SafetyImg is a hosting service: users store encrypted photos and videos with us and make them available to individual other users they choose themselves. Anyone who believes that content made available through the service is illegal can report it to us. This document sets out how to do that and what happens next.
Why we depend on reports. The content is end-to-end encrypted. What sits on our servers is ciphertext and nothing else, and we hold no key to it. We can therefore neither search nor spot-check what is stored — not voluntarily and not on order. A report by a recipient is the only way a piece of content becomes visible to us at all.
That is why the app offers reporting at the one place where it can work: in the viewer, on the authorised recipient's device. When they report, their device decrypts the medium and sends us a copy together with the reasons given.
The viewer offers a Report action. It asks for a reason and then transmits the report together with a copy of the medium. This route is open to every user who is allowed to view the medium.
We also accept reports in writing: meldung@safetyimg.app
As we cannot view content ourselves, we need details in this case that identify the medium concerned unambiguously — as a rule the media identifier the app shows in the viewer, or the sender's username together with the time.
Under Article 16(2) of the Digital Services Act, that is:
A report containing this information gives us knowledge within the meaning of Article 6 of the Digital Services Act.
We take no automated decisions: we can only assess content that a report has made accessible to us, and that assessment is made by a human being.
Where an account is suspended, access remains blocked immediately. We keep the data for 30 days and then delete it automatically. That period exists so that a wrong decision can be corrected and an official enquiry answered.
Anyone who disagrees with a decision — whether the person reporting or the user concerned — may contact widerspruch@safetyimg.app within six months. We will look at the case again; as far as is organisationally possible, the second look is not taken by the person who decided the first time.
On the legal classification — this is the most important open question in this document. The duties under Article 20 (internal complaint-handling) and Article 21 (out-of-court dispute settlement) of the Digital Services Act apply to online platforms. Under Article 3(k), an online platform is a hosting service that disseminates information to the public. SafetyImg makes media available exclusively to individual recipients named by the sender; recital 14 excludes dissemination to a limited number of predetermined persons from being public. On that reading SafetyImg is a hosting service but not an online platform — and Articles 20 and 21 would not apply.
We offer the objection procedure regardless, because it costs little and makes mistakes correctable. Independently of that, micro and small enterprises are exempt from Section 3 of the Regulation under Article 19. [[ Have both confirmed by a lawyer. If the assessment comes out differently, the following are additionally required: a formal internal complaint-handling system, a connection to an out-of-court dispute settlement body, transparency reports under Articles 15 and 24, and reporting of monthly active user numbers. ]]
Where somebody repeatedly submits manifestly unfounded reports, we may suspend the handling of further reports from them for a reasonable period (Article 23 of the Digital Services Act). We issue a warning first. The same applies to users who repeatedly share manifestly illegal content.
Please address orders to act against illegal content (Article 9) and orders to provide information (Article 10 of the Digital Services Act) to our point of contact: dsa@safetyimg.app. We confirm receipt without delay and state what action we have taken.
What we can supply is limited by the encryption: we cannot hand over content even on order, because we cannot decrypt it. We can provide information about account data and traffic data (who shared with whom and when).
Where a report gives rise to a suspicion of a criminal offence involving a threat to the life or safety of a person, we inform the competent law enforcement or judicial authorities without delay (Article 18 of the Digital Services Act). The same applies to content depicting the sexual abuse of children.
Single point of contact under Article 11 (authorities) and Article 12 (users) of the Digital Services Act:
Email: dsa@safetyimg.app
Postal address: Lutz Maier, Vogelweide 22, 22081 Hamburg
Languages: German, English