Privacy
Mooting sends messages to people who never signed up for anything. They're on it because a friend's organising something. So it needs to be careful, and the way out is on every message.
Who sees what
Organisers of an event see the People page for everyone who's in on it:
- names, and the numbers and addresses Mooting has for each person, partly hidden (+44 7700 •••• 89, t•••@example.com), and whether they're confirmed;
- what everyone answered;
- whether they've opened their board in the last three days;
- who's stopped everything.
They can read the chat, and they can look at anyone's board using Preview as.
Organisers never see anyone's number or address in full. Enough to tell two apart, or spot the wrong one, but not enough to read off. Only you see yours in full, on How you're reached.
A link only opens in its owner's browsers. Every link Mooting sends carries a one-time pass, and the browser that opens it is that person's from then on. Open somebody's plain link in any other browser and you get Is this you? (or This is Ann's link, in a browser that's somebody else's), with nothing of theirs on it but their name. Getting past that takes a 6-digit code sent to one of their own confirmed numbers or addresses. So a link that's been forwarded, or copied out of an address bar, doesn't let anyone in as anybody.
Organiser pages need a checked browser too. The first time an organiser opens People, Event settings or anything else only organisers can do, in a browser that got in without a pass or a code (the first one to open their link, say), Mooting sends them a code. So someone who got hold of an organiser's link still can't open the People page without that organiser's email or phone. Two exceptions, so a new organiser isn't asked straight away: the browser that starts an event, and the first browser to open a link that was sent in the last hour.
Someone who's only asking to join isn't named on the People page, and their contacts aren't shown. It just says Someone asking to join, and what kind of contact they gave. Letting them in names them. Turning them away leaves the organiser knowing nothing about them.
Someone who picked a name on the shared link shows up as Someone says they're Kate, with their number or address mostly hidden (+44 •••• •• 89, k•••@example.com), and when they asked. That's enough to recognise a friend's number, but not enough to read off a stranger's. If they're turned away, what they typed is deleted.
Organisers never see anybody's link. No page ever shows one person another person's link, and links only go to the number, address or account they were confirmed on.
If your link's got out, use Replace my link on the Privacy tab of Your settings. The old one stops working everywhere straight away, and the new one goes to your confirmed numbers and addresses. Get it again on the front page doesn't replace anything: it sends your current link, and only ever to a number or address that's already yours.
Members see the event's board, the road with everyone's names and figures, the tallies on questions, and the chat. When a question closes, the result that goes on the board names the people who sat out. Members never see anyone's number or address.
Anyone with the shared link sees the event's name, dates and venue, the road with figures but no names, and how many notices are on the board (not what they say). The only names they see are in the list on the claim sheet. That's people an organiser has added by name who haven't picked up a link yet, so they can find themselves. Once someone's got their link, their name comes off the list.
What an organiser can't do to you
Three rules. They're built into Mooting, so they don't depend on anyone's good manners.
An organiser can never make your link go somewhere you haven't confirmed. They can type a number or address into your contacts (that's how a wrong number gets fixed). But once a link of yours has got through, nothing's sent there. It's stored, untested, until you confirm it yourself from How you're reached.
The only time an organiser typing a number sends a link is for someone whose link hasn't got through yet. Got through means it arrived on a number or address that's now confirmed, or you've opened the board with it. For someone brand new, that first message is what makes their link in the first place, and it's the first test of the number. And if your only link went to a number that never took it, an organiser can add your email and it goes there, the same as a first invitation. A link that never arrived isn't one anybody can take from you.
Adding a number Mooting already knows doesn't put that person on an event. It invites them. They get a message on the contact they already had, and the event asks them next time they open their link. Only they can say yes. Until they do, the organiser just sees the name they typed themselves, marked You invited them by text: not the person's own name, and no contacts.
Once you've got a link, your name and contacts are yours. An organiser can fix the name and number of someone they added who's never picked up a link, and of someone whose only event is theirs. Anyone else might be on events that organiser can't see, so only you can change your own name and contacts, from How you're reached.
A removed contact stays removed
Remove doesn't delete the contact, and it'll never hand the number to anyone else. But nothing goes to it again either. No announcements, no reminders, no links.
A removed number typed into Get it again, a shared link, or an organiser's Add someone box doesn't find anybody. It gets the same answer as a number Mooting's never heard of.
What's stored
- You. Your name and your figure.
- How you're reached. The numbers, addresses and devices you've been reached on, and the switches you've set.
- Discord. If you connect Discord, Mooting keeps your Discord user ID and nothing else from your Discord account. Not your name there, not your servers, and not the sign-in token Discord hands over while you connect (that's used once and thrown away).
- WhatsApp. If you add WhatsApp, Mooting keeps the number and nothing else. Not your WhatsApp name or picture, and not anything you send back to its number.
