Moderation Policy

Status: v1, September 2026, adopted. Written alongside the backend so the Report button has something real behind it from the start. The response times, staffing trigger, appeals handling, law-enforcement stance and retention periods below are settled policy, not proposals.

One thing this document does deliberately: it describes the process we actually run today with one reviewer, rather than the process we would like to advertise. Where a protection does not yet exist, it says so.

Why this exists before launch

KeepLuna asks women to meet strangers in person. That is the product. It means a moderation process is not a compliance checkbox to add later; it is part of the core offering, and the scope document is explicit that a real review process must be live before the app opens to the public.

This document covers what gets someone removed, who decides, how fast, and how a person who thinks we got it wrong can say so.

What is not allowed

Grouped by how fast we act, not by how bad they sound.

Immediate removal, no warning

• Anyone under 18. KeepLuna is 18+. Accounts are removed on credible report, not on proof, because the cost of a wrong removal here is much lower than the cost of a wrong retention.
• Threats of violence, stalking, or intimidation, on or off the app.
• Sexual content sent without consent, including images.
• Hate speech targeting race, ethnicity, religion, disability, gender identity, sexual orientation, or immigration status. Transphobia is hate speech; there is no "just asking questions" carve-out.
• Impersonation of a real person, or a profile built from someone else's photos.
• Any report of assault or coercion at an in-person meetup. The account is suspended the moment such a report is filed, before any review.

Warning, then removal on repeat

• Persistent contact after being asked to stop.
• Commercial solicitation, promotion, recruiting, or sex work advertising.
• Misrepresenting age, location, or identity in a way short of impersonation.
• Aggressive or demeaning conduct that is not hate speech.

Not a violation

To be explicit, because over-moderation of queer people is a real and documented pattern and this app is disproportionately exposed to it:

• Being visibly queer, trans, butch, femme, or gender non-conforming.
• Discussing sex, sexuality, sobriety, mental health, or transition.
• Declining to meet, ending contact, or unsaving someone.
• Being reported by someone whose interest was not returned. A report is a signal, not a verdict. Reports filed immediately after a skip or unsave are weighted accordingly.

How enforcement works

1. A report is filed

Filing a report immediately blocks the reported member for the reporter. Nobody has to keep seeing someone while waiting on a decision. This is automatic (actions.report → actions.block).

The reasons offered map to a priority (src/actions.js): harassment, hate speech, unwanted sexual content, threats, under-18, and off-platform harm are urgent; fake profiles and solicitation are normal.

2. Automatic pause, if several people independently report

When three different members have open or upheld reports against the same account, it is automatically suspended pending review (moderation.autoSuspendIfNeeded, threshold AUTO_SUSPEND_DISTINCT_REPORTERS).

Deliberate limits on this:

• It pauses, never bans. Only a human bans.
• It counts distinct reporters, so one person filing repeatedly cannot trigger it.
• If every report is later dismissed, the pause lifts automatically and an audit row records the reinstatement. A wrong auto-pause does not quietly become permanent.

3. Human review

A person works the queue (GET /admin/reports), urgent first, oldest first within a priority. The reviewer sees the report, the reported profile, and how many total reports exist against that account.

Every report gets a human look within 24–48 hours.

That is the commitment for all reports, urgent and normal alike. Urgent ones are still worked first inside that window, but the promise is one number rather than two, because one number is what a single reviewer can actually keep.

We do not promise same-day review. A same-day promise would be broken the first time a report arrived on a Friday evening, and a moderation commitment that quietly fails is worse than a slower one that holds.

When a second reviewer gets hired

At current scale that reviewer is Rachel. Staffing is revisited when either of these is true, whichever comes first:

• reports sustain an average of 2–3 or more per week across a full month, or
• active users cross roughly 500.

Naming the trigger in advance is the point. The failure mode for a solo-run queue is not a sudden collapse; it is a slow slide where response times drift and the person running it is too close to it to notice.

4. The decision

Every decision writes an auditable row to moderation_actions: who acted, what they did, why. Outcomes: warn, suspend, ban, dismiss.

