A logo visible only after capture
A technical investigation dated August 17, 2026 explains why Bluesky screenshots can contain the service’s butterfly logo even when the same spot displays a Follow button inside the iPhone app. The behavior does not depend on detecting the screenshot buttons and swapping elements at the last instant. Instead, it uses the way iOS protects secure text fields during capture.
The investigator noticed the logo in the corner of a captured post, then returned to Bluesky and found that it was absent from the live interface. Some applications position branding behind the iPhone’s screen cutout, where it becomes noticeable only in a screenshot, but Bluesky’s mark occupied an otherwise visible part of the layout.
Because Bluesky’s code is available to inspect, the answer was found in a file named `GrowthHack.tsx`, introduced in January 2026. That component relies on the `expo-privacy-sensitive` package. The package creates a native `UITextField`, switches on its `isSecureTextEntry` property and places the actual interface content—in this case, the Follow button—inside the field’s rendering layer.
When iOS takes a screenshot, it blanks the secure field’s layer to avoid recording sensitive text. Bluesky positions its logo underneath. The user normally sees the button, but the operating system removes that layer from the captured image and exposes the butterfly below it. On other platforms, the package renders its content normally without the masking behavior.
A privacy feature becomes presentation logic
The trick behaves differently in the iPhone’s application switcher. A screenshot taken while moving between apps did not reveal the logo in the same way. The investigator’s proposed explanation is that iOS creates a static snapshot at the start of the switching gesture. A later screen capture then records that inert image rather than a live secure text field that can be blanked. The author identifies this as a hypothesis, not confirmed platform behavior.
Secure-entry masking exists to keep passwords and other private content out of screenshots. Bluesky’s implementation repurposes that protective behavior to change the appearance of shared images. The underlying API still performs its normal task—removing a designated layer—but the visual result is branding rather than simple redaction.
The technique is not unique to Bluesky. The account says Telegram has used a similar method for secret chats, as has Signal. Those precedents lead the author to doubt Apple will remove the behavior soon, though the supplied evidence includes no statement from Apple about whether this use is supported.
Reaction among developers was mixed. Participants in the code thread largely disliked the addition before discussion was locked, while the investigator regarded it as a playful trick. Whatever its reception, the mechanism demonstrates how an operating-system privacy guarantee can become a compositing tool: place ordinary content in the protected layer, put an alternate image behind it, and let screenshot redaction determine which one appears.
