Thnkrr Moderation — The One Plan

7 October 2026. This is the single current answer on moderation: what we use, what we keep, how it holds up when 10,000 students arrive on day one, what's left, who does what, and what the safety team can do. It replaces the earlier summaries (the decision brief, "How we check writing", and the 29 September status page). Those stay in the code repository as background, but if they disagree with this page, this page is right.

1. What we use — in one table

Every post, comment, message and profile is checked before anyone else sees it. The writer sees it straight away, marked "being checked". This is LinkedIn's approach, made stricter for minors: LinkedIn shows most posts first and checks again later.

No OpenAI agreement is needed. The AI is OpenAI's free model, but Amazon sells and runs it. OpenAI isn't a party to our contract and never receives students' writing; Amazon may share only usage information that "does not include Your Content" (Amazon Service Terms §50.12.5). The written promise that students' writing is never used to train AI comes from Amazon, the only company that touches it. That promise is already in force, with nothing to sign.

What launch day looks like: steps 1, 2 (our own matching), 3, 6 and 7 work, once the Amazon account is connected and the AI's first real checks pass. Until then a person checks every post, which is safe but slow. Steps 4 and 5 come later.

2. Speed: what happens when 10,000 students post at once

How long one post takes

10,000 text posts in the same minute

Amazon lets us run up to 10,000 AI checks a minute in its US East location. How fast we clear a burst depends on how many we run at once:

What's built for this:

• Up to 300 checks run at once, never more than 150 started a second, safely under Amazon's limit.
• Messages and possible self-harm go first.
• One person can post at most 10 times a minute, so nobody can flood the queue.
• While the queue is busy, students see "Checking is busy right now — about N min" instead of a silent wait.
• Anything not checked within a few minutes goes to a person. Nothing is ever posted unchecked.

The real speed of Amazon's AI is measured in the first week on the real account (§6).

How LinkedIn does it:

• Small, fast checks decide most posts in under a third of a second.
• Heavier checks run in the background.
• People see the riskiest items first, sorted by a score.
• A risky post is shown only to its writer until it's cleared.

We're doing the same, except a student's post waits for the AI check rather than going out first.

Photos at speed

Amazon's picture check handles 50 photos a second in US East, which is 3,000 a minute. Each photo gets two checks: one for nudity and violence, one for text in the picture. So 1,000 photos posted at once are all pre-screened in about 40 seconds, and reviewers open the list with the riskiest photos already on top.

The real bottleneck: people and video

AI checks scale. People and video processing don't.

• Photos. If 1,000 students post a photo on day one, at about 20 seconds per review, that's about 5½ hours of reviewing. With five reviewers, a photo post could wait about an hour.
• Videos. Our server prepares one video at a time. A hundred one-minute videos would take 3–5 hours to get through.

The options are in Decisions for you, section 5.

3. Why we don't just use what other companies built

LinkedIn and Upwork build their own and publish none of it. Here's what is available, and what we do with each:

Is Discord's Osprey better than our rules? No, because it isn't a set of rules at all. It's the empty machine Discord runs its rules in; the rules themselves stay private. An empty machine has no accuracy of its own. Discord's published numbers (about 85% automated, but 4 in 10 automated actions wrong) don't mention Osprey, and that error rate is exactly why our unsure cases go to a person. We are borrowing four of its ideas, inside our own database:

• a word list our team can edit without a release;
• labels on an account that expire (for example "tried to share contact details");
• a plain reason on every decision;
• a "watch-only" mode that tries a new rule silently before it acts.

We'll look at Osprey again only if a full-time safety analyst needs to write new rules every week, and we face coordinated abuse across many accounts.

Why "test first" and not "plug in": an outside tool can wrongly block innocent students or miss real harm in our kind of writing: Indian English, Hinglish, school slang. We run each one on our own test examples first. That takes days, not months.

