How directory visibility and privacy work

This page explains the layered privacy model that controls who appears in the directory and what each viewer can see. Members control their own visibility; admins set the defaults and can lock specific fields.

The short version

Three conditions must all be true for a member to appear in a directory: their membership must be active, they must not have opted out, and the viewer must meet the directory’s access level. Within those conditions, each field on a member’s profile has its own three-state visibility choice — Public, Members only, or Hidden — which the member controls.

How it works

Who is listed, and who can open the directory

A member is listed in a directory only when both of the following apply:

Member status gate — the member’s effective status is active (or the admin has chosen to include lapsed members in that directory’s display settings).
Member opt-out gate — the member has not turned off “Show me in the directory” in their privacy settings. This toggle is the member’s master switch for directory presence.

Separately, the directory’s visibility decides who may open it: Public (anyone), Members only (signed-in members), or Restricted (administrators, and members with one of the allowed membership levels or tags). Visibility never changes who is listed — everyone who can open a directory sees the same list.

Per-field visibility

Even when a member is listed, each field on their profile has its own visibility level that the member sets themselves:

Public — visible to all viewers, including visitors who aren’t signed in.
Members only — visible only to signed-in members; visitors see “Sign in or join to see this” in that field’s place.
Hidden — the field doesn’t appear in the directory at all. Nothing appears in its place.

Admin-configured defaults set the starting point for each field: a member starts from them when they first save their directory settings. (Until that first save a member isn’t listed in any directory, and their privacy settings show the current defaults.) Members can change any field their admin hasn’t locked. When a field is locked, it shows read-only in the member’s privacy hub with the note “Your admin has set this — contact them to change it.”, and every directory shows the locked visibility for that member, whatever they had chosen. If the admin unlocks it, the member’s own choice comes back. Changing a default later doesn’t change members who have already saved their settings unless the admin applies the defaults to existing members.

(v1.2, 2026-10-17: this paragraph said only “Admin-configured defaults set the starting point for each field” and that a locked field “shows ‘Set by your admin’”.)

The difference between the opt-out and field settings

The opt-out toggle and the per-field selectors work together but serve different purposes:

Opt-out toggle (voluntary) — when the member turns this off, they disappear from the directory entirely. Their per-field settings are saved and automatically restore when they re-enable the listing. The field-visibility matrix collapses in the privacy hub while opted-out, with a note that settings are preserved.
Admin-locked listing (not available in the current version — only individual fields can be locked) — an admin can lock a member’s listing so the member can’t opt out. When this happens, the listing toggle is disabled with “Your admin has set this.” The per-field matrix remains visible and read-only so the member can see which values are enforced. The locked matrix does not collapse — hiding the enforced settings from the member would undermine the transparency this feature is designed to provide.

Multiple directories

When your organization has more than one directory instance, a member’s opt-out toggle applies to all of them. Per-instance opt-out granularity is not available at this time. Members see all directories they have access to in their portal.

Why it works this way

Privacy choices in a membership context are high-stakes: members may join a club without expecting their email address or profession to be visible to strangers. The two listing gates ensure no single misconfiguration exposes a member — both must be met — and a directory’s visibility separately limits who can open it at all. The per-field model gives members fine-grained control after they’ve opted in, so they can share what they want without sharing everything. Admins retain the ability to lock critical fields (such as Name = always public for board members) while leaving members in control of the rest.

The member’s opt-out also takes effect immediately with no sync delay — there’s no window where a member who has chosen to hide shows up anyway.

Edge cases & boundaries

Archived members never appear in any directory view, even admin mode. Archiving is a permanent exclusion.
A member’s opt-out applies to all directory instances in the organization at once; per-instance granularity is not available in the current release.
Per-field visibility changes (unlike the opt-out toggle) are batched into a single Save action, so one consent event is written per save rather than one per field.