What is public and what is not

A public record is a small file in your own repository on the AT Protocol network. Anyone can read one, other services copy them, and copies made before you delete yours can outlive it. You write every record in your own repository; nobody writes one for you, and no record ever carries someone else's name unless they wrote it themselves.

These are the ones you can create:

• A session proposal — its title, description, format, duration and topics, plus a public area if you name one. Never an exact address.
• Your confirmation when you accept an invitation to co-host a session.
• An endorsement of a proposal, if you make one. An endorsement is not a vote, and it spends nothing.
• An RSVP, and your availability for a proposal — each only if you choose to share it.
• Your display name and bio, only after you switch on the public profile in Account. Your photo, email and everything else stay here.
• “I hosted at this gathering”, only if the organizers allow role listings and you switch it on for that gathering.

A gathering publishes from its own account, not from an organizer's: the gathering itself, its policy, its rooms and tracks, the schedule once it is out, and vote totals after a round closes. Totals show counts only, never who voted, and a session named by fewer people than the gathering's threshold shows no count at all.

When you delete a record it leaves your repository and this app's index. Copies other services already took are theirs, and this app cannot reach them.

Joining a gathering makes you a member of that gathering and no other. Members see each other; the rest of the world does not.

• The roster and profiles — name, photo, affiliation, interests and what you are looking for. You can hide yourself from the directory in Account.
• Your messaging handle and your email address, each behind its own switch, per gathering. Email is off unless you turn it on.
• Transcripts a host, co-host or organizer attached to a session, and anything the gathering's assistant answers from them.
• Room outlines and floor plans on the gathering map.
• Chat groups and meeting links, and the exact address of a self-hosted session — those reach confirmed attendees, the host and the organizers. Everyone else sees the neighbourhood.

Hosts and organizers see how many people saved, RSVP'd to or voted for a session, never which people. A count that would come from a handful of people is withheld instead.

Your votes, once a round closes. While a round is open your allocation is yours alone: nobody sees a count, organizers included. When the round closes, the one thing that tied each vote to a person is destroyed in the same step, so afterwards nobody — not you, not the organizers, not the people who run this server — can say which votes were yours. Only anonymous totals remain.

Nothing about a vote ever becomes a public record. Neither do ballots, tickets, check-ins, rosters, RSVPs you did not choose to share, the names organizers use for speakers who have no account, or the reason anybody was reported.

No exact address is ever published. A self-hosted session's public area is rounded to roughly a neighbourhood; a private home's pin reaches members only. Room outlines stay in this app.

There is no leaderboard and no ranking. Tallies are listed alphabetically on purpose.

Session feedback is anonymous and appears only as a summary, once enough people have answered.

Signing in with an email address creates an identity for you on this instance's own data server: a permanent identifier and a generated handle such as calmotter417.unconference.events. Neither is derived from your email, and your email is never published.

The password for that identity is held here, encrypted, so you never have to manage one. Take ownership from Account → Identity whenever you like: you get a new password, shown to you once, and this app stops holding it. From then on you sign in to your own data server, change the password, export everything you have written, or move to another provider.

You can also sign in with an AT Protocol account you already have, such as a Bluesky one. Everything you publish here then belongs to that account, permanently, and this app asks you to confirm that before your first public action.

Leaving a gathering takes you off its roster and cancels your RSVPs. The sessions you proposed stay where they are: they are yours, and a gathering cannot take them down.

You can point your own assistant — Claude, ChatGPT, Cursor — at the gatherings you belong to and ask it about the schedule or about a session you missed. It sees exactly what you see and nothing more, it cannot change anything, and it cannot read votes, other people's messages or anyone's email address. Your questions and the excerpts it reads go to whoever runs that assistant.

A token is what connects it. Only a fingerprint of the token is kept here, so it is shown to you once and never again; revoke it in Account and the assistant loses its access immediately. How to connect one.

Transcripts stay inside the gathering that holds them, and are never published. Whoever attaches one confirms that everyone in the room was told the session was being recorded. If the organizers switch on search and answers, the text is indexed — on this server by default, or by the AI provider the operator or the gathering has configured. The gathering's Knowledge page says which is running.

This page explains the product. The binding version, with retention periods and where data is stored, is the privacy policy. Something here unclear or wrong? Tell the organizers of your gathering — they can reach the operator.