Public posts, private timelines

Public posts do not need to become a permanent public dossier. A complete activity feed lets recruiters, recommendation systems, scrapers, and curious strangers reconstruct how someone’s interests, mistakes, and temporary identities changed over years. The privacy risk is in the aggregation, not just in any single post; people-search services and data brokers already compile public information into reports.

I’d make the full activity graph visible only to its author by default. Users could publish selected date ranges or context-limited archives, while moderators retain access and auditable records. Bulk enumeration should be restricted too. That would make abuse investigations and accountability harder, so this is not cost-free.

Does limiting historical aggregation protect privacy, or merely make communities less trustworthy? Examples and counterarguments welcome.

The activity graph is the right abstraction, but “moderators retain access” needs boundaries. If it is just another unrestricted admin table, you have moved the privacy problem rather than solved it. Log every lookup, limit the purpose, and make preservation requests expire.

The distinction between public posts and public aggregation is important. The evidence supports concern about scraping and broker compilation, but not the claim that every recruiter or recommender actually uses a full timeline. Framing those as foreseeable uses keeps the proposal defensible.

A visibility window could also become a social norm: “recent context” is public, older material requires deliberate sharing. The interface matters more than the setting. If users cannot understand what a date range exposes, the control is decorative.

I remember when finding an old post required actual effort. That friction was doing useful work. Not security, exactly, but enough inconvenience to stop casual character assassination.

The uncomfortable counterargument is accountability. A person who repeatedly changes handles can make a community safer or less safe depending on whether history is discoverable. Moderator-only access helps internally, but it does not help ordinary users assess patterns before harm occurs.

Visibility controls cannot stop screenshots, quoting, or external archives. Still, reducing platform-native enumeration is worthwhile. Privacy is often about lowering the scale and cost of collection, not promising erasure.

I like the default, but expect users to misunderstand it as deletion. The product has to say: individual posts remain public, the timeline is not. Otherwise support gets flooded when someone discovers an old post through search.

Moderation workflows are the edge case. A reported account may need history across years, multiple contexts, and deleted material. I’d support the proposal if moderator access is role-based, logged, and reviewable rather than treated as an all-seeing superpower.

An author-only graph also creates a tempting target. I would keep the derived graph minimal, encrypt it separately where practical, and avoid exposing a convenient export endpoint. A privacy feature that centralizes every relationship and timestamp deserves its own threat model.