4. Everything left — nothing hidden

Built and tested

Everything here is finished and tested. It's waiting to be added to the app's main version, which happens before the first deploy.

• The legal deadlines, matching the law:
  • 24 hours to acknowledge any complaint
  • 36 hours for unlawful content
  • 2 hours for intimate images and for impersonation
  • 3 hours for court and government orders
  • 7 days for everything else
• The evidence hold. Anything tied to a safety case is kept a year from the moment the case opens; no reviewer can delete it.
• Five reviewers on one list, each with their own login. If two click at once, the second sees "already done by Vidhi". A "Who did what" log records every action.
• Video: takedowns delete every copy of a video, a removed video can't be uploaded again, and videos are processed in their own line.
• The Amazon AI connection, with a tested backup AI and a daily check that keeps our access alive. It has only run against a stand-in for Amazon so far; the first real check is on Adarsh's list (§6).
• Checking at Amazon's full speed (section 2).
• Student–mentor messaging is off until the grooming check is live. Mentors and students see a plain notice saying so; nobody sees an error.
• A removed photo or video disappears within minutes. Amazon's delivery network is told to drop its copies at every takedown.
• The live server can never send writing to Anthropic. It refuses to start if asked to.
• Phone numbers written in words are caught: "nine eight seven six…", "double five", and some Hindi.
• Reviewers see why something was held, in plain words, plus labels on the writer that expire on their own, such as "Tried to share contact details ×2".
• The team can edit the watch-word list without a new release. Every change is checked and logged, and new words start in watch-only mode: they record what they would have caught before they act.
• Every page links to the complaint and intimate-image forms.
• The older moderation pages are marked as replaced by this plan.
• Four staff roles (Moderator, Child Safety Lead, Grievance Officer, Safety Admin), each seeing only its own work, with backups and deadline emails by role (section 7).
• The safety team's tools (section 8). The team sees the real post, photo or profile an item is about, the conversation around a held message, and the person behind it. They can warn, remove, pause, limit, suspend, ban or hide, and hand child-safety matters to the Child Safety Lead. The person on the other side is told in plain words, except in child-safety cases.

Both are in the test version of Thnkrr, with everything above.

Not built yet

Built, but only provable on the real Amazon account: the AI's first real check, the delivery network dropping removed photos, the secure database connection, and the server's access to file storage. All four are on Adarsh's checklist (§6).

Next for the hats (section 7): phone or text alerts once there's an on-call rota, and a narrower hat for an outside review vendor if WebPurify is added.

Deferred on purpose

Stand-ins to switch off before real students

• The laptop stand-in that approves everything (already forced off on the live server)
• The made-up staff in each role (Rosa, Kate, Arjun and others), until you name the real people and their backups
• The team alert inbox: alerts now go to each role's people, and this inbox only catches a role with nobody in it, so it still needs a real address
• Mentor messaging: off by default; it's switched on only once the grooming check is live (decision 6 below)
• The support email address
• Test accounts and test school contacts
• The draft Terms and Privacy pages

5. Decisions for you

The technical choices are ours. Decided, for your information:

• every AI check runs on Amazon (Bedrock) in Amazon's US East location, next to our first schools;
• no OpenAI agreement is needed (section 1);
• if Amazon ever retires the AI, a tested backup takes over with a setting change (see the one-pager).

These are yours:

1. Does a person still see every photo and video? That's what we've promised families and built. You said "AI screens, a supplier for later". The two fit together like this:
   • (a) Keep the promise and cover launch-day surges with WebPurify's reviewers (about 2 cents a photo, about 5 minutes). We recommend this for the pilot.
   • (b) Let the AI approve photos it's very sure about. Faster, but a promise to families changes.
2. Video for launch week. Lower the limit from 15 minutes to 3? The longest video then takes a fifth of the processing and reviewing time, and it's a setting we can raise later.
3. Names:
   • Vidhi is Child Safety Lead and handles everything a review vendor escalates. Before her first case: a background check (CMU verifies her details, or we use Checkr) and free child-safety training. Is she also the person who files NCMEC reports?
   • We need a second safety handler.
   • We need India's Grievance Officer, whose name goes on the site by law.
   • We need a Safety Admin (you or Adarsh), who sees every list and is told when anything is late.
   • Each hat needs a backup person (section 7). Until the names come, the demo uses stand-ins.
4. Send and sign:
   • NCMEC registration
   • the five free child-abuse list applications
   • the Thorn and Hive emails
   • the WebPurify quote, with our conditions: a signed data agreement; nothing kept after each decision; no sharing or training on our images (their standard terms allow both); no face analysis; where their reviewers work; their child-abuse matching; and a price for checking held text
5. The Community Guidelines. You referred to the published guidelines, but there is no page on the site. Send us the text, or approve us drafting it with the deadlines above.
6. Mentor messaging stays off until the grooming check is live. Confirm.
7. Our lawyer: the Terms, the Privacy Notice, and the deadlines and at-risk procedure above.
8. Rules for suspending and banning (section 8). Built as below; each is a setting, easy to change. Confirm or change:
   • Who may ban an account: the Child Safety Lead and the Grievance Officer. Moderators can't ban.
   • How long a moderator can suspend someone: up to 7 days. The other two hats can suspend for up to a year.
   • How a member appeals: the email they get points to the public complaint form ("A problem with an account"), and a Grievance Officer answers it.
   • Who is told: the member is always emailed the reason, unless it's about child safety or an intimate image. Then they're never told, because telling them could warn an abuser.

6. Adarsh's checklist: connect it, then smoke-test it for real

Nothing below has ever run against the real service. Each one needs a real connection and a short smoke test before the pilot. Tick each one when it has passed.

Amazon account (do first)

• Turn on Bedrock in US East (us-east-1). Set "keep nothing" (data_retention_mode: none) and lock it for the whole account.
• Leave request logging off. Turn on the AI-services opt-out before any photo is checked.
• Look up our real limits for the AI model in Service Quotas, and the picture check's limit (50 a second by default in US East).
• Set up an alert for Amazon's retirement notices, and correct the account's contact details.
• Confirm the credit grant covers Bedrock, Rekognition, EC2 and RDS, and note its end date.

AI check (once the connection is written)

• Send one real check from the server and get an answer.
• Measure seconds per check every day for a week.
• Run the test set through the chosen model, its bigger version, and the backup (Qwen3).
• Ramp test: 50, then 150, then 300 checks at once, watching for Amazon's "slow down" errors.
• Turn off the AI on purpose and confirm posts wait for a person, never go live.
• Write "call me nine eight seven six five four three two one zero" and confirm it's blocked.

Pictures and video

• Upload, approve and view a photo through real Amazon storage and delivery.
• Take that photo down and confirm its link stops working within minutes (the delivery network drops its copy).
• Install ffmpeg and Whisper on the server. Time a 1-minute and a 15-minute video.
• Run Amazon's picture check on a test photo set.

Email

• Verify our sending domain in Amazon's email service (SES), then send real mail to the team alert inbox, a school care contact and a guardian.
• File a test intimate-image request and a test court order, and confirm the alert email arrives.

People and legal

• Two reviewers on two laptops click the same item at once: one decision, and a clear "already done by" message.
• Open a mentor's profile as a student and confirm the "messages with mentors are switched off" notice shows instead of the request form.
• Sign out and confirm the complaint and intimate-image links are on the page.
• Confirm only the Child Safety Lead (Vidhi and her backup) can open a safety case.
• Practise one report on NCMEC's test site once registered.
• Give every person their hats on the live server (pnpm staff:role), then check each sees only their own lists, and that the Safety Admin sees all of them but can't act.
• File a test complaint and a test order, and check the alert emails reach the right hat on arrival, the backups half-way, and the Safety Admin when late.

