# Staff should not see user profile email addresses without a click
**URL:** https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871
**Category:** Feature
**Created:** [8월 14, 2014, 10:15오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871 "2014-08-14T22:15:51Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8월 14, 2014, 10:15오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/1 "2014-08-14T22:15:51Z")
Continuing the discussion from [Last post versus seen timestamps](https://meta.discourse.org/t/last-post-versus-seen-timestamps/18856/6):
> [@PJH](#):
>
> why do Admins automatically get to see email addresses there?
I agree with this. Staff shouldn’t see emails unless they explicitly click to expand the email (e.g. they _need_ to see it for some reason) and this action should be logged in Admin / Logs / Staff.
Would happily accept a community PR in this area.
---
### Author:  [@Lid](https://meta.discourse.org/u/Lid)
#### Post date: [8월 14, 2014, 10:51오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/2 "2014-08-14T22:51:00Z")
There is actually no reason why email address should be visible/readable to staff at all, at least not by default.
Beside the masking of the email. make a configuration “email visible to staff” and turn it off by default.
This information(email address) in most cases does not have any operational value for individuals on this type of system even to a trusted staff. having a staff contacting a user by email not via the system, will probably require TOC change as well. more headache for site operators.
To a certain extant having this information “out there” create potential legal complexity and increase the risk of data privacy violations and security risks.
Imaging if a staff account get compromised it can potentially allow an attacker to harvest the entire user base email address.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [8월 14, 2014, 10:54오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/3 "2014-08-14T22:54:24Z")
Do we really need it on the public profile page to begin with? You can always get to it in the Users Admin area.
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [8월 14, 2014, 11:32오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/4 "2014-08-14T23:32:16Z")
Only extremely rarely have I ever had to email a forum member.
I have always sent a PM first, and only if they don’t respond in a reasonable amount of time have I then emailed them.
IMHO as long as it can be found somewhere for the rare instance it doesn’t need to be elsewhere.
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [8월 15, 2014, 4:16오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/5 "2014-08-15T16:16:07Z")
The e-mail address can be useful in identifying multiple accounts, but I agree, it shouldn’t be on the public profile.
---
### Author:  [@anon80392659](https://meta.discourse.org/u/anon80392659)
#### Post date: [8월 15, 2014, 4:29오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/6 "2014-08-15T16:29:40Z")
I like this request for a pull request so much that I had to like it twice.
No fair, my extra like was revoked. I demand reparations!
---
### Author:  [@lisajill](https://meta.discourse.org/u/lisajill)
#### Post date: [8월 15, 2014, 9:35오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/7 "2014-08-15T21:35:58Z")
We have the opposite problem here. We really need email addresses available to moderators and admins for a variety of reasons (looking up accounts in our other systems). If you take this away please, please leave a config option to turn it back on.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [8월 15, 2014, 9:42오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/8 "2014-08-15T21:42:33Z")
It is in the Admin Area… so it isn’t going away, it simply is staying in a Admin area place where it belongs. Moderators can currently see it there today.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [8월 16, 2014, 4:05오전 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/9 "2014-08-16T04:05:08Z")
Okay, so is this change as simple as removing the following from user.js.handlebars? ping @sam
```plaintext
{{#if email}}
{{i18n user.email.title}}{{email}}
{{/if}}
```
Or if you really want it on there, just visible by a click, is it as simple as altering the \ to receive a click event that replaces its current text with the email address?
---
### Author:  [@lisajill](https://meta.discourse.org/u/lisajill)
#### Post date: [8월 18, 2014, 1:53오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/10 "2014-08-18T13:53:07Z")
That’s several more clicks in order to get that information… we really need this to stay in the profile.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [8월 18, 2014, 3:30오후 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/11 "2014-08-18T15:30:58Z")
That’ll only obscure the email address. You need to remove the address from the serialized JSON of each user model and create a new route that emits just the email address and logs the action. And of course have a frontend that uses this.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [10월 4, 2014, 11:53오전 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/12 "2014-10-04T11:53:55Z")
I think this is now complete.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [10월 4, 2014, 11:53오전 UTC](https://meta.discourse.org/t/staff-should-not-see-user-profile-email-addresses-without-a-click/18871/13 "2014-10-04T11:53:58Z")