a friend was wondering about this so here's what I sent, posting publicly in case anybody else has the same question:
so your Personal Data Server (PDS) is hosted by Bluesky (the company) at bsky.social(*)
when you log into bsky.app you’re actually firing off a request to bsky.social to authenticate (check devtools, it should be visible)
bsky.app is the main client of bluesky, but there are others like https://skeetdeck.pages.dev/ and some mobile apps. But bsky.app is not privileged, they all work the same — by talking directly to your PDS.
(*) technically bsky.social is the “entryway” to a fleet of individual PDS servers created as a convenience (https://docs.bsky.app/docs/advanced-guides/entryway) but not important here. But if you ever see “mushroom servers” mentioned, those are the individual PDS servers. There are 66 right now, each around 500k users.
every PDS in operation has a default domain and new user registrations become a subdomain of it — hence why most everybody is “NAME.bsky.social”
