This policy explains what Lotus Pond collects, why, and what you can do about it. Lotus Pond is operated by NexThought LLC, which is the controller of the personal information described here.
Lotus Pond is offered only in the United States and is built for US law. If you are outside the United States, please do not create an account.
To decide whether to hide something from your feed, we have to look at it. Feed items a smart filter checks on YouTube and Reddit are sent to our servers, where our own models and, while we move off them, outside AI providers judge them. We keep a record of each decision so you can see what was filtered and why. For 30 days an analysis record is linked to your account (an item you report stays linked until its review ends). After that we remove your account and your filters' names and wording from the record itself and keep the rest of the analysis. Some separate records can still be connected to it: any support ticket you filed about the item, review or training copies you opted into, and our shared result cache, which stores results under an encoded form of filter wording. Each item a smart filter checks is sent with a picture of it as it appeared in your feed (a post with no image is sent as text); we use the picture for that check and delete it when the check ends. Items checked only by basic filters never leave your browser. Two things are up to you: whether the reports you send may help train our filtering, which is off until you switch it on, and whether your usage counts are part of our internal analysis, which is on unless you switch it off. We do not sell your data and we do not run advertising or analytics trackers.
| Category | What it includes |
|---|---|
| Account | Your email address and display name, the US state or territory you live in and the age range your date of birth falls in (13, 14 to 15, 16 to 17, or 18 and over; we never keep the date itself). If you sign in with Google, we receive your email address, name, and profile picture from Google, but not your Google password. |
| Filter settings | The topics, keyphrases, and rules you configure, any exceptions you add, and how you group them, and a record of your consent to process what your smart filters say (see Your choices and your reports). |
| Greenlist | The creators and communities you choose never to filter: the channel, subreddit, or account name you gave us, and whether it was a durable identifier or a display name. We keep this until you remove the entry. |
| Analyzed content | For feed items the extension submits: the platform's identifier for the item, its title and visible text, the creator or community it came from, and the picture of the item as it appeared. The picture is used for that check and deleted when the check ends; a report you send does not carry it. Alongside it we store the classification result: matched topics, moderation categories, and any public figures named in it, together with the filters that were active when the item was judged, so a past decision can still be explained by the rules that produced it. |
| Billing | Your plan, subscription status, and a Stripe customer identifier. Card numbers go directly to Stripe; we never receive or store them. |
| Support | Messages you send us, including the name and email address on the request and anything you attach to it, such as a link to content you think we filtered incorrectly. |
| Technical | Server logs containing IP address, timestamp, and request details, plus counts of how much analysis your account has used. These support security, abuse prevention, and billing. |
| Daily counts | Per‑day totals of how many items your filters matched, how many we judged, how many we hid without being able to check them, and, unless you switch Usage analysis off, when your account reached its daily limit. Each is recorded against a broad surface such as “YouTube home” or “Reddit feed.” These are counts only. They record that you were browsing a kind of page, never which page, which item, or which creator. We use them to show you what filtering is doing for you, and, unless you switch Usage analysis off, to set the daily limit against real demand rather than a guess. |
The extension runs on supported pages on YouTube and Reddit. On those pages it reads the feed items that are already on screen and hides the ones that match your filters.
Whether an item leaves your browser depends on the kind of filter. Basic filters are matched on your machine, so an item that only needs a basic check is never sent anywhere. Smart filters need a model, so those items are sent for analysis as described below. If every filter you have is a basic filter, no feed item ever leaves your browser.
To identify who published an item, the extension may ask the platform's public embed service about that item, sending only the item's link or id.
When you add a Reddit user or community to your greenlist, the extension asks Reddit for that user's or community's public details from your own browser. Your browser attaches your Reddit cookies to that request, exactly as it does when you open a Reddit page, so Reddit sees it as ordinary browsing on your account. We never see those cookies. We receive only the public name, picture, and for a community its subscriber count, which we show you and do not store. This happens only when you add a source, never while filtering.
So your dashboard's Activity page can list what was hidden and let you report a misfilter, the extension keeps a record of the last 20 items your filters hid. Each entry in that record holds the item's title and link, the names of the filters that hid it as they were at that moment, and the misfilter report the extension would send for it. It holds no picture of the item. Entries are not shown or used after 48 hours and are deleted the next time the extension runs; they are also removed when you sign out or a different account signs in. The item's link in this record never leaves the extension except inside a misfilter report you ask for.
