Privacy Policy

Last Updated: October 4, 2026

1. Your Keys, and What Recovery Costs You

BeanPool is a peer-to-peer (P2P) localized protocol natively bypassing centralized tracking silos. Our systems are mathematically verifiable, functioning without a central corporate authority tracking your personal data. Your Ed25519 keypair is generated on your own device. It leaves the device only as a locked copy, if you use a sign-in for recovery (below), or when you copy your account to another device of yours. Where it is kept differs by app, and we would rather say so than round it up: on the phone apps it is held in the operating system's secure storage (Android Keystore / iOS Keychain, via SecureStore), and you can put an optional biometric lock on the app itself; in the browser app it is held in that browser's own local database on your device, which is not hardware-protected. Your 12-word recovery phrase is the only recovery path that depends on nobody.

Sign-in recovery is custodial, by design. If you link an Apple, Google or Facebook sign-in on the phone app, or join the global community with one, your community's node keeps a locked copy of your account: your key, and your 12 words if your device had them. That sign-in opens it. The people who run your community's node can open it too, because their node checks your sign-in and so learns the id that opens the copy. On the global community, that is us. So can anyone who has the node's whole data folder, or opens one of its locked backups, and knows your sign-in account's id. Every app you signed in to with Google knows your Google id. A copy of the node's database alone opens no copy, once the node has been updated for it. We chose this deliberately: it is the difference between a way back in and none at all for members who lose a phone.

Anyone who takes over your sign-in account can get in too. When someone starts getting back into your account, your devices are told and the app offers to stop it, but with a sign-in they may already be in by the time you see it. So give that sign-in account a strong password of its own. If you do not want anyone but you to hold a way in, do not link a sign-in account, and keep your 12 words safe. Disconnecting a sign-in in the app deletes the copy, but not the copies already in the node's backups, or the copy it kept each time a sign-in brought your account back. The people who run the node can open those too. On a community whose node we don't run, these copies live on that node's disk, and they die with it: we do not hold them. Where we run a community's node, we hold them as its operator, as we do on the global community.

2. Location: You Place Every Pin

BeanPool does not track your location. There is no background location tracking of any kind, and the app never follows or records where a member is; the phone apps ask for location only while you are using them.

Location exists in BeanPool only as a pin you place yourself, on a post, an enterprise or an event. You can use your device's location once, at the moment you place that pin, or drop the pin by hand anywhere on the map. Enterprise and event pins can be marked Approximate, which rounds the coordinate to roughly 100 metres before it is saved, so a pin near home need not be your front door.

Pins are public within your community. Anyone who can open your community's map can see them, which is what makes local discovery work — so place a pin where you are willing to be found, and use Approximate when it is at someone's house.

3. Data Collection Restrictions

We do not capture analytical telemetry, behavior-tracking metrics, or third-party marketing metadata. Your application communicates directly with the community nodes that you explicitly join and trust. Any marketplace Needs or Offers you create are broadcast strictly to the specific community ledger tied to your cryptographic callsign.

4. Account Eradication & Data Portability

You retain complete control to erase your identity at any point via the Settings -> Reset / Wipe Identity option. Deleting your local keys renders all your historical transactions cryptographically untamperable and your local identity permanently closed.

5. Moderation & Safety Compliance

Because the platform enables users to broadcast public Needs and Offers within neighborhood networks, we enforce strict client-side blocking and reporting tools. Verified participants can sever, block, and report inappropriate content, which transmits signed cryptographic flags directly to community moderators to maintain safe, healthy local exchanges.

6. Member-Connected Channels & Platform Data (TikTok, Instagram & Video Feeds)

Members may optionally connect their external publishing accounts (such as TikTok, Instagram, YouTube, SoundCloud, or RSS feeds) to syndicate their public posts into the community Pulse feed. Connecting a platform is entirely voluntary and member-initiated.

When connecting an account via OAuth (TikTok or Instagram):

• Device-Side Token Storage: You authorize your account directly with the platform provider. Platform OAuth access and refresh tokens are stored exclusively on your own device in secure hardware storage. Access tokens are never stored on or held by the community node database.
• Limited Scope & No Private Data Access: BeanPool requests only the basic public profile permissions needed to verify channel ownership (such as username and public identifier) and list public videos or posts. The system does not access, read, or store your private messages, direct messages (DMs), follower or following lists, or private/unlisted content.
• What the Node Stores: When public posts are syndicated to the feed, the community node stores only public post metadata: the platform name, your channel identifier and member public key, the platform post identifier, the canonical post URL, the public post title or caption snippet, the preview thumbnail image URL, the publication timestamp, and your selected category. The node also keeps a cached copy of each post's preview image, described below.
• Preview Images Only — No Video or Audio Hosting: So that the feed loads on slow connections, and keeps working after a platform's image link expires, the community node fetches each post's preview thumbnail image and keeps a cached copy, which it can serve to the feed itself. Only still images are cached (JPEG, PNG, WebP, GIF or AVIF, at most 2 MB each), in memory (up to 20 MB, cleared when the node restarts) and on the node's disk (up to 100 MB in total, with the least recently viewed images removed first when that limit is reached). Cached images are not copied to other nodes. Both the web app and the phone app load preview images through the node, so your device does not contact the platform's image servers when it shows a preview; if the node cannot supply an image, the card shows a plain platform placeholder instead. Video and audio are never downloaded, copied, or re-hosted on the community node: content is played through each platform's official player or opened via an external link.
• Retention & Scrubbing: The node keeps the 20 most recently published items from each connected channel. Items beyond those 20 are automatically pruned, typically within minutes of newer posts arriving; items are not removed on age alone. Curated learning content that BeanPool supplies to every node is exempt from this limit and contains no member data. When an item is pruned or deleted, the node records a tombstone deletion timestamp and immediately scrubs the post URL, title, and thumbnail URL to NULL, permanently erasing that data from the database. From that moment the node stops serving the item's cached preview image. The cached image goes with the item on every path that removes it — deleting a single post, deleting a channel, deleting your account, the automatic retention pruning, the inactivity prune, and an operator takedown — and is deleted from the node's memory and disk at that moment, not on its next request.
• Disconnecting & Deleting Channels: You can disconnect an OAuth account at any time in the app, which immediately deletes the stored access token from your device and clears verification on the node (existing imported items remain until you delete them or the channel, or until newer posts from the same channel push them out of the 20 kept). If you delete a channel entirely, the channel link and handle are immediately scrubbed to NULL and all associated imported feed items are scrubbed from the node.

