Overview

Every Truestamp item carries a visibility setting with exactly three levels: private, team, and public. Visibility answers one question only: who is allowed to read the item. Who may change, redact, transfer, or delete it is a separate question answered by ownership. A newly submitted item is private unless a different level is chosen, and visibility can be changed at any time afterward. Because visibility is mutable organizational metadata and is not an input to any of the item’s fingerprints, changing it never alters a hash and never invalidates a proof.

The three levels

• private (the default): readable by the item’s user-owner. Independently of the setting, admins and owners of the owning team can read every item in their team, so a private item is never hidden from the team’s administrators. An item owned by the team itself (the team-retains ownership model) with private visibility is readable only by those team admins and owners.
• team: readable by every member of the owning team, including read-only viewers.
• public: readable by anyone. Any signed-in user can open it through the app and the APIs like any other readable item, and anonymous visitors can view and verify it through the public search and verification pages. Public means exactly that: anyone with the item’s link can see its name, description, tags, and cryptographic details.

These levels govern reading only. Uploading, editing, and deleting are always gated by ownership and team role, never loosened by a more open visibility level: marking an item public lets the world read it, not touch it.

How public items are discovered

A public item is reachable by people with no relationship to the owning team at all:

• Search. The public search page at https://www.truestamp.com/search matches items by free text (name, description, and tags), by claims hash, and by item ID. Anonymous searches return public items only; a signed-in user’s results additionally include their own and their teams’ items, with public items from unrelated teams presented in a separate group that links to the public verification view. Searching is rate limited per visitor (currently 60 searches per minute, 20 of which may be free-text).
• The public verification page. https://www.truestamp.com/verify/item/<id> renders a full verification view of a public item with no sign-in required; see verify a proof.
• Public block pages. An anonymous visitor browsing a block’s page sees only the block’s public items; the rest of the block’s contents stay hidden.

Items that have been redacted or are pending deletion are excluded from search results regardless of their visibility setting. Making an item public does not push it into any feed or directory; it becomes findable by anyone who searches for matching text, its hash, or its ID, and viewable by anyone who has its link.

Choosing visibility at submission

Visibility is optional at submission and behaves slightly differently per surface:

• APIs (JSON:API, GraphQL, MCP). The visibility field is optional and defaults to private when omitted.
• Web form. The new-item form shows a Private / Team / Public picker. On the free plan the picker is locked to Public, with an upgrade prompt for the other two levels; on paid plans (Starter and above) all three levels are selectable and the form preselects Team.

Changing visibility

Visibility is one of the item’s few mutable fields (alongside its team and tags); everything a proof depends on is immutable. Changing it is a rights decision keyed on ownership:

• The item’s user-owner can change it, provided they still have write access to the owning team (read-only viewers cannot write, even to items they own).
• Admins and owners of the owning team can change it on any item in their team, which is also the only path for team-owned items.

The change can be made from the item’s detail page (a Private / Team / Public control in the management section), via PATCH /api/json/items/:id, or via the GraphQL updateItem mutation. Because visibility sits outside claims_hash, metadata_hash, and item_hash, flipping an item between any two levels changes no hash and leaves every existing proof valid. Switching a public item back to private stops new visitors from reading it on Truestamp, but it cannot recall information that others have already viewed or saved.

What visibility does not control

• Rights. Visibility never grants update, redact, transfer, or delete permissions; those follow ownership, not authorship.
• Proof strength. A private item’s proof is exactly as strong as a public one’s. The submission window guarantee is identical at every level; only who can look the item up on Truestamp differs. An anonymous visitor can only open the public verification page for a public item. A signed-in visitor with read access to a private or team item, such as its owner, a team member, or a team admin, can still open the same page for that item as a preview, or verify any item from inside the app or with a downloaded proof bundle.
• Content removal. Making an item private again hides it but does not remove its stored content. To withhold the content of an item while keeping its proof valid, use redaction, described in the item lifecycle.