Here’s the trick: that package creates an invisible UITextField - the same kind of component iOS normally uses for password boxes - and sets it to “secure text entry”. Crucially, it then renders the actual Follow button inside that supposedly secure field’s layer. iOS, treating it as sensitive content like a password, automatically blanks that layer the instant a screenshot is taken. With the button hidden, the Bluesky logo sitting underneath becomes visible.

It’s not really redrawing anything. The logo was there the whole time, just normally covered up. The screenshot doesn’t add a watermark - it removes an obstruction.

That also explains why the trick fails during an app switch: iOS appears to capture that preview at the start of the gesture, before the live blanking behaviour kicks in, so it grabs a stale image with the button still showing.

Marinin is upfront that he’s not an iOS developer and is reasoning from observed behaviour rather than official documentation, but the underlying mechanism checks out against the published source code. He also notes the technique isn’t new: Telegram and Signal use comparable methods to stop secret or disappearing chats from being captured on screen.

So who is actually affected

Nobody’s privacy or security is compromised here - the “secure” text field is being repurposed for branding, not for hiding sensitive data from the user. It’s not a bug, a leak, or a tracking mechanism. It’s a UI trick that makes screenshots carry Bluesky’s logo without cluttering the normal browsing experience, likely intended to nudge more people toward the platform when shared posts circulate on other apps or in group chats.

Unsurprisingly, developers in the Hacker News thread were split: some called it a neat, low-impact way to keep attribution on shared content; others saw it as a sly repurposing of an API meant for privacy protection, not marketing.

The takeaway

There’s no vulnerability, no data exposure, and nothing users need to do. It’s a small, clever - and mildly cheeky - piece of interface engineering that most people will never notice, and the only real cost is to Apple’s API being used for something it wasn’t strictly designed for. As Marinin points out, similar tricks have existed for years in other apps, so don’t expect Apple to close this loophole any time soon.