NavTrail — Content Moderation Policy

Last updated: 2026-09-21.

This document explains how user-generated content (UGC) in NavTrail is moderated. It exists to document our published moderation policy and to give users a clear picture of what they can expect. A copy is hosted publicly at https://navtrail.app/moderation (alongside the privacy policy).

If you have a question about a specific moderation decision or want to report content that the in-app flow doesn't cover, email contact@navtrail.app.

1. What is user-generated content in NavTrail?

The following feature areas accept content from users:

Feature	Free-text fields	Lifetime
Community POIs (camping, springs, viewpoints, refuges, tyre-repair shops)	name (≤ 80 chars), description (≤ 800 chars)	Permanent until reported / deleted by creator
Hazard reports (fallen trees, landslides, etc.)	description (≤ 280 chars, optional)	4 hours TTL, then auto-deleted
SOS alerts	description (≤ 280 chars, optional), contact_hint (≤ 80 chars, optional)	24 hours TTL, then auto-resolved
Convoy messages (Quick-Comms)	fixed presets, or free text (≤ 80 chars), sent only inside a convoy — a private group joined with a code given to you directly	Transient: shown briefly on the map, never stored on our servers
Convoy nicknames	nickname (≤ 8 chars, visible only to fellow convoy members)	48 hours after last activity
Photos	An optional photo on a point of interest you created (1 per point), and up to 2 photos on your own saved route. Optional caption (≤ 200 chars).	Until deleted by the person who added it, or hidden after reports
Published routes ("Public tracks")	route name (≤ 120 chars), description (≤ 800 chars, optional), a difficulty label, and the recorded route itself, exactly as recorded	Until unpublished by the creator, or hidden after reports
Travel-partner trips (the trips board)	title (≤ 80 chars), description (≤ 600 chars), the message of a request to join (≤ 300 chars), up to 3 photos, an optional vehicle profile (make and model ≤ 60 chars, modifications ≤ 200 chars, one photo). Contact details are rejected by the server.	Until deleted by the poster or removed by the operator; a finished trip leaves the board 60 days after its last day
Travel-partner conversations	messages (≤ 1000 chars) between a trip's poster and one person who asked to join, opened only after the poster replied; a phone number the sender chooses to share; a convoy code	Read-only 30 days after the trip, deleted 90 days after it
Partner ratings	1–5 stars, "would travel again" yes/no, an optional private note (≤ 300 chars, read by the operator only)	Until the account is deleted
Username (public handle)	username (3–20 chars, letters/numbers/underscore; shown on your POIs, hazards, and SOS alerts in place of an anonymous ID)	Permanent until the account is deleted

Everything else (downloaded map regions, tire-pressure calculator inputs, etc.) is stored only on the user's device. Saved GPS tracks are backed up privately to their owner's account and are visible to nobody else — unless the owner explicitly publishes a track, which is the deliberate, per-track act that turns it into the user-generated content listed above. Nothing is ever published automatically.

Who can see a photo. A photo added to a point of interest is public, because points of interest are themselves a shared community layer — anyone using NavTrail can see them. A photo added to one of your saved routes is private to you while the route is private: it is backed up to your own account and restored on a new device, and it is not included when you share that route with someone by link. If you publish the route in Public tracks, its photos become public with it — the publish dialog states this before you confirm — and they become private again the moment you unpublish.

Only the person who created a point of interest can add a photo to it, and only they can remove it. This is enforced on the server, not merely hidden in the app.

Location data in photos. Photos are re-encoded on your device before they are stored or uploaded, which discards the metadata the original file carried — including the exact GPS coordinates a camera records. We do this so that publishing a photo cannot accidentally publish where you live.

2. What is not allowed

Hate speech, slurs, or content targeting people based on ethnicity, nationality, religion, gender, sexual orientation, or disability.
Sexually explicit content.
Threats, harassment, or content that incites violence.
Spam — repeated or low-effort posting that drowns out legitimate community content.
False emergency reports (SOS alerts, hazards). These can cause real harm by diverting attention from genuine emergencies. Sending false SOS alerts will result in removal of your account.
Personally identifying information about other people (real names, phone numbers, addresses) without their consent. The contact_hint field on SOS alerts may contain the reporter's own contact info (e.g. their own phone number) but not anyone else's.
Content promoting trespass on clearly-marked private property.
Profanity directed at named individuals or groups.
Asking for, offering or accepting money for a travel-partner trip or a seat in a vehicle. Trips on the board are free by rule; a listing that asks for money is removed.
Contact details (phone numbers, e-mail addresses, social handles) in a public trip listing or in a request to join. Share them only inside the conversation, where you choose who receives them.

