Reporting content & the moderation queue

Bommel is a friendly, public place — and keeping it that way is a team effort. This guide covers two things: how anyone can report a public bookmark that breaks the rules, and how admins review those reports in the app.

The rules, in one line

No sexual content, nothing involving minors, no graphic violence, no hate, no illegal goods, and no malware or scam links. Ever. Public bookmarks that break these are removed, and the worst categories are reported to the proper authorities.

This applies to private bookmarks too. Bommel is not a place to build a private collection of prohibited material, so the check runs when you save, before visibility is even considered — a private bookmark containing this content is refused exactly like a public one.

How to report something (anyone signed in)

If you come across a public bookmark that shouldn't be here:

1. Open the bookmark's page, or flip its card to the back.
2. Click Report (the little flag).
3. Pick the reason that fits best — for example "Sexual or pornographic content" or "Malware, phishing, or a scam."
4. Optionally add a sentence about what you saw, then click Submit report.

That's all you have to do. Thank you — reports genuinely keep everyone safe.

What happens right after you report

• Serious reports hide the content immediately. For the most harmful categories (anything sexual, involving minors, violent, hateful, illegal, or malware), the bookmark is taken out of public view the moment you report it, before any human even looks. It stays hidden until an admin reviews it.
• Other reports queue for review. Categories like spam are recorded and sent to the admin queue without auto-hiding, so honest posts aren't taken down by mistake.
• You can only report each item once — no need to click again; we've got it.

We accept that hiding-first will occasionally hide something harmless. That's a deliberate trade: when it comes to the worst content, we'd rather be safe and let an admin restore a false alarm than leave something harmful up for even a minute.

Your own Bommels: My Pending Bommels

Public and live aren't quite the same thing. A Bommel is public the moment you say so, but it stays out of the directory until a safety check clears it — usually a matter of seconds. My Pending Bommels in the menu shows you every one that isn't live yet, and why.

You'll see one of four states:

Two buttons are always yours:

• Keep private takes a Bommel out of the public directory entirely. It stays in your library.
• Check again now re-runs the check instead of waiting for the next scheduled sweep.

Why there's no "approve my own" button

Because that would make the whole safety system pointless. If the person who saved something could clear its own review, anyone could save prohibited content, wait to be held, and approve themselves — every check behind it would be a speed bump rather than a rule. So approving is a reviewer's decision, never the saver's, and this is enforced on the server and in the database rules, not just hidden in the interface.

Editing a Bommel that's already live sends it back through review, and it reappears on this page while that happens. That's expected: the approval applied to the words that were checked, not to whatever replaces them.

For admins: the moderation dashboard

If your account is on the admin list, you get an in-app dashboard — no code or API tools needed.

Getting there

Open Settings → Moderation → Open moderation dashboard, or go straight to `/admin/moderation`. Only admins can see it; everyone else gets a "not found" page.

Admins also get Approve and Reject directly on My Pending Bommels, which is the quicker path when the thing you want to clear is your own. It's the same decision, the same audit trail, and the same server-side admin check — the dashboard just shows you everybody's queue rather than only yours.

What you'll see

A list of everything that needs attention:

• Pending — new or edited public bookmarks waiting for a first approval.
• Flagged — items hidden by a report or an automatic safety signal.
• Reported — items with open user reports (these rise to the top, newest concerns first).

Each row shows the title, who posted it (@handle), the destination link, quick buttons to open the live page, the content revision number, and any reason tags (from reports or the automatic checkers). Reason tags are short codes only — never the actual offending content.

The three decisions

• Approve ✅ — the content is fine. It becomes publicly visible, and (if enabled) ad-eligible. Approving pins the current revision: if the owner later edits it, it returns to the queue for a fresh look.
• Flag 🚩 — hide it for now, pending more information. Use this when you're unsure and want to come back to it.
• Reject ⛔ — it breaks the rules. It's hidden from the public and the decision is recorded for enforcement.

