Inventory the data first, then judge the risk

"What if they get breached" is usually asked as if the answer were a single number. It is not - a breach exposes exactly what was sitting in storage at the moment it happened, and that set is decided entirely by retention choices made long before any attacker showed up.

A breach does not create exposure, it reveals it

The instinct is to treat a breach as the event that causes the damage. It is more accurate to treat retention as the thing that sets the damage's ceiling, and the breach as the event that collects on it. A service holding nothing but a same-day cache has almost nothing for an intrusion to find. A service holding the original file indefinitely, a derived embedding, full result history and unredacted logs has all four available the moment someone gets in, and no part of that was decided during the incident - it was decided by product and infrastructure choices made months earlier. This is why the honest answer to "what would leak" is always "depends what they kept," and why that question is answerable in advance of any incident rather than only after one.

Working through the inventory

The original file, if still held. Whether the image itself is still in storage depends entirely on the retention window and whether deletion actually removes the bytes rather than just hiding them from your account - what "deleted" really means once a file has left your device covers the gap between those two outcomes, and it is the single biggest lever on this line item.

Derivatives - embeddings and thumbnails. Many services discard the original but keep the model's numeric representation of it, for re-scoring, deduplication or future training. Whether that embedding survives deletion of the photo it came from is worth checking on its own, because a policy that only addresses "the photo" can leave this line completely untouched, and some research has shown embeddings are not always as irreversible as they are assumed to be.

Account data and results. Email address, account creation date, and the history of scores and per-axis numbers tied to it. None of this is the image, and all of it is personal - a history of results over time says something about a person that a single result does not, and it is retained by nearly every service with an account system regardless of how it handles the image itself.

Payment records. If the tool is paid, a name and a payment method sit with the processor and often with the service's own billing records, which links an otherwise pseudonymous account to a real identity the moment it is checked out.

Logs. Server and CDN access logs record request URLs, timestamps and IP addresses as a matter of routine operations, usually under a retention policy set by an infrastructure team rather than the product's own privacy policy. What actually gets written down on a request is worth reading because a log breach can expose linkage - which IP requested which result, when - even in a scenario where the "photo storage" itself was never touched.

Why the same breach means different things at different services

Two services can suffer an identical intrusion technique and leak entirely different things, because the technique determines access, not content. A service that strips EXIF on ingest, deletes originals within a stated short window, purges CDN caches on deletion and rotates logs aggressively hands an intruder very little regardless of how the intrusion happened. A service that keeps everything indefinitely "in case it's useful" hands over everything it has, and the sophistication of the attack is irrelevant to that difference - it was set well before the attack occurred. This is the actual argument for treating retention as the security question, not a separate one: minimising what is kept is the only mitigation that works even against attacks nobody anticipated.

What you can check before trusting a service with this category of upload

A service worth trusting states its retention numbers specifically rather than in general language, and a policy that does this is answering the breach question in advance, whether or not it uses the word breach anywhere. Rate Cock publishes retention terms in these specific terms rather than a single blanket sentence, which is the standard worth expecting of anything in this category. Comparing several tools on exactly this axis, rather than on features or price, is close to what Penis Rater's tools coverage exists to do, and it is one of the few comparisons that predicts something real about risk. A commissioned human review carries a different exposure profile entirely - a written assessment and a name are not the same asset as a stored file and an embedding - and Rate Penis is direct about what a review retains on its own terms. None of this applies to a figure taken with a tape measure and never uploaded anywhere, which is the structural advantage a method Measure My Cock documents in detail has over anything that ever touches a server: there is nothing in the inventory above for a breach to find.

The full adversary picture - a breach alongside staff access, third parties and your own device - is worked through in the wider threat model for this category of upload, and retention is the thread that runs through nearly every line of it. Ask what a service keeps before asking whether it has ever been breached; the second question is a coin flip, the first one is not.