Reports and moderation

Anyone who can see something on the platform can report it to the site's administrators. They review reports in Site administration → Reports and decide what happens. The design and the law behind it are in #115.

Reporting

Report appears on:

A report says what is wrong, from a fixed list:

• child sexual abuse or exploitation;
• other illegal content;
• sexually explicit content;
• graphic violence or gore;
• promotes suicide or self-harm;
• harassment, threats or private information;
• spam or misleading;
• copyright infringement;
• something else.

It can also add up to 2,000 characters of details.

• Who can report: signed-out readers can report. They answer the site's human-verification challenge first, if one is configured (docs/administration.md).
• Rate limits: reporting is limited to ten reports a minute per account, or per address when signed out.
• Reporting again: a signed-in reader who reports the same thing again replaces their earlier report.
• What can't be reported: your own things (change or delete them instead), and things you can't see.
• Anonymity: the owner is never told who reported.

Reviewing

Reports of the same thing gather in one case. An event's report (a moment's or a duration's) belongs to its timeline's case and says which event it names.

The queue has three views:

Each case shows:

• what was reported, with a link (a comment's text is quoted);
• its owner;
• the latest twenty reports: their categories, details, who reported them (or "signed out"), and the event named.

Decisions use the same confirmation as other administration changes: the current password (or, for an account without one, a sign-in within the last five minutes) and a fresh authenticator or recovery code when two-factor authentication is on. Each decision is recorded in oc_admin_audit (action reports).

Dismiss

No rule was broken; the case closes. The reason is kept as a note on the record and isn't sent to anyone. Reporters are told nothing was changed. The owner isn't told.

Restrict

Requires a reason, which is sent to the owner as the statement of reasons. What it does depends on the kind of thing:

New reports about a restricted thing join its case rather than opening another. While a restriction is in force, its owner is not established: browsing leaves out their public timelines, and their stars count for nothing.

Label

For a timeline only: when what was reported is allowed but should carry a warning (educational nudity, a war's photographs), label it instead of restricting it. Choose what it contains (nudity, graphic violence, disturbing content) and give a reason, which is sent to the owner. Its owner cannot remove these labels; they show under Sharing & settings as added by moderators. What labels do is described under sensitive-content labels.

Reviews and lifting

The owner can ask once for a review: from Account → Moderation decisions, or the link in the timeline's notice. A suspended account can't sign in, so its email asks it to contact the operator instead. The request appears under Awaiting a decision, where the administrator either:

• keeps the restriction (or the labels), or
• lifts the restriction (or removes the labels).

A restriction or labels can also be lifted at any time from Restricted. Lifting restores what the decision changed: a timeline's earlier visibility, a suspended account, or the labels moderators added (its owner's own labels stay).

Sensitive-content labels

Educational, historical, medical, artistic and news depictions of nudity, violence and disturbing events are allowed when labelled; pornography and gore for its own sake are not (#115). Labels are nudity, graphic violence and disturbing content:

• A timeline: its owner sets them under Sharing & settings → Sensitive content; moderators add them from a report (Label).
• An event (a moment or a duration): whoever can edit it sets them in its details, under Sensitive content. They are kept in its metadata (content_labels), so they travel with .ochx and .och files.

For readers who are not its owner or writers (adults can turn the warnings off under Account → Sensitive content; accounts that may be under 18 cannot, see ages):

A labelled timeline is also:

• never featured, and left out of browsing by readers who aren't signed in or may be under 18 (search, links and profiles still find it, behind its warning);
• shown in timeline lists with a Sensitive badge;
• previewed in links as its title and labels alone, with no moment strip or excerpt, and no oEmbed thumbnail (sharing).

Who is told what

Emails go only to confirmed addresses, and only when email is configured (RESEND_API_KEY, AUTH_EMAIL_FROM):

Signed-out reporters aren't told anything.

Ages

Accounts are for people 13 and older (#115). Sign-up asks for a year of birth: with a password, when registering; with Google, GitHub or Facebook, when confirming an email address, before the new account can sign in. The age is counted from the end of the year of birth, so someone turning 13 this year is refused until next year.

Only the year is stored (oc_users.birth_year). It is self-declared: not age verification, which the content policy is designed not to need. The sign-up form doesn't say what age is required, and the refusal doesn't either, as the FTC's COPPA guidance asks of a neutral age screen; a refused browser is remembered by a hash of its sign-in token in oc_age_refusals for a day (#166).

Child sexual abuse material

The operator's procedure (see also legal/LAUNCH.md and legal/RISK-ASSESSMENT.md):

1. Restrict it at once. Restricting keeps the data while nobody else can see it. Suspend the account too: report the account and restrict it, or use the Users view.
2. Report it. In the United States, a provider who learns of apparent child sexual abuse material must report it to NCMEC's CyberTipline (18 U.S.C. 2258A). Register with the CyberTipline before launch. Elsewhere, report to the national hotline or police as local law requires.
3. Preserve it for one year (the REPORT Act), or as law enforcement directs. Leave the restricted timeline and its history in place: don't export, copy, download or forward the material, even internally or to "check" it. The database, its backups and the moderation records (oc_moderation_cases, oc_reports, oc_admin_audit) are the preserved copy; keep backups for at least the preservation period.
4. Delete the timeline only after the preservation period, or as law enforcement directs (Site administration → Timelines → Delete).

Other illegal content follows the same steps, with whatever reporting and preservation its law requires; a legal hold works the same way.

Data

Cases name their targets as text, so a case outlives a deleted timeline as a record of what was decided.