The Activity page asks the extension for that record and gets each item's title, the names and ids of the filters that hid it, the kind of page, the time, whether it has been reported, and an opaque random key, but never the item's link. The page shows this list in your browser and does not send it to us. When you press Report Misfilter there, the page sends the extension only that key; the extension then sends us the misfilter report it prepared when the item was hidden, signed in as you, at most once per item. Nothing else from the page is forwarded.
The extension's popup also keeps short lists for each open tab, so you can report a filter that got something wrong: the items your filters hid there, and up to the last 100 items shown on the page, meaning items your filters allowed, and items Lotus Pond could not check (marked "not checked"). Each entry holds the title, the channel or author, the link and the link to the platform's own thumbnail image, never the picture Lotus Pond checked. An item our safety checks flagged is listed as not checked, has no thumbnail link, and carries the id of its analysis request, which a report about it includes. These lists are kept only for the browser session: they are cleared when the tab closes, the browser restarts, you sign out or a different account signs in. They never leave your browser except inside a report you choose to send.
The extension does not:
We use content from your feeds to train or test AI models only from reports you send while training is switched on, as described below. We do not use it for advertising or profiling.
Two things are up to you, and you can change both any time under Your data in your account settings.
Whatever you choose, an item a smart filter checks is judged as described under AI processing, and passes through the services listed under Who we share it with. Filtering works the same whatever you choose.
Your filters can say sensitive things about you, such as your health, religion, politics or sexuality. We use them only to filter your feed, to explain and review its decisions and, for a report you allow for training, to train and test our filtering models, never to work out anything about you, and a person reads them only in a report you send. The first time you save a smart filter, we ask for your consent to process what your filters say, including anything sensitive, and keep a record of it. Basic filters are matched in your browser, and the items they check are never sent to us. They don't need this consent. You can give this consent yourself from 13. If you don't give it, your smart filters stay saved but paused, and the posts they would check stay hidden until you agree or remove them. Switch Smart filters off under Your data in your account settings to withdraw it: your smart filters pause straight away, and their wording is deleted 30 days later unless you switch it back on. A copy kept in a report you sent is deleted 30 days after that report is resolved or closed instead, though the report's message still quotes the wording of the filters involved until you ask us to delete it or you delete your account, as described under Deleting your account. If you are under 18, the wording of your filters is used only to run your filters and to review a report you send yourself: never in usage analysis, never in training or test sets, and our review team reads it only in such a report. How we handle health information is set out in our Consumer Health Data Privacy Policy.
When you report an item, your report carries the item's text, your filters and how each filter judged the item. It does not carry the picture of the item: we deleted that when the check ended. If a future version of the report carries the picture, we will say so here first. Our review team reads it to find out what went wrong. Every view is logged, and other users never see it. Pressing Send is your consent to our team reading the report, including anything your filters say about you. A report also keeps a copy of your filters as they were when you sent it, including if you are under 18. That copy, and how each filter judged the item, are deleted 30 days after the report is resolved or closed. The report's message, which names the item, quotes the wording of the filters involved and holds its link, is kept like other support messages, until you ask us to delete it. When you delete your account, we delete the whole report with it, as described under Deleting your account.
The pictures show other people's posts, names and faces. If a safety check flags an item later, we delete any item made from it in a training or test set.
We analyse how Lotus Pond is used from your account's usage records: daily counts of items checked and hidden by kind of page, how many AI checks your account used, and when a plan limit turned a request down. These are counts only; they never include an item, a page, a creator or the wording of a filter, and nobody outside Lotus Pond sees them. You can switch this off under Your data in your account settings; we then stop recording limit refusals and leave your account out of every analysis. Nothing changes in the product. Your Activity page and the list of recently hidden items are shown only to you, and you can clear them yourself.
When our review team finds that Lotus Pond judged an item wrongly, it may correct the stored decision for that item, and the correction applies to everyone whose filter has the same wording.
Turning training off takes your reported items out of our training and test sets straight away. Switching Usage analysis off leaves your account out from then on. Backup copies of anything deleted are gone within 7 more days.
Items a smart filter checks are judged by our own models, which run on Google Cloud in the United States, and, while we move off them, by these outside providers under terms that forbid them from training on anything we send. None of them is told who you are. When a provider leaves the list we update this page; if we ever add one, we tell you before any item goes to it.
| Provider | What it does |
|---|---|
| OpenAI | Checks items against safety categories, and screens and analyzes them where our own models don't yet. |
| Google (Gemini) | Works out who a picture shows, as described below, until our own model takes it over, and analyzes items where our own models don't yet. |
What we send them: the feed item being judged - its title, its visible text, its thumbnail or a picture of the item as it appeared, the creator or community that published it, and for Reddit the post's link - together with your filters as you wrote them: the topics, the exceptions, and the kinds of source you chose. A model cannot judge an item against your filters without reading your filters. That is the whole payload.
