What the admins can see

In a community whose admins keep a names list: what it holds about you, who can read it, what your community's server keeps, and what being confirmed means.

The names list

Some communities' admins keep a names list: who the members are, by real name, the way a LETS committee keeps a membership list. Not every community keeps one. Ask your admins whether yours does.

An entry holds your name and, sometimes, a short note an admin writes, like how the community knows you. Nothing else: no address, no date of birth, no ID number.

Who can read it

Only your community's owners and admins, on their own phones. Your name is sealed on an admin's phone before it is sent to your community's server. The server keeps scrambled text: a backup, a copy, BeanPool, or anyone who steals the database holds nothing readable.

Whoever runs the server can't read it. The admins' phones give the list's keys only to admins whose phones another admin has checked, on a call or in person, and take new keys only from them. That rests on the admins: an admin who checks the wrong person's phone, an admin's phone someone gets into, or a lost phone before the admins remove its key, can let someone else read the names. So can an admin's phone that whoever runs the server keeps from learning that an admin was removed: until it learns, what it writes can be read with the keys the removed admin had. An admin whose phone still shows the removed admin removes their key by hand, and that phone then makes a new key without them or writes nothing.

Other members don't see the names. They see your BeanPool name, as always.

An admin can make a PDF copy of the list on their phone, for safekeeping. Once made, it's theirs to keep safe, like a paper list. Every time the list is opened or copied, the other admins can see who did it and when.

Being confirmed

An admin may confirm you: they say your account is the person on your entry. Only someone who knows you should do that, and in some communities two admins must agree.

A confirmation carries no name. The server records which account, which entry and which admin, never who you are.
It is not a trust badge, and for now it changes nothing else in the app.
If an admin invited you by name, joining with their invite confirmed you against your entry, by that admin. "Confirmed" means only that an admin says this account is the person on that entry.
If you replace a lost phone and your account moves to a new key, your confirmation moves with it.
If you leave or delete your account, your confirmation ends. Your entry stays on the admins' list until an admin deletes it: ask them to.

What the names list doesn't show the admins

The list holds names and notes, and which account is whose. It doesn't show anyone your balance or your trades (an admin can see your balance in the cases below, and some of your trades: see the end of this page). See "Your privacy" for what members and admins can see otherwise.

What you agree to in a known community

A community that confirms its members, a known community, works the way a LETS always has: the admins keep an eye on debts that grow too big or stay too long. When you join one, the join screen says exactly when, in your community's numbers, for example:

"In this community, the admins can see your balance if it goes past 50% of your credit line or if you stay in debit for 60 days without a sale. That's how a LETS has always worked. Every time an admin opens the list of members past those lines, and every time an admin looks at your balance while removing you, it is logged. In a vote on removing you, everyone who can vote in it sees your balance and any debt, in that vote only, and those looks are not logged. You can take this back at any time in Settings. Whatever you choose, any admin can see some of your trades: a trade that isn't finished yet or that an admin settled (who with, the listing, the price, and your one-to-one chat with them, which they can't read if it is private), so a stuck trade can be settled; a trade whose Beans were left stuck when a member was removed on an older server (the trade's status, the listing, the price, its dates, the Beans left stuck, how many payments went through it, and the last one's amount and note); a fraud alert that names you if you and one member buy from each other back and forth, about evenly, past a limit, with the Beans in total and how evenly they went each way; one that names you, with the Beans in total and how many of the members you invited have traded with no one but you, if members you invited send you Beans past a limit within a set number of days, or if you are one of those members; one that names you, with how much of the group's trading is with each other but no Beans, if you are in a group of members, at least half of them new, who trade mostly with each other; and an alert that names you if no Beans have moved in or out of your account for a set number of days. Every look at one of those trades is logged, with who looked, when, and at which trades; a look at the alerts that name you is logged the first time each admin opens them, and again at that admin's first look after 24 hours, and the looks in between add no line. The owner and the admins can see that log. The member stats the admins see show how many posts you have up and messages you have sent, and of trades only the whole community's totals, not yours. Every member, admins included, sees your trust profile: how many of your trades were finished and how many were cancelled, and the share finished, how many Bean payments you have sent to or received from members plus the trades you have finished, with how many different members you have paid, been paid by or traded with, how many payments and trades you have done with the member looking, and your Trust Points. That isn't logged, because every member can see it. Nothing else of your trades. Whoever runs this community's server holds its whole database, your balance and trades included, and its backups, snapshots and standby copies."

