Community Recovery’s app, privacy first

Three places a word can be: yours alone, ours for members only, and out in the open only with a yes.

Where each person's words belong. Yours alone, sealed with a key only you hold: your kept days, the Sundial content. Ours, read by members only: who is a member, who invited whom, what each can offer and could use, each person's room with its introductions and words, the notebooks' answers, and the meeting room's record. Open only with a yes, one thing at a time: a line shared with our story, an offer someone wants the wider community to see, and the bridge's picture for the organisation, which carries no names: the bridge content.

Names, invites, offers, rooms, notebooks and meetings, read by members only, with one key that a keeper hands each newcomer in person.

On the shared beach the second circle needs a group seal: one key for Community Recovery's members, a copy sealed to each, as the beach already keeps a group block (coloured-stigmergy 1.5), brought into the page as coloured-stigmergy's pages that seal bring it (its 1.1); on a private ground (the ground, at 1.1111 here) it can simply be who may read. Either way a keeper adds a newcomer in person, as lost words are reset; a person who leaves is taken off and the key turns; rooms take words only from members; an introduction is known by the crossing agent's own key, not by the name it signs; and the crossing agent reads offers and needs as a member does. A visitor still sees the front door, where and when, the constitution, the standards, and the noticeboard if the leaders keep it open.

Where the place lives decides who could read it at all, and who answers for it: the shared beach, a private CLERO site, or the LERO’s own beach.

Privacy has levels, and the ground is the first. One, the shared beach as now: open by design, private only by sealing; David hosts it, holds its store and backups, and every lost-words reset needs him (leros-on-the-commons 1.17218); right for a test with people who know what they are part of (its 1.1113). Two, a private site for the CLERO network: one ground only its members can read at all, each LERO a place within it, the national picture read there, its host and who pays named by CLERO. Three, each LERO its own beach under its own domain, the LERO as host and data controller, stood up from the pscale-beach package as any operator does, the network reading across by reference, never by copy. The levels combine: a LERO on its own beach still seals each member's days and keeps its members' circle.

This belongs inside Matthew’s proposal as its next rung, once he and David share its lock.

The obvious end of phase two is inside leros-on-the-commons, as its next rung, written in place. That needs leros-on-the-commons and its law under a lock Matthew and David both hold: Matthew moves them onto it with one write each, and the phrase passes privately between them (two-spines 1.1111). Until then this proposal stands beside his, nested after it in each person's arrangement, and Matthew may take any of it in by his own write.