Skip to main content
Privacy in Orgo works on two independent layers. You set organisation defaults that are copied onto each account the moment it is created, and every member then owns their own settings from that point on. On top of both, three tenant-wide settings decide who is allowed to browse the member directory at all. Default Privacy Settings with toggles for Name, Email, Phone, Age, Town, Profile Image, Profession and Social Media

​
Organisation defaults

Settings → Modules → Users & Profiles → Privacy Defaults. Only Orgo administrators can change it. Toggle ON means the field is visible to the community by default.
These are a starting point, not a ceiling. The values are copied onto a member’s own privacy record once, when the account is created. Changing them afterwards does not touch a single existing member, and nothing stops a member from switching a field back on that you defaulted to admin-only. If a field must never be visible to other members, remove it from the profile form rather than relying on the default.

​
What a member controls

A member opens their own profile, presses Settings, then the Privacy tab. Local admins (ADMIN_LOCAL and above) get the same panel for another member by adding ?tab=settings&setting=privacy to that member’s profile address (/user/{id}?tab=settings&setting=privacy). Changes save as soon as a switch is clicked, with the note Changes are saved automatically. Privacy section of a member's own settings, with the Make my profile completely private switch above a Who sees your data list where Name, Email, Phone, Age, Profile image and town, and Profession and social media each carry an Admins and a Community button The member panel groups fields more tightly than the admin defaults do: Profile image & town is one switch, and Profession & social media is another. Setting either one applies to both fields behind it. Each field has a Community / Admins switch, and the line under its name shows the current state: “All community” or “Only by admins”. Make my profile completely private sits above the rest. Turning it on sets every field to private and greys the individual switches out. Turning it off sets every field back to visible.

​
What each setting actually hides

This is what a signed-in member without HR or Financial permissions sees on someone else’s profile. Email, phone and social links are also connection-gated. Even when the member left them on Community, another member sees them only through an accepted connection (see My Network on the member profile); everyone else sees them blank. In the member’s own panel the line under these fields therefore reads “Only by my connections and admins” while the connections feature is on, and “Only by admins” when it is off, since without connections nobody can connect. Administrators with full access see them regardless. Three things are hidden from ordinary members no matter how the switches are set: date of birth, member card ID, and the identity verification record. Age can still be shown, date of birth cannot. Anonymous visitors and guest accounts get the strictest treatment. They see the shortened name and no email, phone, age, town, photo or profession, regardless of what the member chose.
Make my profile completely private does more than blank fields. The member is filtered out of member lists and directory queries entirely, and opening their profile URL returns “This profile is private” to anyone who is not allowed to see it.

​
Who sees the unredacted profile

Field-level privacy is skipped for:
  • the member themselves;
  • a parent who manages that member’s profile through the family feature;
  • organization admins;
  • organization-wide HR managers and financial managers, because both imply the assistant-level HR read;
  • chapter HR managers, parent-chapter HR managers, and chapter or parent-chapter financial managers over that member’s local center, for the same reason.
A member without a chapter is reached only through the organization-wide rights, so a chapter admin or chapter HR manager gets no special view of them. The private-profile master switch is narrower: it is overridden only by organization admins, organization-wide HR managers, chapter HR managers over the member’s local center, and parent-chapter admins inside their regional scope. An accepted connection also opens the profile, see below.
Financial permissions grant full profile visibility. If you appoint a treasurer at a local center, they can read every field on every member of that local center, privacy switches included.

​
Connections and contact details

Members can connect with each other. An accepted connection (pending or declined ones count for nothing) changes two things for regular members:
  • It opens the profile past the walls above. A connected member can open your profile even when Make my profile completely private is on, and even when Restrict Profiles to Shared Local Centers would otherwise keep them out. Minors stay hidden.
  • It is the only way contact details are shown. A regular member sees another member’s email, phone and social links only when the two are connected. Your per-field switches still win: a field you made private stays hidden from your connections too.
So with every switch on, a stranger still sees no email, phone or social links, and a connection sees them. Name, age, town, photo and profession follow their switches without needing a connection. Administrators and the other people listed under “Who sees the unredacted profile” do not need a connection.

​
Directory-wide visibility

Settings → Modules → Users & Profiles → Configuration, section Privacy & Visibility. All three need an Orgo administrator to change.

​
Bulk export

Exporting members to CSV requires chapter HR manager rights at minimum, and the export is capped at 500 rows per page. A plain member cannot download the directory even for fields they are allowed to read on screen, so field visibility and bulk access are two separate controls.