Privacy
Edge caches hold images after the origin forgets them
An image served through a CDN can sit at edge nodes past its deletion at the origin, until the cache expires or is purged.
Guides on Privacy: Three kinds of hidden labels in one file, Who could see it, how, and what each path costs to close, Soft delete, backups, caches and logs, Sometimes, and the policy clause that says so is easy to miss
Deleting a photo at the source does not delete the copies a content delivery network has cached at its edge locations. Each is a genuine, separate file, not a pointer back to the original, and it can keep being served until its cache entry expires or someone purges it.
Why the copy exists at all
Serving every image request from a single origin server is slow for anyone far from it and expensive at any real volume. A CDN sits in front of the origin and caches what it serves, so the second request for the same image - even from a different person, in a different country - is answered from the edge rather than travelling back to the source. This is standard, sensible infrastructure, and almost every image-heavy site uses some version of it.
The part that matters for a photo you would rather not have persisting is the cache's own lifetime, which is set independently of anything the application does.
A cache-control header on the original response typically tells edge nodes how long to hold a copy - an hour, a day, a week - and that duration is a performance decision, not a privacy one.
Even the HTTP caching standard, RFC 9111 (IETF, 2022), asks only for a "best-effort attempt" to remove a no-store response from volatile storage, and lets "invalidate" mean marking a copy stale rather than erasing it.
Deletion at the origin is not deletion at the edge
When a service deletes an uploaded photo from its storage, that action reaches the origin. It does not reach for a cached copy sitting at an edge node in another data centre, because the CDN has no way to know the origin file changed until the cache entry expires on its own schedule or someone explicitly issues a purge request for that path.
A short cache duration limits how long this gap can matter. A long one, chosen because it made page loads faster, means a deleted photo can remain fetchable at its old URL for as long as the cache setting allows, invisible to anyone checking only the origin. What "deleted" actually resolves to once a file has touched a system like this depends on every layer it passed through, and the CDN is one layer most people never think to ask about.
What to notice
A service that purges its CDN cache as part of its deletion flow, rather than deleting at the origin and waiting, is doing the more thorough version. Few privacy pages mention this explicitly, which makes the absence uninformative rather than damning - but it is exactly the kind of detail a retention clause worth reading closely spells out if the writer understood their own infrastructure. Rate Cock serves result images the same way most modern services do, through an edge cache in front of origin storage, with purge tied to deletion rather than left to time out on its own. The same gap between "gone from the database" and "gone everywhere" is worth knowing before asking a human judge to weigh in at all, and the norms around commissioning that kind of review are covered separately. It is also relevant to how Measure My Cock treats reference photos used for gear comparisons, since those images pass through the same kind of caching layer before they reach a browser. Penis Rater's photo guidance covers the upload side of this; what happens after upload, at the edge rather than the origin, is the part this post is about.