How directory visibility and privacy work

This page explains the layered privacy model that controls who appears in the directory and what each viewer can see. Members control their own visibility; admins set the defaults and can lock specific fields.

The short version

Three conditions must all be true for a member to appear in a directory: their membership must be active, they must not have opted out, and the viewer must meet the directory’s access level. Within those conditions, each field on a member’s profile has its own three-state visibility choice — Public, Members only, or Hidden — which the member controls.

How it works

The three visibility gates

A member appears in a given directory instance only when all three of the following apply:

Member status gate — the member’s effective status is active (or the admin has chosen to include lapsed members in that directory’s display settings).
Member opt-out gate — the member has not turned off “Show me in the directory” in their privacy settings. This toggle is the member’s master switch for directory presence.
Visibility scope gate — the viewer qualifies under the directory’s configured scope: Public (anyone), Members only (authenticated members), or Restricted (viewer’s level or tag is in the admin’s allowed set).

If any one gate fails, the member doesn’t appear in the directory for that viewer.

Per-field visibility

Even when a member passes all three gates, each field on their profile has its own visibility level that the member sets themselves:

Public — visible to all viewers, including visitors who aren’t signed in.
Members only — visible only to signed-in members; visitors see “Sign in or join to see this” in that field’s place.
Hidden — the field doesn’t appear in the directory at all. Nothing appears in its place.

Admin-configured defaults set the starting point for each field. Members can change any field their admin hasn’t locked. When a field is locked, it shows “Set by your admin” in the member’s privacy hub and cannot be overridden.

The difference between the opt-out and field settings

The opt-out toggle and the per-field selectors work together but serve different purposes:

Opt-out toggle (voluntary) — when the member turns this off, they disappear from the directory entirely. Their per-field settings are saved and automatically restore when they re-enable the listing. The field-visibility matrix collapses in the privacy hub while opted-out, with a note that settings are preserved.
Admin-locked listing — an admin can lock a member’s listing so the member can’t opt out. When this happens, the listing toggle is disabled with “Your admin has set this.” The per-field matrix remains visible and read-only so the member can see which values are enforced. The locked matrix does not collapse — hiding the enforced settings from the member would undermine the transparency this feature is designed to provide.

Multiple directories

When your organization has more than one directory instance, a member’s opt-out toggle applies to all of them. Per-instance opt-out granularity is not available at this time. Members see all directories they have access to in their portal.

Why it works this way

Privacy choices in a membership context are high-stakes: members may join a club without expecting their email address or profession to be visible to strangers. The three-gate model ensures no single misconfiguration exposes a member — all three conditions must be met. The per-field model gives members fine-grained control after they’ve opted in, so they can share what they want without sharing everything. Admins retain the ability to lock critical fields (such as Name = always public for board members) while leaving members in control of the rest.

The member’s opt-out also takes effect immediately with no sync delay — there’s no window where a member who has chosen to hide shows up anyway.

Edge cases & boundaries

Archived members never appear in any directory view, even admin mode. Archiving is a permanent exclusion.
A member’s opt-out applies to all directory instances in the organization at once; per-instance granularity is not available in the current release.
Per-field visibility changes (unlike the opt-out toggle) are batched into a single Save action, so one consent event is written per save rather than one per field.