• Warn, recorded; the member is told what was wrong.
• Suspend, account hidden from discovery, sign-in blocked. Reversible.
• Ban, permanent. Reserved for the immediate-removal list and for repeats after a warning.
• Dismiss, no action. Recorded, so a pattern of bad-faith reporting is visible later.

Data is not deleted at the moment of a decision. A suspension is reversible, so a suspended account keeps everything. A ban starts the clock described under How long we keep things below: the account's data is held through the 90-day appeal window and then purged down to a hashed identifier.

Either way the member keeps the right to export their own data while it exists, and a deletion request is honoured immediately rather than waiting out the window.

Appeals

Any member who is suspended or banned can appeal by emailing gokeepapps@gmail.com. That address appears in the message shown to a locked-out account, since they cannot reach an in-app form.

There is currently no independent appeals process

Stated plainly, because members deserve to know what they are getting: KeepLuna has one reviewer. An appeal is read by the same team that made the original decision. It is a second look, not an independent one, and we are not going to call it independent when it isn't.

We commit, in writing, to building a genuinely independent appeals process, one where the person reviewing an appeal is not the person who made the original call, as soon as there is more than one reviewer. That is tied to the same staffing trigger above, and it is the first thing a second reviewer is for.

How an appeal is handled

• Target response: 5 business days.
• A granted appeal restores the account (moderation.reinstate) and records the reversal in moderation_actions, so a reversed decision is as auditable as the original one.
• Bans for under-18 accounts and for reports of assault are not appealable through this route.

Identity verification and failure

Verification is via Didit. A failed check does not remove an account. The member simply does not get the verified badge, keeps their data, and can retry.

This is deliberate. Document and face matching misreads trans and gender non-conforming people more often than anyone else, and auto-removing on a provider's failure signal would land hardest on exactly the members this app exists for.

Law enforcement

We respond to valid legal process only. A real subpoena, court order, or warrant gets a response. An informal request does not: an officer emailing to ask who someone is, a request with no legal instrument behind it. This matters more than usual for an app whose membership is itself sensitive information: being a KeepLuna member says something about a person that they may not have told anyone else.

Separately, and without waiting to be asked: we may proactively report a credible, imminent threat to someone's physical safety to law enforcement. That exception is deliberately narrow. "Credible" and "imminent" both have to be true: a specific, believable threat to a specific person, not a general worry and not something that reads badly out of context.

There is no proactive monitoring beyond that. We do not read member content looking for things to report. We do not scan messages, bios, or activity for anything, by hand or automatically. What reaches a reviewer is what a member chose to report.

How long we keep things

Data attached to a report

Kept through the review, plus a 90-day appeal buffer after resolution, then deleted. The buffer exists so an appeal can be assessed against the evidence that produced the decision. An appeals process that has already deleted the record it is meant to reconsider is theatre.

Removed and banned accounts

A ban does not purge the account on the spot. The data is held through the same 90-day appeal window, because an appeal cannot be assessed against a record that has already been destroyed, and is then deleted down to a hashed identifier.

That identifier is enough to recognise the same person attempting to sign up again, and not enough to reconstruct who they were. Everything else goes: name, photo, bio, interests, location, saves and skips.

This is the narrowest thing that still does the job. A banned account exists in our records as an opaque fingerprint, not as a person.

Everything else

Active accounts keep their data until the member deletes it. Deletion is available in-app and removes the profile outright; the two exceptions above are the only things that survive it, and the privacy policy says so in the same terms.

What is deliberately not built

Named so nobody assumes otherwise:

• No automated content scanning. No AI classifier decides who is removed.
• No shadowbanning. Enforcement is visible to the person it affects.
• No moderation of private plans. We do not read or police what members arrange between themselves.

Reviewing this policy

These decisions were made at a specific scale: one reviewer, pre-launch, no users yet. The staffing trigger above is the moment to re-read the whole document, not just the staffing line: response times, the auto-pause threshold, and the appeals commitment all assume a queue one person can hold in their head.

Two things worth a lawyer's eye before public launch, neither of which is an open product question: the retention periods against GDPR and CCPA obligations, and the law-enforcement section against the jurisdictions Keep Apps LLC operates in.