diff --git a/public/my.js b/public/my.js
index 21f668f..1eab8c2 100644
--- a/public/my.js
+++ b/public/my.js
@@ -826,7 +826,7 @@
         <div style="display:flex;gap:8px;flex-wrap:wrap;align-items:center"><button id="copyDirect" class="btn btn-secondary btn-sm">Copy Direct link</button><span class="micro" style="word-break:break-all;color:var(--muted)">${esc(directUrl)}</span></div>
         <p class="micro" style="margin:8px 0 0">${dd?'Either way you keep the entry reward on anyone you personally bring.':'<strong style="color:var(--text)">Team link</strong> helps your team qualify. <strong style="color:var(--text)">Direct link</strong> places every join under you (own spillover). Either way you keep the entry reward on anyone you personally bring.'}</p>
       </div>
-      <div style="margin-top:16px;padding-top:14px;border-top:1px solid var(--line)">
+      <div id="plBox" hidden style="margin-top:16px;padding-top:14px;border-top:1px solid var(--line)">
         <div style="font-weight:800;font-size:14px;margin-bottom:4px">\u2699\ufe0f How your link places people</div>
         <p class="micro" style="margin:0 0 10px">This is your choice, and you can change it any time. It only affects where NEW joins are registered \u2014 nobody already placed ever moves.</p>
         <div style="display:flex;gap:8px;flex-wrap:wrap">
@@ -850,6 +850,13 @@
       const bt=document.getElementById('plTeam'), bd=document.getElementById('plDirect');
       if(bt)bt.addEventListener('click',()=>setMode('team'));
       if(bd)bd.addEventListener('click',()=>setMode('direct'));
+      // This is a control, not information: only show it to someone who has proved with their
+      // wallet that this position is theirs. /my/<id> is a public page, so a visitor must never
+      // be offered a switch that changes somebody else's placement.
+      fetch('/api/public/msg-me').then(r=>r.ok?r.json():null).then(me=>{
+        const box=document.getElementById('plBox');
+        if(box&&me&&String(me.id)===String(d.id))box.hidden=false;
+      }).catch(()=>{});
     }
     const qr=document.getElementById('dQr');if(qr)qr.innerHTML=qrSvg(dashUrl);
     const qb=document.getElementById('dQrBtn');