# Support and content-removal operations Status: implemented intake and operator workflow. This document describes the software behavior; it is not a legal opinion and does not establish that a particular law applies to the operator. ## Separate queues Who Need Help deliberately separates three mechanisms: 1. An authenticated in-product report targets exactly one request, assignment, message, Activity, or Activity message and follows the existing audited trust-and-safety workflow. 2. A support request covers account access, technical issues, safety concerns, moderation appeals, privacy questions, data export, and account deletion. 3. A content-removal notice covers a precise item alleged to be illegal or to infringe a right. TAKE IT DOWN notices have a dedicated public form and a separate regime value in the removal queue. The operator workspace is `/support/operations`. It is protected by the same database-checked moderator or administrator authorization as the existing moderation workspace. Every creation and decision records an audit event. ## Public routes - `/support` — ordinary support. - `/account/delete` — external account-deletion request path suitable for use as the Google Play account-deletion web resource. - `/legal/content-removal` — general electronic notice-and-action intake. - `/legal/take-it-down` — dedicated intimate-visual-material removal intake. The request and Activity screens link to the general form with the exact local content URL prefilled. Only same-origin relative paths can be prefilled this way. The server validates one complete HTTP or HTTPS URL per line and accepts at most 20 locations in one notice. ## Contact verification and status access Public submissions display a reference but never expose the signed status token in the redirect. The private status link is sent to the contact email. Opening it marks that contact address as verified. An authenticated submission uses the confirmed account email and is verified immediately. Email-link verification establishes access to the mailbox, not government identity, authority to act for another person, or the truth of the claim. Operators must perform any additional verification appropriate to the requested action. In particular, an account-deletion request must not be fulfilled against another person's account merely because an address was typed into the form. Identity and contact fields may be omitted from a general report of sexual material involving a minor. Such a report still receives an urgent queue state, but no status email can be sent without a contact address. ## TAKE IT DOWN boundary The dedicated form accepts exact URLs and textual identification only. It does not accept file uploads and explicitly tells the submitter not to reproduce or email the intimate image or video. A submitted notice is marked for urgent review and records a review due time 48 hours after receipt. The current product does not accept user-uploaded images or videos. The presence of this preparedness workflow therefore does not claim that Who Need Help is a covered platform, that a submitted item satisfies the statutory definition, or that identical-copy detection exists. If media hosting is added, the operator must review the then-current law, implement safe media hashing and identical-copy handling where applicable, and test the entire removal path before enabling uploads. The primary US text currently requires a clear and conspicuous process and, for a valid request to a covered platform, removal of the depiction plus reasonable efforts concerning known identical copies as soon as possible and no later than 48 hours: - ## EU electronic notices The general form captures the elements listed in Article 16 of Regulation (EU) 2022/2065: a reasoned explanation, exact electronic location, submitter name and email subject to the child-sexual-abuse exception, and a good-faith accuracy statement. It sends an acknowledgement when email is available and sends the recorded decision after a verified-contact operator update. - Product implementation alone does not determine the service's legal classification, establishment, target markets, applicable national law, or redress obligations. Those remain launch decisions requiring jurisdiction- specific review. ## Email and operator notification `EMAIL_FROM_ADDRESS` remains the outbound sender. Optional `SUPPORT_INBOX_ADDRESS` has two separate effects: - outgoing support/removal messages use it as `Reply-To`; - it receives a metadata-only alert containing the reference, queue type, and protected operator URL when a case is created. The alert intentionally excludes the free-text report and reported URLs. The full record remains in the protected database queue. If the variable is empty, intake and reporter acknowledgement still work, but no operator inbox alert is sent. The configured inbox must be monitored operationally; the application cannot prove staffing or response availability. ## Account deletion and data export The web application and Android WebView expose the account-deletion request from account settings, and the public `/account/delete` route remains usable after an app is uninstalled. The workflow verifies the contact and creates an audited account-lifecycle request. Actual erasure/anonymization and export are not automated because the operator has not yet selected a jurisdiction-specific retention policy for safety, fraud, disputes, and legal records. An operator must not mark a request resolved until the applicable data action has actually been completed and communicated. Before public launch, legal review must define which linked records are erased, anonymized, or retained and for how long; only then should a destructive execution routine be implemented and tested against backups and relational constraints. Google Play's current policy requires both an in-app path and an external web resource when an app allows account creation: - ## Abuse controls and operational limits `support_request` and `content_removal_notice` are supported names in the shared PostgreSQL rate limiter. As with the other actions, no numeric policy is enabled unless the operator supplies measured values through `RATE_LIMIT_POLICIES_JSON`. CSRF protection, validation, exact URL limits, contact verification, staff authorization, and audit events apply regardless. The software does not provide emergency response. Threats to life or safety are prioritized in the queue, while every public safety screen continues to direct people in immediate danger to local emergency services.