The team's tools (section 8), with test accounts only

• Suspend a test student for 1 day: they're signed out at once, their posts vanish for a classmate, and the "your account is suspended" email arrives with the right link to the complaint form.
• Hide a test profile from a test complaint: a classmate gets "This profile isn't available", and the complaint shows "Done from this item".
• Log a test court order with a PDF attached, open the PDF, then remove the test post it names: the order closes itself.
• As the Safety Admin, open the same screens: everything is visible, and there are no action buttons.
• Lift the suspension and show the profile again, and check everything comes back.
• Warn a test student: the notification and the email arrive.
• As a moderator, send a test message to the Child Safety Lead: the test sender sees "We've limited some activity on your account", can't post or message, and a moderator can't lift it.
• Remove a test post: it disappears for a classmate with no placeholder, and the author gets "We removed your post because …".

Load (last)

• Simulate 10,000 students posting in one minute, using the built load test with the real AI. Record when the last post clears, check that "checking is busy" appears, and see how the server and database cope.

7. Who does what: staff hats

Decided and built (7 October), in the test version. Nobody on the team handles every kind of moderation at once, so each person wears one or more hats. Their screen shows only the lists their hats cover, so anyone looking at it knows what they're meant to do. This is how other platforms work too: specialist teams, child-abuse material seen only by trained people, and named officers for complaints and legal orders.

How it works:

• One login per person. Someone can wear more than one hat. Two or more people can wear the same hat: they share one list and one "who did what" for that hat.

• The Safety Admin sees the combined list of every hat, plus everyone's "who did what", but can't make decisions. The person wearing the hat acts.

• Only the founder's deadlines are used: 24 hours, 36 hours, 2 hours, 48 hours and 3 hours, which cover both US and Indian law. Two internal targets stay for our own team. They're marked "internal target", and only that hat and the Safety Admin see them.

• Email alerts, by hat:

  When	Who's emailed
  An item arrives	The people wearing that hat
  Half its time has gone and nobody has acted	The same people again, plus the hat's backups
  It's late	The Safety Admins

  If nobody wears a hat yet, the team inbox gets the email. Each alert is sent once. Email only for now; phone or text can come later, with an on-call rota.

• Placeholders until the founder names people. In the test version every hat has two people, so the shared screens can be tried: Rosa and Victor are Safety Admins, Kate and Nadia are Child Safety Leads, Arjun and Vikram are Grievance Officers, Tom and Lena are moderators, and Tom is also the backup for the other two hats. Log in as each to see their screen.

• Tested: a check of who sees what and who can do what, for every hat, plus tests that alerts reach the right people at the right time, exactly once.

• Walked through in a browser (7 October), on a fresh copy of the test data:

  • a parent filed an intimate-image removal and an impersonation complaint through the public forms; both status pages showed the deadline;
  • within a minute, emails reached the right people: the removal went to the Child Safety Leads, the complaint to the Grievance Officers; a half-way email also went to the backup; a late report went to the Safety Admins;
  • each person's screen showed only their lists, a "My work" line with the next deadline, and countdowns ("2-hour legal clock: 1h 57m left"; "Internal target: within 4 hours");
  • a Grievance Officer who tried to open child-safety lists directly was refused, and so was a Safety Admin who tried to act; the Safety Admin's screen says "View only" and has no action buttons;
  • Kate closed a request and Nadia saw it, by name, in the shared "Who did what";
  • Arjun and Vikram pressed the same button on the same order at the same moment: it was done once, and Vikram saw "Already done by Arjun Mehta. Nothing was done twice."

What's left for the hats:

• The founder names the real people for each hat and its backup (section 5).
• Adarsh gives them their hats on the live server and smoke-tests the alerts (section 6).
• Later: phone or text alerts, and a narrower hat for an outside review vendor.