What we never send them: your Lotus Pond username, your display name, your email address, your account identifier, your subscription or payment details, or anything else about who you are. The providers see items from a feed. They are not told whose feed it is.
One technical detail worth stating plainly, because it is the closest thing to an exception. Screening requests carry a routing key, which lets the provider reuse a cached copy of our standard instructions and makes the service faster and cheaper to run. That key is derived from your account through a one-way function: it stays the same for you, it cannot be turned back into your account, and it carries no personal detail. It does let the provider tell that a group of requests came from one account, which is what makes the cache work, but not which account, or anything about the person behind it.
Each provider is used under its business or API terms, which do not permit using submitted content to train its models.
To judge an item against a filter about a person, Lotus Pond works out who a picture shows. It reads names printed in the picture, and, where the law where you live allows it, it also recognizes well-known public figures by their facial appearance, including people well known within a field, like a musician, podcaster or athlete. It names nobody who isn't a public figure. The model is told never to work out anyone's race, ethnicity, gender or age, and it returns names only. It keeps no map or measurement of any face, no face template, and no picture of a face; the picture itself is deleted when the check ends.
Recognition by facial appearance is switched off for users in Illinois, Texas, Washington and Colorado, and whenever we cannot tell which state a request comes from. Users there get name-reading from text only. We decide using the state you gave us and the state your connection appears to come from; if either is on that list, it is off.
If you are a public figure and don't want Lotus Pond to recognize you, email [email protected] and we will stop.
Every request to Lotus Pond, including the item and your filters, passes through Cloudflare on its way to us, as listed under Who we share it with.
Classification is automated. It has no legal or similarly significant effect on you, and it only determines whether an item is hidden from your own feed. You can change your filters or report a wrong decision at any time.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not run advertising networks, analytics trackers, or third-party pixels on this site.
Where our marketing pages embed a video, the player is not loaded until you click it, and it loads in a no-cookie mode.
Some things are deleted on a schedule, and the table says which. Anything not on a schedule is kept while your account is open and removed when you close it, except as set out under Deleting your account below, or sooner if you ask us. Backup copies of anything deleted are gone within 7 more days.
| Data | How long it is kept |
|---|---|
| Account and filter settings | While your account is open. Deleted when you close it. |
| The picture of an item | Sent to us with each item a smart filter checks, used for that check, and deleted when the check ends. A report you send does not carry it. An item checked only by basic filters is never sent. The extension keeps no copy of the picture on your device; its lists keep only a link to the platform's own thumbnail image (see What the extension reads). |
| Records of individual checks | For 30 days an analysis record is linked to your account (an item you report stays linked until its review ends). After that we remove your account and your filters' names and wording from the record itself and keep the rest of the analysis. Some separate records can still be connected to it: any support ticket you filed about the item, review or training copies you opted into, and our shared result cache, which stores results under an encoded form of filter wording. We keep the link for those 30 days so your Activity page can show what was hidden and why. |
| Misfilter reports you send | The item's text, your filters and how each judged the item: 30 days after the report is resolved or closed. The report's message, which names the item, quotes the wording of the filters involved and holds its link: kept like support messages, below. A report sent with training switched on stays in our sets as described below. |
| Items in training and test sets | Only reports sent with training switched on. Kept until you turn training off or close your account, or a safety check flags the item, then deleted; backup copies are gone within 7 days. Models already trained are not retrained. |
| Usage records for analysis | Kept for 13 months, then combined into totals that no longer identify your account. If you are under 16, or switch Usage analysis off, your account is left out. |
| Classification caches | Kept indefinitely. Shared across everyone using the service: the cache holds content ids, an opaque fingerprint of the filter and the verdict, never your filter wording or your account, so it is not deleted when you close your account. A correction our review team makes stays in it while the item is unchanged. |
| Support messages | Kept while your account is open, so we have a record of past issues. Deleted on request. A misfilter report's message is kept the same way. When you delete your account, we delete your support messages and reports with it, at once, except any we must keep for a legal reason such as a payment dispute, which we keep unlinked from your account until the dispute ends. Backup copies are gone within 7 days. Messages you sent while signed out aren't linked to an account; ask us and we'll delete them. |
| Billing records | As long as tax and accounting law requires, typically 7 years. Held largely by Stripe. |
| Server logs | Retained by our hosting provider for a limited operational period for security and troubleshooting. |
Lotus Pond does not collect, store, buy, sell, lease, trade or share biometric identifiers or biometric information: no face geometry, face templates, fingerprints, voiceprints or iris or retina scans. Where recognition of well-known people by facial appearance runs, the model's only output is a list of names; any face-related data that exists during that step exists only inside the model's working for that single request and is gone when the request completes, within seconds and never later than the end of the check. We keep no such data to destroy on a schedule, and no retention schedule longer than that applies. Recognition by facial appearance is not run for users in Illinois, Texas, Washington or Colorado. If we ever change this, we will publish a retention schedule and destruction guidelines here first and, where the law requires it, ask for consent before collecting anything. Questions: [email protected].