3. How moderation works

NavTrail uses three complementary moderation layers, backed by an account model that strengthened in v1.2: browsing and posting POIs/hazards are anonymous by default, but a user can create a permanent, email-verified account — and sending an SOS now requires one. Because a verified email is needed to send an SOS, account-level enforcement (including removing the account of anyone who sends false SOS alerts) is a real deterrent, alongside the server-side controls below.

3.1 Server-side profanity filter (preventive)

Every POI name/description, hazard description, and SOS description/contact-hint passes through a server-side wordlist filter before insertion. The filter uses whole-word matching with Romanian diacritic folding (ă/â/î/ș/ț → a/a/i/s/t) to catch common bypass attempts. Content that matches the wordlist is rejected with the error content_blocked_profanity; the user sees a localized message asking them to rephrase.

Implementation: BEFORE INSERT triggers on pois, reports, sos_alerts in supabase/migrations/0010_ugc_moderation.sql.

The wordlist is intentionally narrow (severe slurs + common vulgarities, ~25 terms across Romanian and English). We err on the side of letting borderline content through; the report-and-auto-hide path below is the second line of defence.

3.2 In-app "Report content" action (community moderation)

Every UGC surface has a "🚩 Report content" action visible to all users except the creator:

POIs: "REPORT PROBLEM" button in the POI detail sheet. Reasons: doesn't exist, private property, spam, other.
Published routes: "Report this track" button on the route's page in Public tracks. Reasons: inappropriate content, spam, abusive, other. The creator of a route can also be blocked from the same page.
Hazards: "🚩 Report content" link under the hazard confirmation dialog. Reasons: false report, spam, abusive, other.
SOS alerts: "🚩 Report content" link in the SOS detail sheet. Reasons: false, spam, abusive, other.
Convoy nicknames: convoy owners can kick any member at any time.
Convoy messages: any member can block another member, which silently hides that person's messages for them and takes effect at once. Blocking is personal and lasts until undone in the app's settings; it is separate from the owner's ability to remove someone from the convoy. Messages are never stored, so there is nothing to retain or delete — leaving the convoy ends all contact.

Reports are immutable and visible only to the reporter (a user cannot see who else has reported a row). One report per user per row is enforced at the database layer.

3.3 Auto-hide / auto-resolve trigger (≥ 3 unique reporters)

When the count of distinct reporters for a given row reaches 3:

POIs: is_hidden flag flips to true; the POI disappears from the map for everyone except its creator. A 24-hour age safeguard prevents griefing of brand-new POIs.
Hazards: status flips to RESOLVED; the marker drops out of bbox queries and Realtime UPDATE removes it from open clients' maps.
SOS alerts: resolved_at is stamped with the current time; same removal effect.
Published routes: is_hidden flips to true at 3 unique reporters, with no age delay. The route disappears from Public tracks and its GPX file stops being downloadable — for everyone, immediately. The creator's own copy of their recording is never touched; hiding removes a route from discovery, it does not delete anyone's data.
Convoy members: not subject to community auto-hide; owner-kick is the only path.

Triggers run as SECURITY DEFINER functions and stamp resolved_by_user_id = NULL so the audit log distinguishes system-resolution from human-resolution.

Implementation: poi_auto_hide_on_reports, report_auto_resolve_on_reports, sos_auto_resolve_on_reports.

3.3.1 Photos

Photo captions pass through the same server-side wordlist filter as every other free-text field. The image itself is not inspected automatically. We want to be direct about that rather than imply a capability we do not have: no automated system reviews the picture content.

What protects the community instead is a combination of measures:

Only signed-in users can add a photo, and every photo is permanently attributable to the account that added it.
Photos can only be added to a point of interest by the person who created it, which keeps the volume proportionate to what one person can review.
Any user can report a photo from the app. A photo is hidden automatically once 2 different people report it — a lower threshold than the 3 used elsewhere, and with no age delay, because a harmful image does more damage per view than a piece of text.
Every report reaches the operator immediately (see section 4), and hard limits (1 photo per point of interest, 2 per route) cap how much any one account can post.

3.4 Time-to-live cleanup (passive moderation)

Even content that nobody reports doesn't live forever:

Hazards expire 4 hours after creation (extendable to 4 more hours per community "still here" confirmation).
SOS alerts auto-resolve after 24 hours.
Convoys are reaped 48 hours after last activity.
POIs are permanent unless reported or deleted by the creator.

Expired/resolved rows are purged by pg_cron jobs every 15 minutes to 1 hour, depending on the table.

3.5 Blocking another user

Any user can block another user from the app. Blocking hides everything that person has contributed — including content they posted before you blocked them — from your view: their points of interest, their photos, their published routes and their travel-partner trips, and it closes any conversation between you on the trips board, in both directions. It takes effect immediately and applies wherever that content would otherwise appear.

