RSVP privacy

Status: Proposed 2026-09-24

An RSVP is the most sensitive record in the product after messages: it says a named person intends to be at a named place at a named time, often at a protest. This page is the rule set. The threat model explains the adversaries.

Who sees what

Viewer	Sees
Anyone (public event)	The count of going
Members of the hosting Grove (grove event)	The count of going
The organizer(s) of that event	Handles and avatars of going and interested, and the message-all action
A friend of the attendee	Nothing, unless the attendee chooses to share the event with them (which shares the event, not the RSVP)
The attendee	Their own RSVP in "my events"
Admins	Counts, and handles only in a moderation case tied to a report

There is no "who else is going" list for attendees. This is the deliberate difference from every mainstream events product, and the trade is worth it: a member can RSVP to an action without any other member learning it.

Enforcement

• GET /api/events/:id/attendees loads the event, checks that the caller is an organizer of the hosting Grove or an admin of the hosting organization, and otherwise returns 404 (not 403, so the route does not confirm the event's existence to a caller who cannot see it).
• GET /api/events/:id never embeds attendees.
• Counts are stored as rsvpCount and recomputed by the RSVP service on every change; they are never computed on the client from a list.
• event_rsvps rows are deleted 30 days after the event ends by a worker, so the historical record of attendance does not accumulate. A member's private action log is where their own history lives, under their control.

Details after RSVP

For sensitive actions, organizers can hide the exact meeting point until a member RSVPs. The listing shows the region and the time; the event page shows the address only in the response to an RSVP'd caller. This is a visibility check in the event read path, not a separate endpoint, so the address never appears in a public listing payload.

Organizer trust

Organizers of an event necessarily see who is coming. The controls: organizer status is per Grove or per organization (never global), the attendee list is a screen and not an export, and the docs say plainly that organizers see attendees so members can decide accordingly.

Notifications

Reminders ("your event is tomorrow") are sent to the attendee only. The organizer receives count milestones, never names, in push notifications.