Your privacy

What others can see about you, and the settings that control it.

Opening Settings

Tap the sliders button at the top right of the screen. Settings is not one of the tabs.

What members of your community can see

Your name, photo, bio, when you joined and when you were last active.
Your trust badge, your reviews, and your trust profile: how many of your trades were finished and how many were cancelled, and the share finished, how many Bean payments you have sent to or received from members plus the trades you have finished, with how many different members you have paid, been paid by or traded with, how many payments and trades you have done with the member looking, and your Trust Points. The admins see it as any member does, and it isn't logged.
Your posts, and where their pins are. See "Where your pin goes".
How you voted on a Poll, but only on a Poll its creator made an open vote. Polls are anonymous otherwise, and votes on Decisions are always secret.

What only you can see

Your balance and your trades. Nobody else in your community can read them, in the app or from your community's server. A trade shows only its two people: you and the other person.
If the community votes on removing you, everyone who can vote in it sees your balance and any debt, in that vote only. An admin or an owner who can't vote in it doesn't see them there. Those looks are not logged.
If an admin removes your account, the admin who starts it sees your balance, so that what you hold or owe can be settled. The other admins and the owner can see who looked and when.
In a known community, if you agreed to it when you joined and an admin has confirmed you, the admins can see your balance once it passes one of your community's lines. You can take that back at any time in Settings. In any community, any admin can also see some of your trades: a trade that isn't finished yet or that an admin settled, a trade whose Beans were left stuck when a member was removed on an older server, fraud alerts, and an alert if no Beans have moved in or out of your account for a set number of days. Every look at one of those trades is logged, and a look at the alerts that name you is logged the first time each admin opens them in 24 hours. The owner and the admins can see that log. The admins also see how many posts you have up and messages you have sent, and of trades only the whole community's totals, not yours; and, as every member does, your trust profile, unlogged. Whoever runs your community's server holds its whole database, with its backups, snapshots and standby copies. See "What the admins can see".

The owners and admins who run your community's server can still see what is stored there. See "Who else can see things".

People who have not joined

On your community: nothing of your posts. Its listings, and their photos, are for its members. Each photo opens only from the link that comes with its listing, so someone outside sees one only if a member passes that link on. Someone who opens your community's address without joining is shown the way to the global community instead.
On the global community: anyone can look at its listings before joining, but they see only the words, the photos and roughly where each one is, never your name, your face or the exact spot.
Anything you share to the Pulse can be seen by anyone who opens it. See "Sharing your channels".

What you control

Contact details: in your profile, choose Who can see this?: Hidden, Trade Partners, Friends or Community. See "Your profile".
Location: in Settings, under App Settings, turn Location on to use your position for the map and nearby posts. To turn it off, change it in your phone's own settings; the app shows you how.
App Lock: asks for your phone's screen lock (its PIN, pattern, password, fingerprint or face) when the app opens, and when you come back to it after 15 seconds or more away. The lock covers the app's screens and pop-ups. On an iPhone it also closes a web page the app opened, such as your community's Settings from Manage. It can't cover a web page the app opened on an Android phone, which opens outside the app, or the panel for sharing something on either phone: close them before you put your phone down. Your community's Settings, opened from Manage, signs you out after 15 minutes unused. While App Lock is on, the app goes blank as you leave it, and comes back when you return. It needs a screen lock on the phone: without one there is nothing for it to ask.
Channels: anything you share to the Pulse is shown with your name, to anyone who opens the Pulse. See "Sharing your channels".

Who else can see things

Chats between two people are end-to-end encrypted: a message that cannot be locked is not sent. The notices BeanPool adds to a chat about a deal, such as its amount, are not encrypted. See "Messages".
Playing a YouTube video in the Pulse tells YouTube you watched it, the same as opening it in the YouTube app would. Nothing is sent to YouTube until you tap ▶, and scrolling past a video sends nothing at all. See "The Pulse".
Your community's server keeps your trades, posts and votes, and whom you blocked in the web app. The owners and admins who run it can see what is stored there, including event chats and group chats. Choose a community whose people you trust.
If you delete your account, every message you wrote reads This message was deleted and the photos you sent are deleted. The server's own daily copies made before then keep them for up to 14 days. A backup an owner downloaded keeps them until the owner deletes it. See "Leaving or deleting your account".
If you linked a sign-in account, joined with one, or added one later, your community's server keeps a locked copy of your account for it. The people who run that server can open it. Only your 12 words need nobody. See "Getting your account back".
On the global community, its moderators can see which accounts joined from the same internet connection within a day of each other, but never the connection itself, so they can deal with a burst of fake accounts in one go. See "Reporting a problem".
When you join the global community, it keeps a scrambled reference to the internet connection you joined from for a day, never the address itself. With it, when many accounts are being made from one connection, each new one there takes a little more setting up, and only so many can come from it. If the community removes an account within a day of its joining, that reference is kept for 7 days from the join instead, so new 12-words accounts from the same connection take longer to set up that week. It is never kept longer for someone who deleted their own account.
If you join the global community with 12 words, all it learns at the door, besides that reference, is the name you chose and your account's key: no email, no phone number, no other account.

In Settings, under Legal & Privacy, tap Privacy Policy.

The same guide is in the BeanPool app, and works there without a connection: open Settings, then "Help & how it works" under BeanPool. Every other rule, guide and manual is in the Help Centre. Guide version 112.