Three audiences, on /sharing.

/sharing is where you decide who gets in. Your profile starts private.

Public — anyone with the link sees your summary and timeline. The page gives you the URL once it's on.

Specific handles — stay private, but let named people through one at a time.

Orgs — let an organisation's members through as a group.

The same page lists people sharing with you, which is the only way to find out someone has — nothing notifies you.

Category visibility is a separate page.

Widget visibility controls which categories a viewer gets, whoever they are: combat, commerce, movement, records, and your recent-activity feed.

The two levels multiply rather than override. A public profile with commerce switched off means anyone can find you and nobody sees what you spend. A private profile with everything switched on still shows nothing to anyone you haven't let in.

Two levels because “let my org see me” and “let anyone see my spending” are different decisions. Collapsing them into one switch would force you to over-share in order to share at all.

Every grant is reversible.

Going private again, dropping a handle, or leaving an org share all take effect immediately — there's no window where an old link keeps working.

Machines are separate from people: connected uplinks lists the desktop apps paired to your account, and revoking one there stops that machine sending. That is a different action from un-sharing your profile, and you may want both.

What leaves your machine in the first place.

Sharing decides who sees data we already hold. What gets collected at all is a different question, and /trust answers it — including the part people expect to be untrue.