What the admins can see

In a community whose admins keep a names list: what it holds about you, who can read it, what your community's server keeps, and what being confirmed means.

The names list

Some communities' admins keep a names list: who the members are, by real name, the way a LETS committee keeps a membership list. Not every community keeps one. Ask your admins whether yours does.

An entry holds your name and, sometimes, a short note an admin writes, like how the community knows you. Nothing else: no address, no date of birth, no ID number.

An admin can add your name to the list when they invite you.

Who can read it

Only your community's owners and admins, on their own phones. Your name is sealed on an admin's phone before it is sent to your community's server. The server keeps scrambled text: a backup, a copy, BeanPool, or anyone who steals the database holds nothing readable.

Whoever runs the server can't read it. The admins' phones give the list's keys only to admins whose phones another admin has checked, on a call or in person, and take new keys only from them. That rests on the admins: an admin who checks the wrong person's phone, an admin's phone someone gets into, or a lost phone before the admins remove its key, can let someone else read the names. So can an admin's phone that whoever runs the server keeps from learning that an admin was removed: until it learns, what it writes can be read with the keys the removed admin had. An admin whose phone still shows the removed admin removes their key by hand, and that phone then makes a new key without them or writes nothing.

Other members don't see the names. They see your BeanPool name, as always.

An admin can make a PDF copy of the list on their phone, for safekeeping. Once made, it's theirs to keep safe, like a paper list. Every time the list is opened or copied, the other admins can see who did it and when.

Being confirmed

An admin may confirm you: they say your account is the person on your entry. Only someone who knows you should do that, and in some communities two admins must agree.

A confirmation carries no name. The server records which account, which entry and which admin, never who you are.
It is not a trust badge. It also gives you a credit line straight away, the known floor, unless your community's owner switched it off: see "Your credit line".
If an admin invited you by name, joining with their invite confirmed you against your entry, by that admin. "Confirmed" means only that an admin says this account is the person on that entry.
If you replace a lost phone and your account moves to a new key, your confirmation moves with it.
If you leave or delete your account, your confirmation ends. Your entry stays on the admins' list until an admin deletes it: ask them to.
If you are confirmed and you leave, are removed or delete your account while you owe Beans, the Commons covers the debt as always. The admins' list also keeps a note on your entry of what you owed, why and when, for 3 years, and admins see it next to your name on their phones. Nobody can be confirmed against that entry until it is paid back, worked off or forgiven.

What the names list doesn't show the admins

The list holds names and notes, and which account is whose. Apart from the note, above, of a debt you left owing, it doesn't show anyone your balance or your trades (an admin can see your balance in the cases below, and some of your trades: see the end of this page). See "Your privacy" for what members and admins can see otherwise.

The balance rule in a known community

A community that confirms its members, a known community, works the way a LETS always has: the admins keep an eye on debts that grow too big or stay too long. The join screen and "How this community works" say how, in your community's numbers. With the usual numbers, the join screen says how much a confirmed member can owe (the known floor), then:

"The admins can see a confirmed member's balance if they owe more than half their credit line, or are in debit and haven't made a sale for 60 days. Each look is logged."

That comes with being confirmed: there is nothing to agree to and nothing to withdraw. While an admin has confirmed you:

If you are in debit past either line, your account shows on the admins' phones with your balance and your credit line, so an admin who knows you can have a word. That list shows nothing else about you, and none of your trades.
Every time an admin opens that list, the other admins and the owner can see who opened it and when.
If nobody has confirmed you, or your community doesn't confirm members, that list doesn't show you, with one exception: if you step back from being confirmed while owing more than your ordinary credit line, you stay on it until you are back within that line.

Only an owner moves the two lines. A tighter line applies 14 days after the change, and "How this community works" says from when; a looser one applies at once.

