Struggling to comprehend users

That particular rule is set by default, and it trips folks up all the time. It wasn’t always like that, though… check out this thread for some context.

I have to believe the reason Bubble left the default rule in place on the User data type is to protect new users from themselves when it comes to having personally identifiable information accessible across users. Sure, you can “control” that access on the front end, but data that isn’t visible in the front end can still be sent to the browser by the server if you don’t have privacy rules in place.

Anyway, there is a ton of info out there on privacy rules, and you should definitely read up on them and figure out how to use them effectively in your app.