Your privacy
Nothing about you travels further than you chose, and every step outward is something you switched on.
This page lists every field this system holds about a person, who can see it, and whether any setting could ever make it visible.
The switches are not built yet.
This page shows what the system holds and who can see it. The switches themselves do not exist. We are not rendering toggles that do not save -- a switch you flip that does nothing is worse than no switch, because you would believe you had turned something off.
16
fields no setting publishes
3
off until you turn them on
4
a stranger can see
You cannot be searched for
There is no list of people in this product, for anyone. You reach a person through something they chose to publish -- a public post, a listing they filed, a comment they wrote -- and never through an index of everybody.
Without an account you cannot look people up at all. You can read what people chose to publish.
Who can look at all
anonymoussigned inthe person themselves
16 fields that never leave, whatever anybody switches
There is no setting that publishes these, because there is not supposed to be one. That includes your politics — the field this whole project exists to refuse to publish.
email
The single most useful field for finding somebody elsewhere.
auth user id
The identity-provider key. Correlates this account with every other system the person signed into.
political identity
A person's politics, in a column. This is the field this whole project exists to refuse to publish, and there is no consent setting that turns it on -- there is not supposed to be.
city
Precise. coarse_location is the only location that travels.
county
Precise, and in Illinois a county plus a first name is often one household. coarse_location is the only location that travels.
district
A civic division is a public fact about a PLACE and a private one about a person -- pinning somebody to a district is pinning them to a few streets.
state
Harmless alone and a powerful filter in bulk. The old list endpoint let a stranger filter every account by state, which is how a directory becomes a targeting list.
is minor
Announcing which accounts belong to children is the exact opposite of protecting them.
guardian id
Links a child to an adult. Never leaves for the same reason.
coppa consent at
Implies is_minor, so it leaks the same fact sideways.
audience role
Which track somebody is on -- family, educator, adult. A guess at their household.
profile visibility
Whether a profile is private is itself a fact about the person, and returning it tells a stranger there is something there to look for.
search indexable
Same shape: a setting is a signal.
show location
Caught by the census below rather than by me, which is the point of having one. It is a setting, and a setting is a signal: returning it tells a stranger this person deliberately hid where they live, which is a fact about them they did not publish.
created at
Account age orders people by seniority, and this product has no seniority. It is also a reliable correlation key.
updated at
Reveals when somebody was last active. Nobody needs that.
Off until you turn them on
Every one of these starts off. Silence is never consent, and a location is always a city, a town or a region — never a street address, ever.
coarse location
Requires show_location. ALWAYS VAGUE -- a city or a town, never a street. The precise columns (city, county, district) are never the source for this and never travel.
avatar url
A picture of a person is a person. Shown on a public profile; never in a list.
bio
Free text somebody wrote about themselves, which is exactly where people put the things that identify them. Public profile only.
What a stranger can see
A first name. Not a surname — that is the difference between recognising a neighbour and being findable by an employer.
id
needed to link to the profile at all; it is an opaque identifier
first name
The founder named this exactly: a stranger sees a first name. Not a surname, which is the difference between recognising a neighbour and being findable by an employer.
display name
The name the person chose to be called. Shown only on a profile they set to public, and never returned in a list a stranger can page through.
handle
The @ they bought or earned. It is a public address by design -- a handle nobody may look up is not a handle.
Search engines are a separate switch
false by default on users.search_indexable and posts.search_indexable, for everyone, forever. Being public IN THE APP and being indexed BY GOOGLE are different audiences, and the founder named them separately.
Why we serve noindex instead of blocking the crawler
Disallow says do not FETCH. noindex says do not LIST. A disallowed URL can still be indexed from inbound links, and because the crawler may not fetch it, it can never read the noindex that would remove it. Disallow on a page you want removed makes it permanent. Allow the crawl; serve noindex.
- any feed
- One URL carrying many people's choices. A robots directive is per URL, so one person opting in would publish their neighbours.
- any session page
- account, settings, saved, messenger. A crawler cannot see them and listing them only leaks the shape of the private surface.
- any operational page
- mission-control, founder-dashboard. Nothing a search result should ever point at.
- a private profile
- profile_visibility is not public, so there is nothing to index and the person did not ask.
What this page cannot tell you
- Whether the switches work, because they are not built. What is described here is what the code permits, not what a control panel currently does.
- What another person has chosen. Their settings are theirs and this page describes the shape of the choice, not anybody's answer to it.
- Anything about a business listing. A shop that listed itself gave an address on purpose so customers could arrive, and it is governed separately.
The rules behind all of this are at /standards, and where we stand on every governance document is at /governance.