- What you've done. Which events you're on, what you answered, what you said in the chat, and who mentioned you.
- What was sent. A record of every message Mooting sent you: which event, which way, when, and what it said.
- Sign-in codes. Where Mooting texts a 6-digit code instead of a link (phone networks often block texts with links), it keeps a locked fingerprint of the code, never the code itself, and blanks it from the record of what was sent once the text has gone. A code is deleted as soon as it's used, replaced by a newer one, or worn out by five wrong tries, and stops working after 14 days.
- Browsers you've used. For each browser your link opens in: a fingerprint of a random number the browser keeps, a short name like Chrome on Mac, whether it can open organiser pages, and when it was added and last used. A code sent to check one is kept as a locked fingerprint, works for 15 minutes, and goes after five wrong tries.
- Passes. For each link Mooting sends you, a locked fingerprint of its one-time pass, never the pass itself, and when it was used. A pass works once, for 14 days.
- When you last looked. When you last opened each board. Put together with what's been posted since, that's what makes figures go to sleep on the road.
- Your theme. Whether you picked light, dark, or following your device.
In your browser
When you open your link in a browser that's yours, Mooting sets a cookie in it, wm_key, holding your link so the front page can welcome you back. No script on the page can read it, and it's only ever sent back to Mooting.
If you've picked Dark or Device under Theme in your menu, there's a second cookie, wm_theme, holding just the word dark or device. That's so the help pages, the front page and an event's shared link look the way you chose. It says nothing about you, and with Light, the default, there is no such cookie. The third, wm_dev, holds a random number that means nothing on its own. Mooting keeps a fingerprint of it, so it knows that browser's yours. No script can read it either. Those are the only cookies Mooting sets, and none of them tracks you.
Opening any page of yours also keeps a copy of your link in the browser's own storage. It never leaves the device. If you've put Mooting on your home screen, it uses that copy to open straight to your events, and the help pages use it to show the menu with the way back.
Forget this device clears it all, the cookies and the copy. A browser that forgets you is still listed under Browsers you've used until you sign it out there, but it won't open anything of yours: next time it'll ask Is this you?. Your link says more.
Discord
Connecting Discord adds you to one Mooting server, which only exists so the bot can message you. It has no channels, and members can't post there or see who else is in it.
But Discord shows mutual servers on people's profiles. So if another member comes across your profile, they can see you're both in it, and they could message you, the same as anyone on Discord could. If that bothers you, don't connect Discord. Texts and email do everything it does.
The bot's messages carry your link, just like texts and emails, with a one-time pass on it.
WhatsApp messages from Mooting go through Meta, like any WhatsApp message. Meta can see that Mooting's number messaged yours, and what it said: the event's name, the title of the announcement or question, or the line of chat that mentioned you. Your link is in the message's button, just as it's in a text.
WhatsApp tells Mooting when a message has been delivered and read. That's how the number gets confirmed, and how organisers can see it reached you.
Reply STOP to switch WhatsApp off for that number. Anything else you send to Mooting's number isn't read or kept.
Links are locked away
Your link has to be recoverable, because every message carries the current one. So the database keeps two things: a one-way fingerprint to look you up by, and a locked copy, sealed with a secret that's kept outside the database. Someone who walked off with the database file on its own wouldn't get anybody's link.
Logs never keep links
The server's log rewrites every address before writing it down, so a link becomes /k/[key]. The little messages pages pass between each other get blanked out too, because they can carry names and things people typed. The web server in front of Mooting doesn't log addresses at all. There's enough to spot a flood or a run of errors, but never enough to open someone's board.
Stopping, and leaving
Stopping everything from an event is one switch on the Pause or leave tab of Your settings (see How you're reached). No announcements, no reminders, no mentions, no digest. The board's still there if you want it, and organisers see stopped next to your name, so they know rather than guess.
Leaving one event is gentler than deleting yourself, and it's on the same tab. You're off that event's people, road and messages. Your answers and chat stay, under your own name, and your link still opens your other events. Organisers see a quiet line saying you left, and they aren't sent anything.
Delete me is on the Privacy tab of the same settings. Here's what it does:
- Your numbers, addresses, devices, WhatsApp number and Discord account are wiped and stopped.
- Your link stops working.
- The messages Mooting sent you are emptied of their words (and their links).
- Your name becomes someone.
- Your figure goes too. Everyone who's deleted themselves gets the same hooded figure, because the one you picked would give you away as clearly as your name.
- You come off every road.
What stays after Delete me is what other people made decisions on: your answers, your chat messages and your place on People pages, all as "someone". A tally that quietly changed afterwards would be worse than a name that says someone.
An organiser can delete a whole event. If they do, everything on it goes for good, including your answers and messages there. Nobody's told, and old links to it say it was deleted. You and your link stay, and your other events aren't touched.