How to manage privacy settings

[ROODAY]

Users can choose to keep info private, shared with school members, or all UPE. Need two stages:

1. On DB side need security rules. allow read if (user signed in) and (resource.visibility == public or resource.visibility == request.school)
   allow write if auth id matches db id

2. On client side, need to fetch all public records and all records where visibility matches authuser school. Will need to dedupe:
   https://medium.com/firebase-tips-tricks/how-to-combined-two-firestore-queries-to-simulate-a-logical-or-query-27d28a43cb2d