# Users stats privacy

**URL:** https://meta.discourse.org/t/users-stats-privacy/59539
**Category:** Support
**Created:** [March 20, 2017, 12:13pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539 "2017-03-20T12:13:23Z")
**Posts on this page:** 19
**Page:** 1

<div class="post-metadata">

### Author: ![Shrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/shrike/32/68103_2.png) [@Shrike](https://meta.discourse.org/u/Shrike)
#### Post date: [March 20, 2017, 12:13pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/1 "2017-03-20T12:13:23Z")

</div>

Hi.

I’ve just noticed that every user has access to statistics on `/users` page where it’s shown how many times every user visits and how many posts he/she reads and views. It’s indeed useful info but I doubt it should be available publicly by default. Anyway is there any way to limit availability of visits/reads/views stats for every user?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 20, 2017, 2:09pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/3 "2017-03-20T14:09:51Z")

</div>

Closest you can get is: `hide user profiles from public` site setting, if you want to protect this info.

Short of that there is no way of removing this information from the payloads, you could create a custom CSS rule to hide the bits you do not want to easily expose.

---

<div class="post-metadata">

### Author: ![Shrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/shrike/32/68103_2.png) [@Shrike](https://meta.discourse.org/u/Shrike)
#### Post date: [March 20, 2017, 2:15pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/4 "2017-03-20T14:15:29Z")

</div>

I see, but are you sure it’s a good idea to show such info be default? How about introducing a new option `show user stats`. It could be not just a boolean but trust level meaning starting what trust-level users are allowed to see other users stats (there should be possible to set `moderators` and `admins only`).

BTW ` hide user profiles from public` means “Disable user cards, user profiles and user directory for **anonymous** users”. I set it on, thanks (again I’m sure it should be `true` by default). But it only restricts accessing info for non-authenticated users. For logged-in users it will be available.

---

<div class="post-metadata">

### Author: ![mikechristopher](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mikechristopher/32/89135_2.png) [@mikechristopher](https://meta.discourse.org/u/mikechristopher)
#### Post date: [March 20, 2017, 2:23pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/5 "2017-03-20T14:23:49Z")

</div>

I dont quite understand what is gained by someone being able to see this - yes you can see how many posts that have been read etc and how many times they have logged on but is it really a privacy issue?

---

<div class="post-metadata">

### Author: ![Shrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/shrike/32/68103_2.png) [@Shrike](https://meta.discourse.org/u/Shrike)
#### Post date: [March 20, 2017, 3:01pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/6 "2017-03-20T15:01:07Z")

</div>

> [@mikechristopher](#):
>
> you can see how many posts that have been read etc and how many times they have logged on but is it really a privacy issue?

I believe it is as it exposes users activity in real life.  
Would you agree if Facebook shows your such activity publicly (when you logged on, how many posts did you read, how long did you stay reading, etc).

---

<div class="post-metadata">

### Author: ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [March 20, 2017, 7:31pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/7 "2017-03-20T19:31:58Z")

</div>

> [@Shrike](#):
>
> I believe it is as it exposes users activity in real life.

It’s not so much as “exposes” as “makes easily available”. You can get the same (or similar depending on hidden topics) information by just crawling the site.

---

<div class="post-metadata">

### Author: ![Shrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/shrike/32/68103_2.png) [@Shrike](https://meta.discourse.org/u/Shrike)
#### Post date: [March 20, 2017, 9:26pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/8 "2017-03-20T21:26:21Z")

</div>

> [@elijah](#):
>
> You can get the same (or similar depending on hidden topics) information by just crawling the site.

not sure that I understand you,  
how will you know a user’s last login time by crawling the site?

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [March 20, 2017, 9:50pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/9 "2017-03-20T21:50:30Z")

</div>

> [@Shrike](#):
>
> how will you know a user’s last login time by crawling the site?

