The Members Manifest.

How the privacy works: when a member joins, their email is salted and hashed with SHA-256 server-side. Only the first and last 4 hex characters of that hash are stored in this view — that's enough to prove a unique member exists, but mathematically infeasible to reverse to a real identity.