8. What the safety team can do, and what the person on the other side sees

Built and tested 7 October. Every item opens like a case, the way professional moderation tools (Meta's, Discord's, LinkedIn's) work: what came in, what it's about, who it's about, and buttons that carry the decision out. Every action is checked from both sides: the reviewer's screen, and the screen of the person it affects.

What the reviewer sees

• What came in, with its files. The Grievance Officer attaches the court order or police notice itself; a parent can attach screenshots or proof to a complaint. Only Grievance Officers and the Safety Admin can open them.
• The real thing, not a description. A Thnkrr link in a complaint, order or request shows the actual profile or post, with its photos and videos. A report shows the reported post, photos included. A held private message shows who it was sent to, their age, an "Under 18" flag, and the last 10 messages of the conversation. A held comment shows the post it was written under.
• Photos are blurred and in black and white until the reviewer clicks "Show clearly". This applies to case photos and to any photo the checks flagged as sexual, violent, self-harm or grooming. Every reveal is recorded.
• The person, on every card: age, school, standing (warned, paused, limited, suspended, banned, hidden), and their record. One click opens their member page with their full history. "Find a member" finds anyone, whatever their standing.

What the reviewer can do

The Safety Admin sees everything and acts on nothing; their screens say who can act, by name. Staff accounts can't be changed from a case.

The ladder is warn, then suspend, then ban, as on every large platform. Child safety skips the ladder: a moderator who sees grooming or a child at risk presses "Send to the Child Safety Lead". The item stays held, a child-safety case opens (the Child Safety Leads are emailed), and the person can't post, comment, message or send requests at all until the Child Safety Lead decides. Nothing already waiting from them can be approved, and only the Child Safety Lead can lift it.

Every action asks why, from a fixed list, and is recorded on the item it came from ("Done from this item: Banned Tyler Novak — Arjun Mehta") and in "Who did what". A court order closes itself when something it names is removed. Complaints are answered with ready-made replies in plain words.

What the person on the other side sees

Child safety is always silent. For anything about child safety or an intimate image, the person is never told the reason: no email, no notification reason, no reason at sign-in. Telling them could warn an abuser.

How it's tested

• Server tests: who can do what, by role; every action's effect; and what each person is or isn't told. The full server suite passes (666 tests).
• Browser tests: a permanent test checks a report, a suspension and a hand-over from both sides. The full browser suite passes (139 tests).
• A walk of every enforcement surface, from both sides, on fresh demo data: review-list approve and turn down, reports (warn, remove, dismiss, hand over), suspend and lift, hide, ban from a complaint and from a police notice, removing from a member page, an intimate-image request, the full limit and who can lift it, counsellor referrals, the Safety Admin's view, and every email. All 50 checks pass.
• The demo can be checked from either side. The login page has a "People in moderation cases" section with everyone the demo cases are about. Some start already actioned:
  • Kai is warned;
  • Ethan is suspended;
  • Andre is banned;
  • Luke is limited, with a held message waiting;
  • Marcus's comment was removed;
  • Olivia's and Jasmine's reports have outcomes.

What's left

• Your rules for who may ban, the 7-day cap for moderators, and appeals through the complaint form (section 5, item 8). Built this way; each is easy to change.
• A "your account standing" page. Today a person gets each warning or removal as a separate notification and email. A single page listing them all, as Instagram has, is a later step.
• Comments have no web link of their own, so a complaint can't point straight at one; the reviewer finds the person with "Find a member" and removes it from their page.
• School pages (thnkrr.com/school/…) don't preview yet; a complaint about one is read as text.
• Phone or text alerts and an on-call rota (section 7) are still email only.

Sources for every number: Amazon's Bedrock quotas, model and lifecycle pages, Rekognition limits, LinkedIn Engineering posts (2017–2024), the OpenAI gpt-oss-safeguard report, Amazon's Service Terms §50, and our own timing tests. All checked 5–6 October 2026. Details are in the code repository's moderation docs.