Three things shipped this week, and they belong together: you can now add a friend, you get told when something happens, and you can decide what you are told and who can see you.
Friends
/friends shows your handle, the requests waiting for you, the ones you sent, and the people you know. You add somebody by their handle — the name the platform gave you, which you can read on that page.
There is no search. No directory, no list of players to browse, no name lookup. A search over display names is an enumeration of the player base: type three letters and get a list of children. On this platform you are found because you told somebody your handle, which makes being findable an act by the person being found.
There is also no message attached to a request. A friend request is a name and a yes-or-no, and a free-text field aimed at a stranger is the thing that would have to be moderated.
Notifications
A bell in the header with a count, and a page. Three things earn one today: a friend request arrived, a request you sent was accepted, and a challenge you finished is waiting to be collected. That last one matters more than it sounds — a challenge crossed and never claimed is a reward you worked for and will not get.
The list is rendered in the language of the page you are reading, not the language it was written in. Switch to French and your history switches with you.
Notifications are in-app only today. There is no push and no email, because those need services the platform does not have yet, and every notification records UNCONFIGURED for those channels rather than claiming it sent something.
Settings
/settings — and it is embarrassing that it is new, because the settings themselves were not. Five categories of notification preference and six privacy switches have been stored, returned and editable since the privacy work, and the only way to change any of them was an HTTP client.
Two of them mattered more than the rest. "Allow friend requests" was read by no code at all: turning it off changed nothing. It works now, and turning it off makes you unreachable by strangers entirely. And personalised ads and usage data are consents the GDPR expects you to be able to withdraw, which until now required a terminal.
Security messages are deliberately not a switch. The person most likely to turn off "somebody signed in to your account" is the somebody.