Observed 9 September 2026. Acquisition closed. This packet covers the public-user route; it does not claim that this is the only operational route by which entries reach the database. Root separately owns partner terms, the newly discovered public API reference and named operating accounts. No live case, form, credentials, hash value or media was accessed.
The significant boundary is between withdrawing a supplied signal and reversing what another organization decided after receiving it. The user documents explicitly address the first; they preserve room for independent platform policy enforcement rather than promising restoration.
Entry selection and review
The [FAQ](http[local research file] requires the submitter to be depicted, possess the intimate material and be adult (its wording is “over 18” in the image); submission on another person's behalf is refused in this public-user path. It includes depicted-person synthetic images. Status updates may take 3–5 days. Adding further images requires a new case; withdrawal removes the whole case. Losing the case number or password prevents checking or withdrawal, and the FAQ offers no recovery. These are published eligibility and support rules, not evidence of independently verified identity or a legal adjudication of each item. Locators: eligibility questions; synthetic-image, status, adding-images, credential-loss and withdrawal answers.
The [six-step explanation](http[local research file] says the user selects media and generates the hash on their device; the original does not leave that device. Platforms match against their systems and remove matching material if it violates their intimate-image-abuse policies. That conditional policy assessment is a separate decision from the user's selection and submission. The explanation does not establish that every match causes removal. All six steps were read; no workflow was run.
Sharing permission and hash withdrawal
The [StopNCII privacy notice](http[local research file] visibly last updated January 2026, says hashes go to all current and future participating platforms; users cannot choose recipients. The notice identifies SWGfL as controller and describes international sharing. Its “Data retention and security” section requires valid case credentials for withdrawal and promises erasure from SWGfL systems plus instructions to industry partners to erase. It simultaneously preserves partners' ability to continue removing content that violates their policies. The summary uses “ask”; the full notice uses “instruct”. Neither wording proves delivery, compliance or restoration.
The notice separately describes personal-data access, rectification, erasure and objection rights, subject to exceptions, and a privacy complaint route followed by ICO escalation if unresolved. These general rights are not evidence of a working credential-recovery path or an adjudicated appeal against a platform's moderation. It says case numbers and hashed passwords remain while a case is active; this does not establish storage of plaintext passwords. Locators: Parts 1–2, “Who we share your data with”, “Data retention and security”, “Your Rights” and “Complaints”.
The [SWGfL privacy policy](http[local research file] visibly updated May 2026, repeats the erasure/instruction promise and continuing-removal reservation in its StopNCII section. Its recipient sentence mentions platforms signed up at upload; the more specific StopNCII notice and FAQ expressly cover future partners too. The general policy's rectification/erasure/consent sections describe conditional data rights and normally a one-month response to rights requests. They do not specify a recipient hash-deletion acknowledgement or a platform restoration procedure. Read locators: StopNCII section; general “Your Rights”. The shared original was reused, not reacquired.
An express right to keep removing offending content should not be silently converted into permission to retain the withdrawn StopNCII reference unchanged. Conversely, an instruction to erase a reference should not be converted into a promise to restore previously removed content or an affected account. The user documents read here provide neither a worked withdrawal trace nor a recipient acknowledgement deadline. The separate API/partner lane may refine those operational duties; this is not a programme-wide finding that no such protocol exists.
Which terms govern what
The StopNCII privacy notice incorporates [SWGfL Website Terms of Use](http[local research file] that page expressly lists StopNCII among its sites. These are general website terms, including temporary service access, amendment/suspension rights, truthful registration information and possible registration termination for noncompliance. Its registration clause sets an adult age requirement. It points processing questions to privacy policies and acknowledges additional policies. The entire substantive page was read; no displayed revision date was identified. An original GET timed out; the successful reader extraction is retained instead. These general terms do not supply the separate partner data-sharing agreement or proof of a named user's termination.
One technical-description qualification is necessary: the FAQ collectively calls PDQ/PhotoDNA/MD5 “open-sourced”. That sentence is preserved as publisher wording, not adopted as a verified PhotoDNA licence finding; the earlier Microsoft licensing packet establishes why software and service permissions must be examined separately. No new algorithm or code audit was attempted.
Remaining discriminator and custody
The useful next record is a public, non-personal specification or worked audit connecting a case withdrawal to recipient delta processing, deletion acknowledgement and any separately retained policy basis for later enforcement. A user privacy request, withdrawal instruction and reversal of an enforcement action are different records. No individual case is needed to establish the governing schema, but none was sought here.
user-captures.json records exact URLs, observation times, scopes and hashes. Three original HTML pages were captured here: FAQ, StopNCII privacy and how-it-works. Root's SWGfL privacy original is shared with its exact hash. All four originals pass local hash checks. user-website-terms.reader.json identifies a reader extraction only, not original HTML. The ordinary timeout route is closed. Full substantive reader scopes and narrower retained-text checks are distinguished in the manifest. Two focused searches were used; the indexed creation form was not opened or used. Public API details, partner admission, operator funding and actual platform accounts remain in sibling lanes. No further acquisition is pending in this lane.