Report abuse

If a Flagship app (a *.flagship.services address) or a voi.ci link or page is hosting malware, phishing, copyright infringement, or other abuse, report it with the form below or by email, and we will investigate and take action. For a message, see voi.ci pages and Messages below.

Report a link or an app

You don't need an account. We don't keep your IP address. Leave an email only if you want us to confirm we got the report and tell you what we decided; it is deleted with the report.

Contact

• Email: abuse@flagship.services
• Authorized representative: Flagship Abuse Team (flagshipserver.com)

What to include

• The full URL or hostname (e.g. something.example.flagship.services).
• A short description of the abuse (phishing, malware, CSAM, copyright, harassment, etc.).
• Evidence: screenshots, headers, sample URLs, or a reference to a third-party report (Google Safe Browsing, PhishTank, NCMEC, etc.).
• Your contact info if you would like an acknowledgement and resolution update.

Response targets

• Acknowledge within 2 business days.
• CSAM, active phishing and malware escalated immediately on receipt.
• Other categories triaged within 5 business days.

What we can do

Each Flagship server runs on hardware the user owns; user content is end-to-end private to that user (TLS terminates on their machine, not on our infrastructure). What we control is the routing layer and the account.

• We work out which account the app, link or page belongs to and send that account's administrators a notice in the Flagship app: what was reported, why, what to do (change it or take it down) and a deadline.
• If it is still there after the deadline, we can suspend the account: its servers are taken off the public internet (their routing on flagship.services is revoked), its voi.ci page is taken down and its names are held. Child sexual abuse material, active phishing and malware can be suspended at once, without waiting for a deadline.
• A suspended owner's data stays on their own server: they can still back it up and move it over their home network. If we got it wrong, we lift the suspension and everything comes back.

We cannot read the content of a user's TLS-encrypted traffic, so requests for content monitoring or interception cannot be honored, by design.

voi.ci pages and Messages

A voi.ci page is a public profile page that a Flagship user publishes on our servers, and Messages are the private messages people send to it. Unlike a server, we host the page, so we can remove it. Messages are end-to-end encrypted: we can't read them unless someone who received one reports it.

How to report illegal or abusive content

• On the page: every voi.ci page has a Report this page link at the bottom. Pick a reason and add a note. You don't need an account.
• In the Flagship app: open the conversation and tap Report on the message. You can also block the sender.
• By email: write to abuse@flagship.services. Please include:
  • the page's address (for example https://voi.ci/name) and which post, photo or link;
  • why you think it is illegal or breaks our rules (if it is illegal, which law, if you know);
  • your name and email, so we can confirm we got it and tell you what we decided (you may leave these out when reporting child sexual abuse material);
  • a statement that you believe in good faith that what you say is accurate and complete.
• Copyright: send a DMCA notice as described in the terms, section 9.

What happens next

• If you gave us an email, we confirm we received your report.
• A person at Flagship reviews every report. We don't use automated tools to decide on reports. We aim to decide within 24 hours; child sexual abuse material, threats to someone's life or safety, and active scams go first.
• If the page breaks the law or our rules, we take it down: voi.ci shows "This page isn't available" and it can't be published again until we restore it.
• If a message breaks the rules, we open the sealed tag on that one message to learn which account sent it, and we can stop that account from sending messages. Its servers and apps keep working.
• If you gave us an email, we tell you what we decided and why.
• We report child sexual abuse material to NCMEC, and we tell the police when we learn of a threat to someone's life or safety.
• If someone keeps sending reports that are clearly unfounded, we may stop handling their reports for a while, after a warning.

If we act on your page or account

When we send your account a notice, take down your page, stop your account from sending messages or suspend it, the Flagship app tells you, with the reason. A notice shows its deadline; tap I've done this once you have changed or removed what it names, and we check. If you ask, we send you a full statement of reasons: what we restricted, which of our rules or which law it was under, whether we acted on a report or found it ourselves, the facts we relied on, and how to appeal.

Appeal a decision

You can appeal for six months after a decision: an account that got a notice or was suspended, a page owner whose page was taken down, an account that was stopped from sending messages, or a person whose report we turned down. A person at Flagship reviews the appeal again, looking at what you sent, and we answer within 14 days.

Write an appeal

Send it from any email address and tell us your Flagship username (or the page's address), what we decided and why you think it was wrong. To prove an account is yours, we may ask you to approve a code in the Flagship app. If we got it wrong, we restore the page or lift the ban. If you live in the EU, you can also take the decision to a certified out-of-court dispute settlement body, or to court.

For authorities

Authorities and law enforcement can reach us at abuse@flagship.services, in English. What we hold about pages and messages, and what we can't see, is listed in the privacy policy.

Connections that seem to come from our address

Servers on Flagship can make outbound calls to AI providers through our relay, so a provider may see such a call arriving from the relay's address instead of the user's. Only the box's own AI-building software makes these calls, only on port 443, and only to public internet hosts; the relay cannot read them. If you see an attack or abuse that seems to come from our address (149.248.216.86 or 2a09:8280:1::110:d2b6:0), write to security@flagshipserver.com with the address and the time. We will look at the host, and if it should not be reachable this way we remove it from the list of hosts boxes may reach.

Security vulnerabilities

For security issues in Flagship itself (the protocol, daemon, control plane, or clients), please use the security disclosure process instead.