Privacy in Groups

What the blockchain shows about a group, what is encrypted, who can read it, and where the protection ends.

#The Short Version

Who is a member, who the admins are and how the groups are linked is public, even when the group is private. Names, emails and the text of cards are not.

A private group hides what it is called and what its members say about themselves. It does not hide that an address belongs to it. If the fact of membership is itself sensitive, do not use a group.

An open campaign of a group is not a secret ballot (the secret ballot is another kind of campaign: see Secret Ballot, with its limits). A response is recorded under the member's address. The current members and the admins read each other's names on member cards. And in every answer setting somebody reads each address's answers; with "After the end date" that is every participant, once the campaign has ended. So the people who read the answers of a group's campaign can know, by name, who answered what and who did not respond.

Privacy says the same for all of Logbook on one page: what is public, what is encrypted, what cannot be deleted.

#What Anyone Can See

For every group, private ones included:

• The members as addresses, with when and how each joined and left, and whether an admin ended the membership
• The owner and the admins, who removed whom, appointments of admins that wait and who made each, and an offer of the group to a new owner
• The tree: which group hangs under which, requests to link, and paused links. A public parent gives away what a private subgroup belongs to
• Applicants' addresses, those not accepted and those withdrawn included
• How people join and whether a card is required
• Invitation links: that one exists, its limit, its last day, whether it only opens an application, and how often it was used. Not the link itself
• Lists: that a group keeps a list, each time its files change, and how many seats it has. Not the names of the seats or their links
• Seats: which address holds a seat of a community, under an id that is a salted hash of the seat's name. Through the published form of a subgroup's list: which taken seats that subgroup lets in
• Cards: that an address has a card, when it was written and how long each part is. An empty admins part shows that no email was given. Not what the card says
• Campaigns: which groups a campaign is for, when it was created, its waiting period and its end; for an open campaign of a group, who responded, when, and through which of its groups, and so who could respond and has not
• Sizes and times of every write

For a public group the name, the description and the card form are public too.

#What Is Encrypted

Everything in this table is encrypted in the browser before it is sent. The contract, the blockchain and Logbook's servers see ciphertext.

#Who Decides Who Reads

Not Logbook's servers: they hold no keys, except the session key of an app that a person connected through the remote MCP connector (see Clients and Where Keys Live). The keys are held by the Seal key servers: servers that Logbook does not run, 2 of 3 of which must agree on Testnet. Who runs the three key servers this site uses: two are run by Mysten Labs, the company behind Sui, which also runs the full node this site reads and the service behind Google sign-in; the third is a committee of operators reached through an address of Mysten Labs. They are independent of Logbook, not of each other: any two of the three release a key, so Mysten Labs alone could read what they protect. A key server releases a key only after it has run the group contract's own check for the address that asks: is this address the owner, an admin or a current member of this group, right now?

Two things follow. The check is code of the contract, and Logbook holds the key that can upgrade the contract (see The Limits below). And a key server sees every request: which address opens which group, and who reads whose card.

"The group's own admins" is meant literally. Rights flow down the tree, so an admin of a group above can manage a group below. The keys do not follow: an admin from above reads none of the above until they take a seat among the admins of that group, and the seat shows in the group's public list of admins. A member of a subgroup does not read the private name of the group above either.

#What Happens When Someone Leaves

Removing a member, removing an admin or changing the owner starts a new key period for the group. The contract calls it an epoch and keeps two counters: one for what members read, one for what admins read.

• What is written afterwards is encrypted for an identity the former reader never had a key for. A removed member is no longer served the group's key or any card. A removed admin is no longer served applications, the admins part of cards or the list
• What they read before, they may have kept. Encryption cannot take back what was already opened
• A card written before the change stays as it was until its owner encrypts it again. The page of the group asks for that with one button, and the text stays the same
• The admins' copy of a list is sealed again with a new key after an admin is removed. Until an admin presses "Seal it again", the stored copy is one whose key the removed admin may still hold. The List screen says so at once
• An admin who is removed and later appointed again reads again, also what was written while they were out

#Cards When You Leave

Leaving the group, or being removed, closes your card: nobody is served its keys any more, and it stays closed if you come back until you write it again. That is as close to deletion as a blockchain allows. The ciphertext stays in the history, and anyone who read the card earlier may have kept a copy.

#The Limits, Plainly

• Membership is public. See above
• Whoever controls a threshold of the Seal key servers reads everything encrypted with them. This is the trust all of Logbook's encryption rests on. Testnet key servers come without guarantees of service
• The contract can be upgraded during the beta, and Logbook holds the key that upgrades it: one key, not a multisig. An upgrade is a public transaction, but it can change who may decrypt what, so Logbook could read everything in the table above by publishing one. It would be seen; it is not yet prevented (see Smart Contract)
• Names meet responses. Members and admins read names; the readers of a campaign's answers read them per address. No open campaign of a group is a secret ballot
• Nothing is erased. A member record, an application, a response and the trace of an admin stay on the blockchain for good, with their times. Leaving ends a membership; it does not remove the record of it
• A card is a self-description. Nobody checks it
• Public to private does not erase. A group that was public and goes private keeps its old name and description readable in the history of the blockchain
• An admin from above can get in. They take a seat, visibly, and then read what the group's admins read. A group that links itself under a parent accepts this, and the screen that asks for a parent says so
• A link is a key. Whoever holds an invitation link can join while it has places; whoever opens a personal link first takes the seat. The secret part stays after the # and never reaches a server, but a forwarded link works for whoever gets it
• Logbook stores the list files, encrypted; its servers are never given the key of the admins' copy. If they are lost, taken seats survive and unused links do not (see Data Storage)
• No check of who a person is. The World ID check is not built. The email check confirms a mailbox, not a person, works with Google accounts only, and runs on a Logbook site only once its owner has switched it on