> **[@Shrike](https://meta.discourse.org/users/shrike.json)**

`last_seen_at:2017-03-20T21:48:54.722Z`

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [March 20, 2017, 9:52pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/10 "2017-03-20T21:52:10Z")

</div>

You could guess by finding a members last post.  
But if you’re talking about the Users page, last log-in isn’t given there either.  
Personally, I don’t consider my “activity” stats to be a privacy concern. I certainly wouldn’t want my email address or password to be available to members. Nor would I want my Preference Settings to be easily found (less a concern). But I have no problem with what shows on the User page or my Profile

---

<div class="post-metadata">

### Author: ![razaq](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@razaq](https://meta.discourse.org/u/razaq)
#### Post date: [March 21, 2017, 4:35am UTC](https://meta.discourse.org/t/users-stats-privacy/59539/11 "2017-03-21T04:35:58Z")

</div>

I agree that this should be somewhat private. Maybe number of likes received or given could be displayed but definitely not login times. Even if one can get them by crawling, at least we reduce the availability of such info by removing them or at least give the user the option to show or hide it.

---

<div class="post-metadata">

### Author: ![Krischan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/krischan/32/47290_2.png) [@Krischan](https://meta.discourse.org/u/Krischan)
#### Post date: [May 13, 2019, 1:06pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/12 "2019-05-13T13:06:26Z")

</div>

I would also love to see a more granular control over the public user data. Especially public time-based metrics that can be used to get user in trouble should be optional.

---

<div class="post-metadata">

### Author: ![P16](https://avatars.discourse-cdn.com/v4/letter/p/b19c9b/32.png) [@P16](https://meta.discourse.org/u/P16)
#### Post date: [May 13, 2019, 1:34pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/13 "2019-05-13T13:34:06Z")

</div>

One page which i think should be private is the invites tab. I don’t think anyone else should see who you have invited, etc.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 13, 2019, 2:16pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/14 "2019-05-13T14:16:34Z")

</div>

Users can opt to disable their profile page in their preferences now, under Interface:

> Hide my public profile and presence features

---

<div class="post-metadata">

### Author: ![Krischan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/krischan/32/47290_2.png) [@Krischan](https://meta.discourse.org/u/Krischan)
#### Post date: [May 13, 2019, 2:29pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/15 "2019-05-13T14:29:12Z")

</div>

Yes, but it would be cool to show your public profile and hide your presence features. 😉

---

<div class="post-metadata">

### Author: ![Benjamin\_D](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/benjamin_d/32/277831_2.png) [@Benjamin\_D](https://meta.discourse.org/u/Benjamin_D)
#### Post date: [October 6, 2019, 3:27pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/16 "2019-10-06T15:27:32Z")

</div>

Is there a way to have this option, to hide the public profile, enabled by default for new users ?

---

<div class="post-metadata">

### Author: ![Ralf\_Stockmann](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ralf_stockmann/32/505867_2.png) [@Ralf\_Stockmann](https://meta.discourse.org/u/Ralf_Stockmann)
#### Post date: [July 27, 2021, 7:17pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/17 "2021-07-27T19:17:34Z")

</div>

> [@Krischan](#):
>
> Yes, but it would be cool to show your public profile and hide your presence features.

I agree. Hiding the profile altogether is the atomic option. There should be some middle ground between “post privacy, I’ve nothing to hide” and “I’ll tell you nothing about me”.

---

<div class="post-metadata">

### Author: ![cawa](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cawa/32/259774_2.png) [@cawa](https://meta.discourse.org/u/cawa)
#### Post date: [May 11, 2022, 2:56pm UTC](https://meta.discourse.org/t/users-stats-privacy/59539/18 "2022-05-11T14:56:27Z")

</div>

This was requested and would also be much appreciated by users of our new (scientific) forum. We have added equipment user fields that they want to be able to see, but they are rather shy about having to expose their activity…

---

<div class="post-metadata">

### Author: ![Deads](https://avatars.discourse-cdn.com/v4/letter/d/6a8cbe/32.png) [@Deads](https://meta.discourse.org/u/Deads)
#### Post date: [May 28, 2024, 10:32am UTC](https://meta.discourse.org/t/users-stats-privacy/59539/19 "2024-05-28T10:32:16Z")

</div>

I’d like to be able to hide this info too.

---

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [May 28, 2024, 10:34am UTC](https://meta.discourse.org/t/users-stats-privacy/59539/20 "2024-05-28T10:34:48Z")

</div>

You can disable the user directory with the `enable user directory` site setting. You can also customize the directory columns if you just want to hide some data.
