It's come up quite a few times since Hidden Communities were implemented - users expect privacy and unexpectedly end up losing it all when conversation gets migrated to the chat system. Suddenly their name and network profile are exposed on a message which was once linked to a profile not visibly linked to the rest of the network.
Fixing this in the chat system is unlikely to happen, just because of the way chat exists. You have a single profile which operates for all the sites on our network, minus two. So if you're holding out on being able to participate in a site-specific chat room without linking to the rest of your network activity, don't get your hopes up too high.
However, we can prevent the surprise of suddenly losing anonymity due to no fault of the owner by doing some more pre-processing on the site before the migration of comments to chat actually occurs. A couple of solutions:
Don't migrate messages from users who have the site hidden
Essentially, for each comment under the post look up the owner. If the owner has this site set as hidden, then just delete the comment and don't include it in the list of comments to be migrated into the chat room.
This is the less-than-ideal option because it can effectively destroy a conversation, making the migration to chat somewhat useless. If the entire conversation is between two users and you delete all the messages from one user, then all you're migrating is a one-sided conversation with no context.
Anonymize all messages from users who have the site hidden
Similar to the previous option, we'll need to look at the user. This time if they have the site set as hidden, we simply won't migrate their user data with the comment when it makes it to the new chat room (will show their plain-text display name with no link to their profile).
Assuming there are no major pitfalls with this solution, it'd be ideal because it preserves all messages and has less chance of breaking a conversation while still preventing the user's identity being revealed in chat. But there may be something I'm not thinking of here.
So what am I missing? Anything? Which option would be better for users who utilize the hidden communities feature and why? Or are there other solutions that might work better for this case?
No, we're not adding a site preference so users can choose what happens to their comments in these situations.