Moderation

Everything that arrives waits for a person. This page is about that person's tools.

Inbox is the queue: newest first, filterable by state, kind, rating and tags.

States

stateDiagram-v2
    [*] --> pending: arrives
    pending --> approved: you approve
    pending --> rejected: you reject
    pending --> spam: you mark as spam
    approved --> pending: restore
    rejected --> pending: restore
    approved --> withdrawn: consent withdrawn

State	Meaning
Pending	Arrived, nobody has looked
Approved	A person approved it. Publishable, if consent allows
Rejected	Not wanted. Kept, not deleted
Spam	Rejected, and counted as abuse
Draft	A video reservation exists but the visitor has not submitted yet

Rejecting keeps the item. You can restore it later, and you can read it while deciding — a rejection is a decision about publishing, not a deletion.

The invariants

Three rules are structural rather than settings. None of them can be switched off, which is the point:

1. No automatic publication. There is no configuration that approves things for you. AI moderation and the CAPTCHA score produce signals; approval is an action a person takes.
2. Approval cannot be done by a machine. The approval path structurally refuses AI and system actors. A bot cannot approve on your behalf even with a token that carries moderate:submissions.
3. Approved is not the same as displayable. Display also needs the person's consent. Both facts are stored, separately, and the public queries require both.

The audit trail

Every transition records who did it, when, and from what state. Bulk actions record one entry per item, not one for the batch.

State changes are compare-and-set: approving something already approved is not an error and does not fire a second webhook, so a double-click or a retried API call is harmless.

AI moderation

Optional, per project, and off by default. When it is on, incoming text is classified and the inbox shows a badge — spam, abuse, a likely duplicate.

It is triage. It reorders your queue; it does not empty it.

Switching it on discloses something to your visitors

AI moderation sends submitted text to a third-party model. That is a disclosure your privacy notice should carry, which is why the setting says so and why it starts off.

Video

A pending video is private. Moderators watch it through a short-lived signed URL; no public URL exists until approval promotes the file. Reject it, or the person withdraws consent, and the object is deleted and the CDN edge purged.

Captions

Every video is transcribed automatically, and the transcript appears in the inbox next to the clip, editable line by line. Speech recognition is wrong often enough — accents, background noise — that the words are yours to correct before anyone sees them, because they land on your marketing page.

Captions follow the same "approved is not displayable" rule as everything else, with a second half specific to them:

• Approve from the submission page, where the transcript is on screen, and the captions you see go live with the video.
• Approve from the inbox list, and the video is published but the captions are held back — nobody read them there. The submission page then shows a Publish captions button once you have.
• Over the API or an agent (MCP), approving publishes the video and holds the captions the same way — unless the caller sets captions_reviewed after reading the transcript (both surfaces return it), which publishes them too.

Editing already-published captions updates them everywhere at once. Transcribe again re-runs the recognition and takes the captions back down until you have reviewed the new words. A recording with no speech, or submitted without the consent that covers transcription, simply has no transcript, and the inbox says which.