Roles & visibility
Peekr has one visibility rule, and the database enforces it on every query — the web app, the API, sync and the MCP servers all go through it. There is no code path that can show someone a capture the rule says they can't see.
The rule
You can see a capture if any of these is true:
- You made it.
- It's in a group you're a member of.
- It's in a workspace-visible group and you're a member or admin of that workspace.
- You're an owner or admin of the workspace it's in.
A capture that isn't in any group is visible only to its author (and workspace admins). Filing it into a group shares it with that group's audience — that's the moment sharing happens, and it's always deliberate.
Roles
| Role | Sees | Can |
|---|---|---|
| Owner | Everything in the workspace | Everything an admin can, plus delete the workspace and transfer ownership |
| Admin | Everything in the workspace | Manage members, invites, groups, bots, webhooks, settings; edit and resolve any capture |
| Member | Workspace-visible groups, private groups they're in, their own captures | Create groups, invite guests into their private groups, edit captures they can see |
| Guest | Only the private groups they've been added to, and their own captures | Capture into those groups, comment, claim and resolve within them. Can't create groups or invite |
Groups
- Private groups are visible to their members plus workspace admins. When an admin opens a private group they aren't in, the group's members get a notification — quiet accountability rather than a secret.
- Workspace-visible groups are visible to every member and admin. Guests never see them.
- Changing a group's visibility re-evaluates who can see every capture in it. The web app tells you how many captures are affected before you confirm. Devices that lose access drop the captures on their next sync; devices that gain access pull them.
- Deleting a group doesn't delete its captures — they become private to their authors again. Admins can restore a deleted group within 30 days.
Agents and bots
- An agent connected by a person (through OAuth or a personal token) sees exactly what that person sees and acts in their name. Tokens can be narrowed to read-only or to specific groups; they can never see more than the person.
- A bot is a workspace identity with a role (member or guest) and group memberships of its own. It sees what a person with those memberships would see. Assign captures to it, make it a group's default assignee, give it a webhook.
- Every action taken through an agent is recorded with both identities, and shown on the board as “Client · Person” or the bot's name.
What admins can't do
Admins can see everything in their workspace, but they can't read your captures in other workspaces, your local-only library, or your account's tokens. Removing someone from a workspace leaves their ungrouped captures with them; the captures they filed into groups stay with the group.