diff --git a/common/script/api-v3/cron.js b/common/script/api-v3/cron.js
index 132adafe32..604b6254f4 100644
--- a/common/script/api-v3/cron.js
+++ b/common/script/api-v3/cron.js
@@ -232,6 +232,7 @@ export default function cron (options = {}) {
   progress.collect = _.transform(progress.collect, (m, v, k) => m[k] = 0);
 
   // Clean PMs - keep 200 for subscribers and 50 for free users
+  // TODO tests
   let maxPMs = user.isSubscribed() ? 200 : 50; // TODO 200 limit for contributors too
   let numberOfPMs = Object.keys(user.inbox.messages).length;
   if (Object.keys(user.inbox.messages).length > maxPMs) {
diff --git a/website/src/controllers/api-v3/chat.js b/website/src/controllers/api-v3/chat.js
index aa56b03f73..e94546ddac 100644
--- a/website/src/controllers/api-v3/chat.js
+++ b/website/src/controllers/api-v3/chat.js
@@ -30,16 +30,21 @@ api.getChat = {
     let validationErrors = req.validationErrors();
     if (validationErrors) return next(validationErrors);
 
-    let query = groupId === 'party' ?
-      Group.findOne({type: 'party', members: {$in: [user._id]}}) :
-      Group.findOne({$or: [
-        {_id: groupId, privacy: 'public'},
-        {_id: groupId, privacy: 'private', members: {$in: [user._id]}},
-      ]});
+    let query;
 
-    query.exec()
-    .then((group) => {
+    if (groupId === 'party' || user.party._id === groupId) {
+      query = {type: 'party', _id: user.party._id};
+    } else if (user.guilds.indexOf(groupId)) {
+      query = {type: 'guild', _id: groupId};
+    } else {
+      query = {type: 'guild', privacy: 'public', _id: groupId};
+    }
+
+    Group
+    .findOne(query, 'chat').exec()
+    .then(group => {
       if (!group) throw new NotFound(res.t('groupNotFound'));
+
       res.respond(200, group.chat);
     })
     .catch(next);
diff --git a/website/src/models/group.js b/website/src/models/group.js
index 9bf5313858..07f9ec9b16 100644
--- a/website/src/models/group.js
+++ b/website/src/models/group.js
@@ -127,7 +127,7 @@ schema.post('remove', function postRemoveGroup (group) {
   firebase.deleteGroup(group._id);
 });
 
-schema.methods.toJSON = function groupToJSON () {
+/*schema.methods.toJSON = function groupToJSON () {
   let doc = this.toObject();
   // removeDuplicates(doc);
   doc._isMember = this._isMember; // TODO ?
@@ -143,7 +143,7 @@ schema.methods.toJSON = function groupToJSON () {
   this.challengeCount = _.size(this.challenges);
 
   return doc;
-};
+};*/
 
 // TODO move to its own model
 export function chatDefaults (msg, user) {
diff --git a/website/src/models/user.js b/website/src/models/user.js
index 26b38b31d3..40a9fbcaa0 100644
--- a/website/src/models/user.js
+++ b/website/src/models/user.js
@@ -479,7 +479,7 @@ schema.plugin(baseModel, {
   // TODO revisit a lot of things are missing
   noSet: ['_id', 'apiToken', 'auth.blocked', 'auth.timestamps', 'lastCron', 'auth.local.hashed_password', 'auth.local.salt', 'tasksOrder', 'tags', 'stats', 'challenges', 'guilds', 'party._id', 'party.quest', 'invitations'],
   private: ['auth.local.hashed_password', 'auth.local.salt'],
-  toJSONTransform: function toJSON (doc) {
+  toJSONTransform: function userToJSON (doc) {
     // FIXME? Is this a reference to `doc.filters` or just disabled code? Remove?
     doc.filters = {};
     doc._tmp = this._tmp; // be sure to send down drop notifs