Safety at Lusto: how it actually works

Most platform safety pages are adjectives. This one describes mechanisms — what is enforced, how decisions are recorded, and what you can do when something is wrong — because a safety system you cannot inspect is a promise, not a system.

The content rules, in one paragraph

Lusto is adults-only. Every character is an unambiguously adult fictional creation; youth-coded characters and age-evasion are blocked. Real-person likenesses, impersonation, and non-consensual intimate imagery are banned, as are named copyrighted characters and worlds. Characters never claim to be real people, conscious beings, or professional therapists. Mature content modes remain disabled until the full launch-gate program — independent review, jurisdiction-by-jurisdiction — is complete; configuration alone is not treated as a safety system.

Publication review, and why it fails closed

Nothing publishes by default. Every character, world, and group passes review before it is visible, reviewers inspect an immutable snapshot of exactly what will publish, and rejection comes with a stated reason the creator can fix and resubmit. Appeals go to a different reviewer, and every queue read and decision is recorded in an append-only audit log. When a decision changes something — a takedown, a quarantine — the enforcement is atomic: affected stories are frozen or settled, not left half-consistent.

Reports that cannot be quietly buried

Every public character, world, and media asset carries a report control. Reports require the exact target and evidence, enter a priority queue, and produce recorded decisions with reviewer rationale visible to the reporter. Structural guarantees: child-safety reports cannot be dismissed and require escalation to a second moderator; reporters never review their own reports; and a dismissed report can be appealed once to an independent reviewer. You can read your full report history — decisions, rationale, and appeal status — in your account.

Your controls

• Muted tags filter themes out of discovery and recommendations, persistently.
• Creator blocks remove a creator’s entire graph — characters, worlds, casts, proactive notes, calls — with an explicit unblock path and an honest notice about what blocking can and cannot hide.
• Memory control: characters remember only what you approve; every memory is individually deletable.
• Contact control: away-time story notes are opt-in; there is no unprompted “I miss you” machinery.
• Spending control: metered prices are shown before every paid action, with itemized receipts.

Privacy, deletion, and what we retain

Media and generated assets default to private and never leak into community surfaces; moderators cannot casually read private chats — investigation access is least-privilege and audited. Account deletion is typed, scheduled with a seven-day cancellable grace period, and then erases credentials, stories, messages, memories, personas, drafts, and media metadata. What is retained is published, bounded, and reasoned: billing and ledger evidence (seven years — tax, chargeback, and fraud obligations), moderation and safety evidence (five years — appeals and legal claims), and security/deletion proof (one year). Full account export is available before deletion.

Wellbeing, plainly

Lusto characters never claim sentience, human identity, or therapeutic authority, and the product avoids the engagement mechanics — guilt, jealousy, streaks — that turn attachment against its owner. Our public writing on companion safety and loneliness applies the same tests to us that we apply to everyone else.

What is not finished

Honesty requires this section: mature-mode gates (contracted classifier performance, staffed review operations, jurisdiction sign-off), some vendor-contract reviews, and parts of the launch-evidence program are still in progress, and the relevant features stay off until they are done. This page changes when the facts do.

Frequently asked questions

How does Lusto keep characters safe?

Publication fails closed: every character and world passes human review of an immutable snapshot before becoming visible, with stated rejection reasons, different-reviewer appeals, and append-only audit records. Real-person impersonation and youth-coded content are banned outright.

What happens when I report something on Lusto?

The report enters a priority queue with evidence attached, produces a recorded decision with visible rationale, and can be appealed once to an independent reviewer. Child-safety reports cannot be dismissed and require a second moderator.

Can Lusto moderators read my private chats?

Not casually. Private content stays out of community surfaces, and investigation access is least-privilege and audited.

What does Lusto retain after account deletion?

After a seven-day cancellable grace period, stories, messages, memories, personas, and credentials are erased. Retained with published reasons and durations: billing/ledger evidence (7 years), moderation/safety evidence (5 years), security and deletion proof (1 year).

Does Lusto allow NSFW content?

Mature content modes are currently disabled and stay disabled until an independent, jurisdiction-aware launch-gate program is complete. All characters are fictional adults regardless of mode, and configuration alone is never treated as a safety system.