Every decision is written to a private, tamper-resistant audit trail (who decided what, when, and the reason code) so there's always an accountable record. Acting on an item also clears its open reports, so it leaves your queue.

A good daily rhythm

1. Open the dashboard once a day (more if you're growing fast).
2. Clear anything Reported first — those are your community's live concerns.
3. Work through Pending so new creators aren't kept waiting.
4. When in doubt, Flag and take a second look later rather than approving too quickly.

How this fits with the automatic pipeline

Reviewing every submission by hand stops working somewhere in the first few hundred users, so the pipeline is designed to decide most things on its own and hand you only what it genuinely cannot call. See Set up content-safety scanning for turning it on.

Four checks run over each submission. Google Natural Language reads the text, Vision inspects the cover image, Web Risk checks the link for malware and phishing, and a Gemini classifier reads the destination page itself and scores it for child-safety, sexual, violent, illegal, and hateful content. That last one matters more than it sounds: every other check is blind to what a link actually points at, so without it a pornographic site saved under the title "Interesting article" looks perfectly clean.

From those signals the pipeline does one of three things. A confident violation is rejected outright and the account takes a strike. An uncertain signal is flagged and lands in your dashboard. A clean result across all four checks is approved automatically and goes live.

That third outcome only happens when two conditions hold. Auto-approval must be switched on (MODERATION_AUTO_APPROVE), and the checks that matter must have genuinely run. A scanner that is unconfigured or times out, or a classifier that admits it could not read the page, counts as unchecked rather than fine — and unchecked content goes to you instead of to the world. This is why the queue never silently empties when something is misconfigured; it fills up instead.

Approval is pinned to the exact revision that was checked. Editing a bookmark bumps the revision and sends the new text back through the pipeline, so approval can never be inherited by content nobody looked at.

Start in shadow mode

Turn scanning on while leaving auto-approval off. Every submission gets a full verdict recorded on it, but you still make the call. Spend a week comparing the pipeline's verdicts with your own decisions on the same items, and switch auto-approval on once you're satisfied it agrees with you. Turning it off again is the kill switch: nothing new goes public unreviewed, and already-approved content is unaffected.

Zero tolerance for the worst content

Anything involving the sexual exploitation of minors is in a category of its own. It is refused when you try to save it — public or private — rejected by the database itself if a modified app tries to store it anyway, blocked at publish, and scored by the classifier at a threshold far below every other category.

One warning, then permanent closure. The first detection refuses the content and issues a single, explicit final warning. The second permanently closes the account, with no appeal. The warning exists because detection is automated and automation is occasionally wrong about a researcher, a journalist, or a parent — and a permanent ban on a first machine-made signal is not something a person can recover from. It is not leniency about the content itself: the material is refused every single time, warning or not.

Every detection, warned or banned, writes a record to the incident ledger holding the account, the reason codes, and the snapshot id — never the content. That record exists because reporting is a legal obligation, and software cannot discharge it on the operator's behalf.

The operator's reporting duty (US)

Bommel is operated from the United States, so 18 U.S.C. § 2258A applies. In plain terms: the platform is not required to go looking for this material, but the moment it actually knows about an apparent violation, it must report it to the NCMEC CyberTipline as soon as reasonably possible. Reports go to NCMEC, not directly to the FBI — NCMEC is the congressionally designated clearinghouse and forwards to the appropriate law-enforcement agency itself. The report and its contents must then be preserved for 90 days.

Two things the operator must not do: download, copy, forward, or otherwise move the suspected material while "gathering evidence" — that creates a new offence — and delete it before reporting, which destroys what investigators need. Leave it where the system put it, report, and follow NCMEC's instructions.

Why users are never told about a referral

The refusal message states the policy and the consequence, and stops there. Telling someone a report has been filed is what investigators call tipping off: it prompts the destruction of evidence and can obstruct a live case. And when the detection is wrong, it would mean putting an accusation of a serious crime in writing to an innocent person. Silence on this point is deliberate.