A rule on a bucket, not a person pressing delete

A privacy policy that says "we delete your photo after 30 days" is describing a configuration, not a promise someone keeps by hand. Almost every service storing uploaded images uses object storage - Amazon S3, Google Cloud Storage, Cloudflare R2 and equivalents - and the actual deletion happens because a lifecycle rule attached to that storage says to, on a schedule nobody re-checks. Understanding what a lifecycle rule is turns a vague sentence in a policy into something checkable in principle, even when it is not checkable in practice from outside.

What object storage is, briefly

Object storage holds files as opaque objects under keys, rather than in a filesystem with folders a person browses. A photo uploaded to a rating tool typically lands in a bucket as one object, often alongside a handful of related objects: a thumbnail, a derived crop, sometimes a copy at a different resolution for different parts of the interface. None of these are automatically linked for deletion purposes - each is its own object, and each needs its own rule or its own explicit delete call to actually go away.

What a lifecycle rule actually does

A lifecycle rule is a policy set on a bucket, or a prefix within one, that tells the storage system to act on objects automatically once a condition is met - most commonly, "delete objects older than N days" or "move objects older than N days to cheaper archival storage first, then delete them after M more." This runs on the storage provider's own schedule, independent of the application, independent of whether anyone remembers the rule exists, and independent of your account status. It is genuinely more reliable than an application manually deleting rows, because there is no code path to have a bug in - the rule either exists and runs, or it does not exist and nothing expires.

Why the setting is the real policy

This is why the number in a lifecycle rule is a more honest description of retention than the sentence in a privacy policy summarising it. A policy that says "processed images are retained for 30 days" is, if the engineering matches the wording, describing a lifecycle rule set to 30 days on the bucket holding processed images. The two can drift apart: a rule left at a default 90 days after a policy was updated to promise 30 says "processing error," not malice, but the object still sits for 90 days regardless of what the policy page states. This is also where the caveat about derived files matters - a thumbnail generated from an upload can live in a different bucket with a different rule, or no rule at all, and a policy describing "your photo" rarely specifies whether it means every derived copy or just the original.

What this does not cover

A lifecycle rule expires an object from the primary bucket. It says nothing about a copy that made it into a backup, a CDN edge cache, or a log line recording the object's key - what "deleted" actually means once those other copies are accounted for is the larger question this piece is one part of. How a CDN edge keeps serving a cached copy for a while after the origin object is gone is its own mechanism, covered in CDN caches and image copies. It also says nothing about an embedding derived from the image, which is a separate artefact stored separately and, unless explicitly covered, can easily outlive the source file's own lifecycle rule. What actually happens to a photo you upload, from the moment it arrives to the moment any of these rules fire, is the wider path this piece sits inside.

What a good disclosure looks like

The useful version of a retention claim names the object class and the number, not just a headline duration: "uploaded photos: 30-day lifecycle rule; derived embeddings: retained until account deletion" is a specific, checkable-in-principle claim, where "we don't keep your data longer than necessary" is not a claim at all. Rate Cock is worth using as a benchmark for what a specific disclosure reads like, since specificity here is the entire test of whether a privacy sentence means anything. Comparing tools on exactly this kind of specificity is worthwhile before assuming any two "we delete after processing" claims mean the same retention window - Penis Rater's comparison of tool practices treats this as a real axis rather than a checkbox. A commissioned human review runs on a different storage model entirely, closer to a case file than an automated bucket, and how that side handles retention is worth reading separately rather than assumed to match. None of it applies to a measurement taken by hand, since Measure My Cock's method never creates an object to expire in the first place.