In a discussion titled “Staged users and privacy” under the Support category, Jonathan5 asks about the visibility of staged users (e.g., imported via mailing list into a private category) to other users, including unregistered or varying trust levels, and how to minimize exposure. hiddenseal responds that if staged users are placed in a private group, the group’s membership remains hidden from non-members — though user profiles themselves remain visible unless the user manually hides them. Jonathan5 follows up, questioning whether admins can programmatically set profile visibility for staged users, perhaps via database query. In a subsequent post, Jonathan5 suggests an alternative: naming staged users generically (e.g., “staged1”, “staged2”) to obscure real identities, noting that usernames can later be changed if the user registers. The discussion centers on balancing privacy for imported users with Discourse’s default visibility rules, exploring group permissions and username obfuscation as potential mitigations.
Continuing the discussion from Hide User Profiles setting incomplete:
If staged users are created (eg during a mailing list import to a private category) what information about the staged users is available to others (unregistered or at the various trust levels)? How can this be minimised? Thanks.
If I understand you correctly, the imported users are placed into a group (otherwise, I can’t imagine having a private category).
You could make the group visible only to group owners/members (in effect, being invisible to everyone who is not in the group). This is done in group settings.
I don’t think anything can prevent other users from seeing a user profile, but if the group is private, they won’t see who’s in that group. They won’t be able to tell if someone is in a private group unless that someone has a title specific to that group, but then again, they won’t know anything beyond that.
I believe it’s possible for a user to hide his own profile – I wonder whether it’s possible as admin to set this for staged users? Maybe with a database query?
Alternatively, I guess the staged users could just be named staged1, staged2, staged3 etc, so their existence wouldn’t reveal anything about the users. I assume it’s possible to change a username later, if the user registers for the forum.