What Gerany's privacy protects

• One comment unlocking your account. A comment or a like is a one-way broadcast, not a relationship. It no longer exposes your messages, your profile or your circles the way it used to.
• Being enrolled in someone else's circle. A circle is a channel into your feed. It now takes an invitation you accept; no path adds you without your consent.
• Reading a handle off your content. No @handle appears on what other neighbours read, so a thread cannot be turned into a contact list.
• Permanent, resolvable invite links. A referral is single-use, expires within minutes, and is stored only as a keyed hash. A leaked link soon stops working and cannot be reversed.
• A blocked person reaching you through a shared circle. You can sever one connection per pair; the identity held for that connection stops resolving while the rest of the circle stays open.
• A reactor list on a comment. Reactions return a count, plus whether *you* reacted — never who else did. A like cannot reveal a sub-graph or who is in a circle.
• Reading a small group's size from its badge. Member and attendee counts below five are hidden.
• Your account id in third-party systems. Stripe, CRM exports and integration webhooks receive scoped references, not your account identifier.

These are honest limits, not loopholes we are hiding.

• Gerany itself still sees the graph. The platform can see who connects to whom. That is deliberate: it is what makes abuse traceable and accountable. Severing a connection removes reach, not accountability.
• A determined neighbour profiling a consistent stranger. Anyone who sees you often can build a picture over months. Removing handles and coarsening counts narrows it; it does not erase it.
• Self-disclosure. If you post your building number, your car or your pet's name, no setting can take that back.
• Behavioural fingerprinting. Writing style, topics and the times you post survive every privacy control.
• Off-platform knowledge. If a neighbour already knows you in real life, no app setting changes that.
• A camera pointed at a screen. Capture protection warns on screenshots and blacks out screen recording, but no phone truly blocks a screenshot, and nothing stops a second camera.
• Anonymity. These features pseudonymise; they do not anonymise. Gerany holds the account and the keys, so the usual privacy, retention and subject-access duties still apply.

Replies live in the thread. Messaging is separate, and your message policy governs it.

• Commenting and replying create no connection and do not unlock messages.
• Who may start a chat with you is set by your message policy: everyone, people you have actually talked with, people in your circles, or nobody.
• Blocking removes reach in both directions; severing removes reach for one connection only.
• You can always reply in the thread — to move a conversation to messages, you connect first.

You no longer carry a permanent invite code.

• Gerany mints a fresh link that expires in five minutes (ten at most) and is single-use by default.
• The server stores only a keyed hash of the link, so a database leak yields no usable invitations.
• Opening a link reveals no identity — not who invited you, not anything about them.
• Expired, used, revoked and wrong-purpose links all give the same answer, so a link cannot be probed.

A circle is an audience you choose, not one chosen for you.

• An invitation arrives as a request; you accept or decline, and nothing changes until you accept.
• Your circle-invite policy decides who may invite you at all.
• If you are already in a circle with someone you no longer want reach from, sever that one connection without leaving the circle.

Blocking is account-wide; severance is about one person.

• Sever removes reach for a single connection and leaves every other relationship — including a shared circle — intact.
• The identity Gerany derived for that connection stops resolving.
• The other person is not notified.

You can ask to connect with a neighbour you have seen, and you decide who may ask you.

• Your contact policy gates incoming requests; the default is people you have actually talked with.
• A decline is silent: the requester gets the same answer whether you declined, accepted, or the request was never recorded.
• Requests are rate-limited per person, so nobody can mass-request a neighbourhood.
• A request never reveals your @handle or account id.