Doodle Gallery - a Moderated art wall

A few weeks ago I added a Gallery to Disco Doodle — my little side project with drawing-prompt generators (Daily Doodle, Monster Maker, Theme Park Edition) — so people could actually show off what they drew instead of the prompts just disappearing into the void. Simple idea. But I didn't know how much would go into doing something like this.

I wanted to be sure to have a moderation component because, the internet being the internet, people are always trolling.

What it does

The Gallery is pretty straightforward on the surface: a person draws something from one of the prompt generators, snaps a photo, and submits it through a simple form. But nothing shows up on the public Gallery page until I've actually looked at it.

• A submission form (wall/submit.html) that takes the photo plus which pack/prompt it was for
• Every submission lands in a private moderation queue — invisible to the public, only I can see it
• I get an email notification the moment something's waiting on me
• I approve or reject from an admin page, and only approved photos ever hit the public Gallery
• A basic profanity filter runs client-side too, in case someone tries to get something inappropriate into a custom category text

The build

Nothing fancy on purpose — I wanted this running on the same free-tier, no-backend-server stack the rest of the site uses, because it's a hobby project and I'm not trying to run a server for it.

• Firebase Realtime Database holds the moderation queue. Submissions write in as "pending," and only get flipped to visible once I approve them.
• Cloudinary hosts the actual images. We chose them because of the completely free tier. Another version we looked at had a free tier, but you had to have a credit card incase the volume got too high.
• EmailJS fires off a notification email when something new comes in, so I'm not manually checking a queue every day. Free tier caps at 200 requests a month, which appears to be plenty for the moment.
• A plain admin page, gated behind Google Sign-in through Firebase Auth, is where I actually approve or reject things
• The whole moderation page is blocked in robots.txt too, since there's no reason for it to show up in search results

It all seemed to work ok. There was some back and forth on getting the google services side wired up and being sure I copied the right text into the right spaces in the setup.

The profanity filter is intentionally basic — it normalizes leetspeak, collapses repeated letters, and matches whole words so it doesn't flag things like "classic." It's client-side, so it's a deterrent, not a guarantee — a determined person could get around it.

We added a way for someone to send an email to notify us if their artwork was uploaded to our site without their permission. We also put a disclaimer checkbox, making the person agree that it's their artwork and reminding them that we're not claiming ownership of it.

Do you have any questions about this build? What should we have done differently? Let us know in the comments.