The screen that teaches the model. Every user is Public or Private — and Private hands strangers a fresh, un-linkable alias per event.
This is about your safety at real-world events. You can switch anytime.
Notes. Privacy is binary and relative to friendship: a friend always sees the real person, a stranger always sees the mask. The alias is minted fresh at Join, is unique within its event, and is permanent inside it. The profile↔alias mapping is encrypted at the application layer — the key never touches the database, so it is never inside a backup.