Agreeing to that is your consent. Then, and only while an admin has confirmed you:

If your balance passes either line, your account shows on the admins' phones with your balance, so an admin who knows you can have a word. That list shows nothing else about you, and none of your trades.
Every time an admin opens that list, the other admins and the owner can see who opened it and when.
If you haven't agreed, or nobody has confirmed you, or your community doesn't confirm members, that list never shows you.

If you joined before your community asked, your app offers it to you. Saying no, or not answering, changes nothing else: you are still a member. If the community changes its lines later, your app asks you again.

You can take your consent back at any time: open Settings, where your app shows what you agreed to and when, and tap Withdraw. From that moment you are off the list. Your community keeps a record that you agreed and that you withdrew, and you can agree again later.

When an admin sees your balance anyway

Whether or not you agreed to anything, in any community:

When an admin removes your account. The admin who starts removing you sees your balance and how many trades you have open, so that what you hold or owe can be settled. The other admins and the owner can see who looked, at whose balance, and when.
When your community votes on removing you. Everyone who can vote in it sees your balance and any debt, in that vote only. An admin or an owner who can't vote in it doesn't see them there. Those looks are not logged.
Whoever runs your community's server holds its whole database, your balance and trades included, and its backups, snapshots and standby copies.

What any admin can see of your trades

Whether or not you agreed to anything, in any community, any admin can see:

A trade that isn't finished yet, or that an admin settled. Both members, the listing, the price, and the messages in the one-to-one chat of the two members. An admin can't read a private chat, only see who wrote and when. This is so that an admin can settle a trade that gets stuck.
A trade whose Beans were left stuck when a member was removed on an older server. The trade's status, the listing, the price, its dates, the Beans left stuck, how many payments went through it, and the last one's amount and note, so that an owner can write the stuck Beans off.
Fraud alerts that name members, with Beans. One names two members who buy from each other back and forth, about evenly, past a limit. It shows the Beans in total and how evenly they went each way. Another names a member and the members they invited, when those members send them Beans past a limit within a set number of days. It shows the Beans in total and how many of the members they invited have traded with no one but them.
A fraud alert that names a group of members, at least half of them new, who trade mostly with each other. It shows how much of the group's trading is with each other, but no Beans.
An alert that names the members who have had no Beans move in or out for a set number of days.

Every look at one of these trades is logged: who looked, when, and at which trades. A look at the alerts that name a member is logged the first time each admin opens them, and again at that admin's first look after 24 hours; the looks in between add no line. The owner and the admins can see that log in Community health, as a list of its own beside the list of who looked at a balance. A look made by an automation token (a script an owner set up) says so: the line reads "by token" and the token's name, beside the owner who made it.

The member stats the admins see show how many posts each member has up and messages they have sent, and of trades only the whole community's totals: how many trades were finished or cancelled and what the finished ones came to, never one member's.

Every member, admins included, sees each member's trust profile: how many of their trades were finished and how many were cancelled, and the share finished, how many Bean payments they have sent to or received from members plus the trades they have finished, with how many different members they have paid, been paid by or traded with, how many payments and trades they have done with the member looking, and their Trust Points. It isn't logged, because every member can see it.

Nothing else of your trades.

Asking about your entry

You can ask your admins what your entry says, to correct it, or to delete it when you no longer belong to the community. They keep the list, not BeanPool.

The same guide is in the BeanPool app, and works there without a connection: open Settings, then "Help & how it works" under BeanPool. Every other rule, guide and manual is in the Help Centre. Guide version 112.