Apply suggestion to docs/USER_GUIDE.md

docs/USER_GUIDE.md

@@ -25,7 +25,18 @@ Posts will contain the text you are posting, but some content will be modified:
 Let's clear up some basic stuff. When you post something it's called a **post** or it could be called a **status** or even a **toot** or a **prööt** depending on whom you ask. Post has body/content but it also has some other stuff in it - from attachments, visibility scope, subject line.
 * **Attachments** are fairly simple - you can attach any file to a post as long as the file is within maximum size limits. If you're uploading explicit material you can mark all of your attachments as sensitive (or add `#nsfw` tag) - it will hide the images and videos behind a warning so that it won't be displayed instantly.
 * **Subject line** also known as **CW** (Content Warning) could be used as a header to the post and/or to warn others about contents of the post having something that might upset somebody or something among those lines. Several applications allow to hide post content leaving only subject line visible. As a side-effect using subject line will also mark your images as sensitive (see above).
-* **Visiblity scope** this one is a bit complicated. Normally all posts are `public` (and this is the *only* option on some software like GNU/Social) but if you want it, you can make it your post `unlisted` which will prevent it from showing up on *Public Timeline* and *TWKN* but AFAIK it doesn't prevent it from showing up in search. `Followers only` (sometimes referred as `fo`) posts are only visible to **your** followers, it's implied to be used in conjunction with [locking your account down to only approved followers](#user-settings) since otherwise it doesn't provide much protection since anyone would be able to follow you and read the fo posts. Another problem with fo posts is that each post is visible to followers of the user posted, so if two users are having a conversations with followers only posts you'll probably see only one side of the conversation. `Direct` posts are direct "messages", they are just regular posts but visible only to people who are mentioned in the post, so be very careful when using direct messages since if you want to mention someone else they will also receive your message, but they won't receive all previous ones. Another note of advice - direct messages could potentially be read by instance admins and attachments in DMs are visible to anyone who has a link to the attachment, so using direct messages as a *secure* method of communication is ill-advised.
+* **Visiblity scope** controls who will be able to see your posts. There are four scopes available:
+
+1. `Public`: This is the default, and some fediverse software like GNU Social only supports this. This means that your post is accessible by anyone and will be shown in the public timelines. 
+2. `Unlisted`: This is the same as public, but your post won't appear in the public timelines. The post will still be accessible by anyone who comes across it (for example, by looking at your profile) or by direct linking. They will also appear in public searches.
+3. `Followers only`: This will show your post only to your followers. Only they will be able to interact with it. Be careful: When somebody follows you, they will be able to see all your previous `followers only` posts as well! If you want to restrict who can follow you, consider [locking your account down to only approved followers](#user-settings).
+4. `Direct`: This will only send the message to the people explicitly mentioned in the post.
+
+A few things to consider about the security and usage of these scopes:
+
+- None of these options will change the fact that the messages are all saved in the database unencrypted. They will be visible to your server admin and to any other admin of a server who receives this post. Do not share information that you would consider secret or dangerous. Use encrypted messaging systems for these things.
+- Follower-only posts can lead to fragmented conversations. If you post a follower-only post and somebody else replies to it with a follower-only post, only people following both of you will see the whole conversation thread. Everybody else will only see half of it. Keep this in mind and keep conversations public if possible.
+- Changing scopes during a thread or adding people to a direct message will not retroactively make them see the whole conversation. If you add someone to a direct message conversation, they will not see the post that happened before they were mentioned.
 * **Reply-to** if you are replying to someone, your post will also contain a note that your post is referring to the post you're replying to. Person you're replying to will receive a notification *even* if you remove them from mentioned people. You won't receive notifications when replying to your own posts, but it's useful to reply to your own posts to provide people some context if it's a follow-up to a previous post. There's a small "Reply to ..." label under post author's name which you can hover on to see what post it's referring to.
 
 Another note: PleromaFE provides a simplified way of posting, however there a lot of stuff going on inside and some other applications allow you to tweak the inmost details of a post - for example you can set "to" and "cc" fields without actually mentioning people, so if you see a post in your notifications that's supposedly not replying to you and doesn't have you in the mentions - it's probably one of those.