When an admin sees your balance anyway

In any community, confirmed or not:

When your account is removed. In a community that votes, that is after it voted to remove you, or after an owner decided it because too few members could vote; where votes are switched off, it is when an admin removes your account. The admin who settles it sees your balance and how many trades you have open, so that what you hold or owe can be settled. The other admins and the owner can see who looked, at whose balance, and when.
When your community votes on removing you. Everyone who can vote in it sees your balance and any debt, in that vote only. An admin or an owner who can't vote in it doesn't see them there. Those looks are not logged.
Whoever runs your community's server holds its whole database, your balance and trades included, and its backups, snapshots and standby copies.

What any admin can see of your trades

In any community, confirmed or not, any admin can see:

A trade that isn't finished yet, or that an admin settled. Both members, the listing, the price, and the messages in the one-to-one chat of the two members. An admin can't read a private chat, only see who wrote and when. This is so that an admin can settle a trade that gets stuck.
A trade whose Beans were left stuck when a member was removed on an older server. The trade's status, the listing, the price, its dates, the Beans left stuck, how many payments went through it, and the last one's amount and note, so that an owner can write the stuck Beans off.
Fraud alerts that name members, with Beans. One names two members who buy from each other back and forth, about evenly, past a limit. It shows the Beans in total and how evenly they went each way. Another names a member and the members they invited, when those members send them Beans past a limit within a set number of days. It shows the Beans in total and how many of the members they invited have traded with no one but them.
A fraud alert that names a group of members, at least half of them new, who trade mostly with each other. It shows how much of the group's trading is with each other, but no Beans.
If someone vouched for you: any owner or admin can open that voucher's card. It shows that they vouched for you, how much, when you joined, whether you're below zero (never by how much), and a mark of where your finished trades reach: "trades with others", "trades inside only" (only with the voucher and the people their vouches reached) or "no trades yet". The mark never says whom you traded with. If you pass on part of a credit line someone gave you, the card of the voucher it came from shows only totals: how much was passed on, to how many people, and how much of it is held by someone below zero now. It never says who gave it or who holds it.

Every look at one of these trades is logged: who looked, when, and at which trades. A look at the alerts that name a member is logged the first time each admin opens them, and again at that admin's first look after 24 hours; the looks in between add no line. The owner and the admins can see that log in Community health, as a list of its own beside the list of who looked at a balance. A look made by an automation token (a script an owner set up) says so: the line reads "by token" and the token's name, beside the owner who made it. A look at a voucher's card is logged too, in the known floor's log, which every owner and admin can read: the first time each admin opens that card, and again at that admin's first look after 24 hours.

The member stats the admins see show how many posts each member has up and messages they have sent, and of trades only the whole community's totals: how many trades were finished or cancelled and what the finished ones came to, never one member's. Community health also shows the owner and the admins how far new members get, as a whole: how many reached a first trade, in steps of 5, and how long that typically took. It names nobody, and it shows no first-trade number or typical time for fewer than 5 people.

Every member, admins included, sees each member's trust profile: how many of their trades were finished and how many were cancelled, and the share finished, how many Bean payments they have sent to or received from members plus the trades they have finished, with how many different members they have paid, been paid by or traded with, how many payments and trades they have done with the member looking, and their Trust Points. It isn't logged, because every member can see it.

Nothing else of your trades.

An admin's AI assistant

An owner or an admin may connect their own AI assistant to the server to help them. It sees less than they do: never your messages, balance, trades, keys, photos or the names list, and never who reported anyone. See "When an admin uses an AI assistant".

Asking about your entry

You can ask your admins what your entry says, to correct it, or to delete it when you no longer belong to the community. They keep the list, not BeanPool.

Changes to community rules

Your community's owners can change these rules (such as who can join, Beans, and message requests), and members are automatically notified on Home whenever a rule changes. See "How this community works".

The same guide is in the BeanPool app, and works there without a connection: open Settings, then "Help & how it works" under BeanPool. Every other rule, guide and manual is in the Help Centre. Guide version 165.