Blocking is private. The person you block is not told, and nothing about them changes for anyone else. You can see who you have blocked, and unblock them, at any time in the app's settings; unblocking restores their content to your view, because nothing was deleted.

3.6 Travel partners: listings and conversations

Before it is stored. A trip listing and a request to join are screened by the profanity filter and rejected if they contain contact details. A conversation opens only after the poster replies to a request — nobody can message a stranger uninvited — and its messages go through the profanity filter too.
Money. The poster confirms the trip is free when posting. Text that looks like a request for money flags the listing for operator review; "asks for money" is the first report reason offered; a listing that asks for money is removed by the operator (the account is kept).
Reporting. Any listing and any message from the other party can be reported from the app. A listing hides automatically once 3 different users report it. Every report on a trip or a message alerts the operator immediately, and we respond to reports on travel-partner content within 24 hours: we review, hide or remove the content and, where warranted, block or remove the account.
Ratings. A partner can be rated only after both sides confirmed they travelled together, once per trip. A "would not travel again" answer is never shown publicly; it goes to the operator together with any private note.
Adults only. Posting a trip or asking to join one requires a declaration of being 18 or older, and a one-time safety notice is shown before a first request.

3.7 Comments, ratings, badges and following

Comments. A signed-in member with a confirmed account and a public username can comment on a community point of interest or a published route. A comment is public and shows the author's username and rank. Before it is stored it is screened by the profanity filter and rejected if it contains contact details (phone numbers, e-mail addresses, social handles); it is limited to 500 characters and to 30 comments per hour. Authors can edit or delete their own comments at any time.
Reporting comments. Any comment by another member can be reported from the app with the same reasons as photos and routes. A comment hides automatically once 3 different users report it; every report alerts the operator and enters the review queue; the operator can hide or restore a comment. A hidden comment stays visible only to its author, marked as hidden.
Ratings. A member can rate a point of interest or a published route from 1 to 5 stars, once per item, and change or remove the rating later. Only the average and the count are shown; ratings are anonymous to other members and cannot be given to your own items.
Badges and ranks. Badges are awarded by the server for what a member does in the app (distance recorded, points of interest added, routes published, curated challenge places driven through while recording); they cannot be bought or given. Ranks and "Respect" are computed from badges and from good ratings received. A member can hide their badges from others with one switch.
Following. A member can follow another member to be notified when that person adds a point of interest, publishes a route or earns a challenge badge. Following is one-way, needs no approval, opens no conversation and reveals nothing beyond what is already public. Blocking a member ends the follow in both directions and hides their comments as it hides everything else they contributed.

4. Operator-level moderation

For content that bypasses the automated layers (a single highly-toxic post that doesn't trip the wordlist and isn't seen by 3 other users), the operator (Constantin, contact@navtrail.app) reserves the right to:

Delete individual rows directly via the database.
Suspend or remove a user account — an anonymous session (revoke it and block re-creation from the same device by FCM token) or a permanent email-verified account (e.g. for repeated false SOS alerts).
Update the wordlist in response to observed abuse patterns.
Remove a travel-partner listing that breaks the rules (asks for money, carries contact details, abuse), recording its title, the reason and the date; hide a reported message for both participants; clear a money flag that was a false positive.

These actions are taken in response to email reports at contact@navtrail.app or to proactive observation by the operator. Operator actions are logged but not publicly visible.

5. User rights

You can:

See what we know about you — no name, email, or phone is required to browse or post. An optional account (to back up your data across devices and to send SOS) uses an email + password; you may also set a public username shown on your POIs, hazards, and SOS alerts. POIs and reports you created are visible in the app.
Delete your content — POIs you created have a DELETE button. Hazards and SOS alerts you created can be resolved (which removes them from the map immediately).
Delete your account — in-app via Settings → Account → Delete account (removes your account and cloud data immediately; community POIs you created are anonymized rather than deleted, so the shared map stays intact). You can also email contact@navtrail.app with your user ID (visible in Settings → About) and we'll purge it within 30 days.

6. Reporting content that bypassed the automated flow

If you find abusive content that wasn't auto-hidden by the in-app report action:

Try the in-app "🚩 Report content" button first — it's the fastest path and triggers immediate moderation once 3 users agree.
If the content is severe (threats, doxxing, sexually explicit content involving minors, etc.) email contact@navtrail.app directly with a screenshot. We commit to first response within 48 hours and removal of clearly-violating content within 7 days.
For illegal content (CSAM, direct threats of violence), report to Romanian authorities (112 for emergencies, +40 21 208 25 25 for the General Inspectorate of Romanian Police) in parallel with notifying us.

7. Updates to this policy

This policy may change as the app grows. Material changes will be announced in the app's release notes and reflected in the "last updated" date at the top of this document. The current version always lives at https://navtrail.app/moderation.