7. Events, RSVPs & Event Chat

Members can post an event to their own community or to one of its groups. The community node stores what you type into the event — its title and description, the start and end times, the place name, the map pin you drop, any photos, and the private note for people going — together with each RSVP: which member marked themselves Going or Interested, and when. The host sees who has replied. Members marked Going can see each other in the event chat. Everyone else sees only the counts.

• The private note: shown only to the host and to members marked Going. It is never part of a public listing.
• The event chat: open to the host and everyone marked Going. It is not end-to-end encrypted, unlike a direct message: the node stores these messages in a form it can read, so that the host can remove a message and so that membership can follow the RSVPs. Your node's operator can read an event chat. The app says so on the chat screen.
• It stays in your community: an event is always local. The event, its RSVPs, the private note and the chat are never sent to another community's node — they stay on your own node and in that node's own backup.
• Thirty days after the event ends: the RSVPs, the chat messages and the private note are deleted from the node. The event post itself remains, inactive, as other finished posts do.

8. Known Communities: Real Names and What Admins Can See

Some communities confirm their members by real name, the way a LETS keeps a membership list. In such a known community, your name is sealed on the admins' phones before it reaches the community's server: the operator and BeanPool cannot read it. Your balance stays private to you except in the four cases below. What any admin can see of your trades is listed below too, and it is nothing more. The first case is one you agree to when you join: the join screen says, in your community's own numbers, when the admins can see your balance (if it goes past a share of your credit line, or if you stay in debit for a number of days without a sale).

• Only with your consent, and only once confirmed: the app records when you agreed and to which wording. Without that, or in a community that does not confirm members, the admins' list of balances never shows you. Saying no changes nothing else.
• You can take your consent back at any time, in Settings, as easily as you gave it. From that moment you are off the list. The app keeps a record that you agreed and that you withdrew.
• When an admin removes your account: the admin who starts removing you sees your balance and how many trades you have open, so that what you hold or owe can be settled. This happens whether or not you agreed to anything above.
• When the community votes on removing you: everyone who can vote in it sees your balance and any debt, in that vote only. An admin or an owner who can't vote in it doesn't see them there. Those looks are not logged.
• The watchers are watched: every time an admin opens the list of balances, the node records who and when; every time an admin sees your balance while removing you, it records who, whose and when. Every other admin and the owner can see that record. A look at your balance in a vote on removing you is not recorded. There is no export of balances.
• The server's operator: whoever runs your community's server holds its whole database, balances and trades included, and its backups, snapshots and standby copies, as the operator of any server does.
• What any admin can see of trades, in any community and whatever you agreed to: a trade that isn't finished yet or that an admin settled (both members, the listing, the price, and the messages in the two members' one-to-one chat, which an admin can't read if it is private), so that a stuck trade can be settled; a trade whose Beans were left stuck when a member was removed on an older server (the trade's status, the listing, the price, its dates, the Beans left stuck, how many payments went through it, and the last one's amount and note); a fraud alert that names two members who buy from each other back and forth, about evenly, past a limit, with the Beans in total and how evenly they went each way; a fraud alert that names a member and the members they invited when those members send them Beans past a limit within a set number of days, with the Beans in total and how many of the members they invited have traded with no one but them; a fraud alert that names a group of members, at least half of them new, who trade mostly with each other, with how much of the group's trading is with each other but no Beans; and an alert that names the members who have had no Beans move in or out for a set number of days. Every look at one of those trades is logged, with who looked, when, and at which trades; a look at the alerts that name a member is logged the first time each admin opens them, and again at that admin's first look after 24 hours, and the looks in between add no line. The owner and the admins can see that log. The member stats the admins see show how many posts each member has up and messages they have sent, and of trades only the whole community's totals, never one member's. Every member, admins included, sees each member's trust profile: how many of their trades were finished and how many were cancelled, and the share finished, how many Bean payments they have sent to or received from members plus the trades they have finished, with how many different members they have paid, been paid by or traded with, how many payments and trades they have done with the member looking, and their Trust Points. It isn't logged, because every member can see it. Nothing else of anyone's trades.
• Who holds it: the community, not BeanPool. Ask your community's admins to see, correct or delete your entry. A record of a debt left behind when a member leaves is kept 3 years, then deleted.

Contact Administrator

For protocol inquiries or privacy concerns regarding your specific local community node, please contact your local node operator or email [email protected].