The short answer
On Mastodon, visibility is a per-post decision made by the author, not a single account-wide switch. A post can be public, followers-only or a private mention, and the same account can publish all three in one day. Old links keep the visibility they were given at posting time unless the author edits or deletes them. Reviewing those links does not require moving servers: you can inspect them from any logged-in account that is eligible to see them.
This guide is about reading your own visibility trail and auditing links you have already shared. It is not a generic private-account lookup page; for that boundary, see the related FAQ on whether a username scan can find private accounts.
Step 1: Know what each visibility level actually gates
Mastodon’s composer offers visibility choices, and the choice controls who can open the post’s permalink. The practical distinction is audience, not secrecy. A followers-only post is not a private message; it is a post whose audience is limited to approved followers. A private mention is addressed to specific accounts.
| Visibility | Who can open the permalink | Appears in public timelines? | Searchable by full-text search? | Typical use |
|---|---|---|---|---|
| Public | Anyone with the link | Yes, subject to instance rules | Only if the author opts in | Announcements, discoverable writing |
| Followers-only | Approved followers who are logged in | No | No, even with opt-in | Community updates |
| Private mention | Named recipients only | No | No | Direct coordination |
Two mechanics are worth internalising. First, restricted posts are not opened by anonymous browsers: a logged-out visitor hitting the permalink will not see the content. Second, search opt-in is separate from visibility.
Mastodon follower-only and private-mention posts require an eligible logged-in viewer to open their permalink. Source
That means an audit must be done while logged in as an eligible viewer, not from a private browser window.
Step 2: Audit old links without changing servers
You do not need to migrate instances to review your own posts. Work from the account that published them and from the links you saved or shared.
- Collect the permalinks you care about: posts you cross-posted, links you pasted into chats, and posts that were boosted. Boosts are a common leak path because a boost can carry a public post further than the author expected.
- Open each permalink in a logged-in session that is eligible to view it. If you are the author, your own session is the correct test for what followers see; use a second eligible account to confirm the follower view.
- Compare what you see with what you intended. A post you thought was followers-only but which opens in a logged-out window is public.
- Check search exposure separately from audience. A restricted post should not become public because the author enabled full-text search.
Opting an account into full-text search does not make restricted-audience posts public. Source
- Record the result in a simple table: link, intended audience, observed audience, action. Editing the post’s visibility or deleting it are author-side actions; neither requires a server move.
Step 3: Review public handles you have reused
Visibility on Mastodon is only half of a footprint. If you reused a handle across other networks, the public posts on those networks may be easier to find than your Mastodon timeline. A username lookup such as TraceSeek can surface public matches across 3,000+ platforms, which helps you build a list of profiles to review. Treat each match as a lead, not proof of ownership, and remember that a username search is not a complete account inventory. TraceSeek cannot change platform settings, cannot open restricted posts, and does not expose private records.
A first scan is free and does not require registration or login. The product describes a scan time of 20-30 seconds, which is a product statement rather than an independent measurement.
Decision table: what to do with an old link
| What you observe | What it likely means | Sensible next step |
|---|---|---|
| Permalink opens in a logged-out window | The post is public | Decide whether the audience still matches your intent; edit or delete if not |
| Permalink opens only for an eligible logged-in follower | Followers-only or private mention | Confirm the recipient list is still appropriate |
| Post is absent for a logged-out viewer but you expected public | Visibility was restricted, or the post was edited or deleted | Check the author’s own view before assuming deletion |
| Post appears in search results | Author opted into full-text search on a public post | Review the post text for details you would rather not surface |
| A restricted post appears in search | Unexpected | Re-check the post’s visibility setting; search opt-in should not widen a restricted audience |
Common mistakes
- Treating followers-only as private messaging. Followers can screenshot and re-share. Visibility limits the permalink audience, not the recipient’s behaviour.
- Auditing from a logged-out browser. Restricted posts will look missing or broken, which tells you nothing about who can actually see them.
- Assuming search opt-in is a privacy switch. It is not; it does not make restricted-audience posts public, and it does not protect public posts from being found.
- Forgetting boosts. A boost can move a public post into timelines you never intended to reach.
- Confusing a username match with identity. A matching handle on another platform is a lead, not proof that the same person owns both accounts.
- Assuming an edited or empty profile means data is gone. Editing a profile does not establish deletion of stored data.
Protecting your own footprint
Start with intent. Before posting, decide the audience and pick the matching visibility; retrofitting visibility after a link has circulated is harder than choosing correctly once. When you review old posts, keep a recovery method you control until any cleanup is complete, and do not treat removal of a login connection as account deletion. If you are closing an account, preserve access to a recovery method you control until closure is finished.
Finally, separate the two questions: what your Mastodon posts expose, and what your reused handles expose elsewhere. The first is governed by per-post visibility; the second is governed by what you published on other platforms. Review both, and keep public matches labelled as leads rather than conclusions.
Key facts
Mastodon visibility is chosen per post by the author, so one account can publish public, followers-only and private-mention posts.
Mastodon follower-only and private-mention posts require an eligible logged-in viewer to open their permalink. Source
Opting an account into full-text search does not make restricted-audience posts public. Source
TraceSeek covers 3,000+ platforms and describes a scan time of 20-30 seconds with a free first scan.
A username search is not a complete account inventory, and public username matches are leads rather than proof of ownership.