Your privacy

What others can see about you, and the settings that control it.

Opening Settings

Tap the sliders button at the top right of the screen. In the web app on a wide computer screen, it is a gear at the bottom of the left sidebar instead. Settings is not one of the tabs.

What members of your community can see

Your name, photo, bio, when you joined and when you were last active.
Your trust badge, your reviews (nobody else can see who wrote a review), and your trust profile: how many of your trades were finished and how many were cancelled, and the share finished, how many Bean payments you have sent to or received from members plus the trades you have finished, with how many different members you have paid, been paid by or traded with, how many payments and trades you have done with the member looking, and your Trust Points. The admins see it as any member does, and it isn't logged.
Your posts, and where their pins are. See "Where your pin goes".
How you voted on a Poll, but only on a Poll its creator made an open vote. Polls are anonymous otherwise, and votes on Decisions are always secret.
Who invited you. On the phone your profile says Vouched in by and their name. If you came in as a founding member or were invited directly by the system admin, it says Founding member or Invited directly by the system admin instead. If a member vouched for your credit line, your profile says Vouched by and their name, in the phone app and the web app.

What only you can see

Your balance and your trades. Nobody else in your community can read them, in the app or from your community's server. A trade shows only its two people: you and the other person.
Your friends list, who you chat with, and the invites you made. Only you can read them, in the app or from your community's server. Others see only the connections in common you share with them.
If the community votes on removing you, everyone who can vote in it sees your balance and any debt, in that vote only. An admin or an owner who can't vote in it doesn't see them there. Those looks are not logged.
If your account is removed (after your community voted for it, or by an admin where votes are switched off), the admin who settles it sees your balance, so that what you hold or owe can be settled. The other admins and the owner can see who looked and when.
In a known community, if you agreed to it when you joined and an admin has confirmed you, the admins can see your balance once it passes one of your community's lines. You can take that back at any time in Settings. In any community, any admin can also see some of your trades: a trade that isn't finished yet or that an admin settled, a trade whose Beans were left stuck when a member was removed on an older server, fraud alerts, and an alert if no Beans have moved in or out of your account for a set number of days. Every look at one of those trades is logged, and a look at the alerts that name you is logged the first time each admin opens them in 24 hours. The owner and the admins can see that log. The admins also see how many posts you have up and messages you have sent, and of trades only the whole community's totals, not yours; and, as every member does, your trust profile, unlogged. Whoever runs your community's server holds its whole database, with its backups, snapshots and standby copies. See "What the admins can see".

The owners and admins who run your community's server can still see what is stored there. See "Who else can see things".

People who have not joined

On your community: nothing of your posts. Its listings, and their photos, are for its members, and so is your profile photo. Each photo opens only from the link that comes with its listing or with your name in the app, so someone outside sees one only if a member passes that link on. Someone who opens your community's address without joining is shown the way to the global community instead.
On the global community: anyone can look at its listings before joining, but they see only the words, the photos and roughly where each one is, never your name, your face or the exact spot.
Your Pulse posts: nothing. The Pulse is for members. The video or post itself stays on its own site (YouTube, Instagram and so on), as public as it is there. See "Sharing your channels".

What you control

Contact details: in your profile, choose Who can see this?: Hidden, Trade Partners, Friends or Community. See "Your profile".
Connections in common: when you and two people have each added each other, each of them can see your name on the other's profile, as someone they can ask. In Settings, under Legal & Privacy, turn off Show me as a connection in common and nobody sees your name there. It is on until you turn it off. See "People and friends".
Who added you: when you add someone, they see a line on their People tab saying you added them, so they can add you back. They are not sent a notification.
Location (phone): in Settings, under App Settings, turn Location on to use your position for the map and nearby posts. To turn it off, change it in your phone's own settings; the app shows you how. In a web browser there is no such switch: the browser asks you, and remembers your answer.
Your area (on the global community): in Settings, under Your area, see the area you gave, about 10 km around a town or two numbers, or Not set. Clear removes it. Below it, Roughly where are you? sets a new one with Use my location or Type a town or suburb, and Cancel (in a browser, ← Back to Settings) leaves it as it is. Only the rounded area is ever sent. Other members see how far away you are, and a poll you make is shown at your area. Without one, you see the newest listings worldwide, and members nearby won't see a poll you make in their list, though they can still find it by searching. See "Your area".
App Lock: asks for your phone's screen lock (its PIN, pattern, password, fingerprint or face) when the app opens, and when you come back to it after 15 seconds or more away. The lock covers the app's screens and pop-ups. On an iPhone it also closes a web page the app opened, such as your community's Settings from Manage. It can't cover a web page the app opened on an Android phone, which opens outside the app, or the panel for sharing something on either phone: close them before you put your phone down. Your community's Settings, opened from Manage, signs you out after 15 minutes unused. While App Lock is on, the app goes blank as you leave it, and comes back when you return. It needs a screen lock on the phone: without one there is nothing for it to ask.
Channels: anything you share to the Pulse is shown with your name, to everyone in your community. See "Sharing your channels".

Who else can see things

Chats between two people are end-to-end encrypted: a message that cannot be locked is not sent. The notices BeanPool adds to a chat about a deal, such as its amount, are not encrypted. See "Messages".
On the phone, a group's chat is end-to-end encrypted too, on a community whose server has been updated to lock group chats: the server holds scrambled words. It still sees who wrote, when, who was mentioned, which message each line answers, and the emoji reactions. The chat says whether it is locked. On a server that has not been updated, it can still read the group's chat.
Playing a YouTube video in the Pulse tells YouTube you watched it, the same as opening it in the YouTube app would. Nothing is sent to YouTube until you tap ▶, and scrolling past a video sends nothing at all. See "The Pulse".
Your community's server keeps your trades, posts and votes, and whom you blocked, in either app. The owners and admins who run it can see what is stored there, including event chats, enterprise chats, and group chats on a server that has not been updated to lock them. Choose a community whose people you trust.
Your blocks from the phone app go to every community you belong to on that phone, the global community too, so the people who run each one can see whom you blocked. A community you are only looking around as a guest gets none of them. See "Blocking someone".
If you delete your account, every message you wrote reads This message was deleted and the photos you sent are deleted. The server's own daily copies made before then keep them for up to 14 days. If your community's server sends its backups to storage somewhere else, each one made before then keeps them for up to 30 days. A backup an owner downloaded keeps them until the owner deletes it. See "Leaving or deleting your account".
If you linked a sign-in account, joined with one, or added one later, your community's server keeps a locked copy of your account for it. The people who run that server can open it. Only your 12 words need nobody. See "Getting your account back".
On the global community, its moderators can see which accounts joined from the same internet connection within a day of each other, but never the connection itself, so they can deal with a burst of fake accounts in one go. See "Reporting a problem".
When you join the global community, it keeps a scrambled reference to the internet connection you joined from for a day, never the address itself. With it, when many accounts are being made from one connection, each new one there takes a little more setting up, and only so many can come from it. If the community removes an account within a day of its joining, that reference is kept for 7 days from the join instead, so new 12-words accounts from the same connection take longer to set up that week. It is never kept longer for someone who deleted their own account.
If you join the global community with 12 words, all it learns at the door, besides that reference, is the name you chose and your account's key: no email, no phone number, no other account.

In Settings, under Legal & Privacy, tap Privacy Policy.

The same guide is in the BeanPool app, and works there without a connection: open Settings, then "Help & how it works" under BeanPool. Every other rule, guide and manual is in the Help Centre. Guide version 162.