extant2000/flamenet-relay
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

A page that says how to report somebody, and what we cannot do about it #142

Merged
paulhitt merged 1 commits from feat/safety-contact-page into main 2026-09-07 18:11:43 +00:00
Conversation 3 Commits 1 Files Changed 4
+149
4 changed files with 149 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Resources/Views/layout.leaf
+1
View File
@@ -91,6 +91,7 @@
<h4>Project</h4>
<a href="/about">About</a>
<a href="/community">Community</a>
<a href="/safety">Getting help</a>
<a href="/roadmap">Roadmap</a>
<!-- Beside Roadmap on purpose: one is what is coming, the other is
what actually landed, and the pair is more honest than either
Resources/Views/safety.leaf
+112
View File
@@ -0,0 +1,112 @@
#extend("layout"):
#export("content"):
<article class="band doc">
<div class="wrap wrap-narrow">
<h1>Getting help, and reporting someone</h1>
<p class="lede">
If somebody is using Flamenet Messenger to harass, threaten or hurt you, we want to
know. This page says how to tell us, what happens next, and — because it matters more
than the promise — what we genuinely cannot do.
</p>
<h2>Reporting from inside the app</h2>
<p>
This is the route to use if you can. Open the message or the story, choose
<strong>Report</strong>, and say briefly what is wrong with it. On a person rather
than a single message, open the conversation and choose <strong>Block</strong> —
that stops them reaching you at all, and it works whether or not you report them.
</p>
<p>
A report goes to the people who run this server. It does not go to the person you
reported, and they are not told you reported them.
</p>
<h2>Reporting by email</h2>
<p>
If the app will not open, or you would rather write to a person, use
<a href="mailto:abuse@flamenetmessenger.com">abuse@flamenetmessenger.com</a>. A
real mailbox, read by the people who run this relay.
</p>
<p>
It helps to include the handle of the person involved, roughly when it happened, and
what you would like done. You do not need to include the messages themselves — see
the next section for why we usually cannot read them anyway.
</p>
<h2>What happens next</h2>
<p>
We read every report. Depending on what we find, we can suspend an account, remove a
stored attachment, or take no action and say so. We aim to reply within a few working
days, and we will tell you what we decided rather than leaving you wondering.
</p>
<p>
⚠️ This relay is run by a small company, not a moderation department. If you need
somebody available at three in the morning, we are honestly not it, and you should
know that before you rely on us.
</p>
<h2>What we cannot do, and why</h2>
<p>
Messages are sealed on the sending phone and opened on the receiving one. The server
carries them without being able to read them, which is the point of the product —
and it means <strong>we cannot look at a conversation to judge a report</strong>. We
are not withholding it. We do not have it.
</p>
<p>
So a report is most useful when it tells us what happened in your own words, and when
it includes anything you can show us — a screenshot, or text you have copied out. We
act on the account and the pattern, not on evidence we can decrypt, because there is
none.
</p>
<p>
The same is true of <a href="/metadata">what the relay stores</a>, which is written
out in full there and is deliberately not much.
</p>
<h2>If you are in danger</h2>
<p>
If someone has threatened you with harm, or you are afraid for your safety, please
contact your local emergency services first. We will cooperate with a lawful request
from law enforcement, and what we are able to hand over is limited to what
<a href="/metadata">we actually keep</a> — which does not include the contents of
anyone's messages.
</p>
<h2>Children</h2>
<p>
Flamenet Messenger is not intended for children. Material that sexually exploits a
child is the one thing we will act on immediately and report onward as the law
requires. Send it to
<a href="mailto:abuse@flamenetmessenger.com">abuse@flamenetmessenger.com</a> with as
much detail as you can, and mark it urgent in the subject line.
</p>
<h2>Other ways to reach us</h2>
<ul>
<li><a href="mailto:abuse@flamenetmessenger.com">abuse@flamenetmessenger.com</a> —
harassment, threats, or anything about another person's conduct.</li>
<li><a href="mailto:security@flamenetmessenger.com">security@flamenetmessenger.com</a> —
a vulnerability in the software. See <a href="/security">Security</a>.</li>
<li><a href="mailto:privacy@flamenetmessenger.com">privacy@flamenetmessenger.com</a> —
a question about your own data, or a request to delete it.</li>
<li><a href="mailto:legal@flamenetmessenger.com">legal@flamenetmessenger.com</a> —
legal process and law-enforcement requests.</li>
<li><a href="/community">Community</a> — bugs, the protocol, and running your own relay.</li>
</ul>
<h2>Who you are writing to</h2>
<p>
Extant 2000 LLC<br>
7051 Brookfield Plz, PO Box 41<br>
Springfield VA 22150<br>
United States
</p>
<p>
If you run your own relay, this page describes the one operated at this domain. Your
own server is yours to answer for, and the people using it should be told how to
reach <em>you</em>.
</p>
</div>
</article>
#endexport
#endextend
Sources/FlamenetRelay/Entrypoint.swift
+3
View File
@@ -564,6 +564,9 @@ func register(routes r: Routes, on app: Application) throws {
"What Flamenet Messenger is, why it exists, and what it does not claim to be."),
("community", "Community — Flamenet Messenger",
"How to review the protocol, report a bug, report a vulnerability, or run a relay."),
("safety", "Getting help — Flamenet Messenger",
"How to report harassment or abuse, what happens next, and what a server that "
+ "cannot read your messages is unable to do about it."),
("security", "Security — Flamenet Messenger",
"How to report a vulnerability, and what this project does and does not defend against."),
("spec", "Specification — Flamenet Messenger",
Tests/FlamenetRelayTests/PublicPagesTests.swift
+33
View File
@@ -74,6 +74,39 @@ final class PublicPagesTests: XCTestCase {
/// The navigation is on every page, so one dead entry there is a dead link
/// on the whole site — and it is exactly what gets broken while moving
/// sections between pages.
/// 🔴 **Apple's Guideline 1.2 requires a way to reach us, published.**
///
/// An app that carries user-generated content has to offer a route to
/// report it and a contact its users can actually use, and this page is
/// that contact — it is also the Support URL on the App Store listing. A
/// tidy-up that drops the address, or a rename that leaves the footer
/// pointing at nothing, is a rejected submission and a person with nowhere
/// to write.
///
/// ⚠️ The address is asserted by NAME, not merely "some mailto exists".
/// `abuse@flamenetmessenger.com` is the alias that was tested for delivery;
/// a plausible-looking address nobody reads is worse than none, because it
/// consumes the one attempt somebody makes.
func testTheSafetyPageCarriesAReachableContact() throws {
let page = try String(contentsOf: views.appendingPathComponent("safety.leaf"),
encoding: .utf8)
XCTAssertTrue(page.contains("mailto:abuse@flamenetmessenger.com"),
"the safety page must name the reporting address")
XCTAssertTrue(page.contains("Report"),
"it must say how to report from inside the app")
XCTAssertTrue(page.contains("Block"),
"it must say how to block somebody")
// ⚠️ The honest half. A page that promises moderation of content the
// server cannot read is a claim this project must not make.
XCTAssertTrue(page.contains("cannot read"),
"it must say what a server that cannot read messages cannot do")
let layout = try String(contentsOf: views.appendingPathComponent("layout.leaf"),
encoding: .utf8)
XCTAssertTrue(layout.contains("href=\"/safety\""),
"the page has to be reachable from every page, not only by URL")
}
func testTheLayoutLinksOnlyToPagesThatExist() throws {
let slugs = try registeredSlugs()
let layout = try String(contentsOf: views.appendingPathComponent("layout.leaf"),