Write to [email protected], or use Delete account in your account settings, and we delete your account: your sign-in, filters, settings, usage counts, consent records, stored pictures, your reports' copies in our training and test sets, and your billing customer are removed (Stripe keeps its invoices). Records of past checks that are still linked to your account are deleted. Older ones, which we have already unlinked as described above, and our shared result cache are kept without your account attached, and so are our usage and cost logs. We also delete your support messages and misfilter reports with your account, at once, along with everything made from them: their replies, the copy of your filters and how each judged the item, and their items in our training and test sets. Our review team's labels of a reported item are kept, without your filters' wording or your account. If we must keep a support message or report for a legal reason such as a payment dispute, we keep it unlinked from your account until the dispute ends, then delete it. It still holds the message and contact details you wrote in it, its replies and any copy of your filters kept with it. Messages you sent while signed out aren't linked to an account, and we don't match them to one by email address; ask us and we'll delete them.
We may also keep records where we must to meet a legal obligation, resolve a dispute, or enforce our agreements. Backup copies of anything deleted are gone within 7 more days.
If we change any of these periods, we will say so here and change the "last updated" date before it takes effect.
Data is encrypted in transit and at rest. Access to production data is restricted to those who need it, and reports are seen only through a review tool that logs every view. Our database enforces row-level security, so records are reachable only through the paths our application is authorized to use rather than being open by default.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.
Wherever you live, you can:
To make a request, write to [email protected]. We respond within 30 days. We will not discriminate against you for exercising these rights.
Lotus Pond is offered only in the United States and is built for US law. If you are outside the United States, please do not create an account. We operate in the United States, and our service providers are listed above with their locations.
We ask which US state you live in so we can apply its privacy rules, such as where recognition of well-known people by facial appearance is switched off, and we check it against the state your connection appears to come from. We never ask for or keep your precise location.
Under the CCPA and CPRA you may request to know the categories and specific pieces of personal information we collected, to delete it, to correct it, and to opt out of its sale or sharing. As stated above, we do not sell or share personal information, so there is no opt-out to exercise. The categories we collect and the purposes we collect them for are described in sections 2 through 4. You may use an authorized agent to make a request.
Some of what we hold can be sensitive personal information: the wording of your filters, which can reveal your health, religion, politics or sexuality, and the names of well-known people recognized in a picture. We use it only to provide the service you asked for, never to infer characteristics about you, and keep it only as long as the table under How long we keep it says.
You must be at least 13 to use Lotus Pond. We ask for your month and year of birth when you sign up and keep only the age range it falls in. If you are under 13, we do not create an account. If you tell us you are under 13 after signing up, we close your account at once and delete it within 7 days. If we learn that a child under 13 has given us personal information, we delete it; if you believe one has, contact us.
If you are 13 to 17, you use Lotus Pond yourself: you agree to our Terms of Service yourself, and you give the consent for smart filters yourself (see Your filters). You need a parent or guardian's permission only to buy a paid plan. If you are under 18, the wording of your filters is used only to run your filters and to review a report you send yourself, and if you are under 16, Usage analysis is always off.
Training on reports is not offered under 18. We do not show advertising to anyone, and we do not sell or profile anyone's data, whatever their age.
Lotus Pond is not a parental control or child-safety product and should not be relied on as one.
We may update this policy. If a change is material we will give notice by email or in the product before it takes effect, and the "last updated" date above will change.
Privacy questions and requests go to
[email protected], or through
our contact page.
NexThought LLC, operator of Lotus Pond.
