Pinduoduo Deleted Your Photos. Google Deleted Pinduoduo.

In March 2023, users discovered something that should have been impossible: photos were disappearing from their phones, and the app blamed in public reporting was Pinduoduo. Security researchers and multiple media outlets reported that the app had engaged in overreach — including deleting users' photos. Google's response was swift and unusually blunt: it removed Pinduoduo from Google Play, citing malware.

Read that sequence again. An app deleted your photos. Then a platform deleted the app.

If you have ever thought "my photos are on my phone, so they are mine," that week was the moment that sentence broke.

"On My Phone" Does Not Mean "Under My Control"

Most people carry a quiet assumption: what sits on my device belongs to me, and nothing happens to it unless I do it. The Pinduoduo reports broke that assumption in public, but the underlying fact was true long before March 2023 and remains true now.

A phone is not a private room. It is a building full of tenants, and every app you install is a tenant with a key. When you grant an app "full photo access" or "all files access," you are not adjusting a setting. You are handing over a capability. In technical terms, that permission means the app can read, modify, or delete the things it covers. The fine print in a user agreement does not change that fact. The capability is the fact.

"I never pressed delete" is not the same as "nobody could delete it." If the capability sits in someone else's hands, the deletion is one decision away — yours or theirs.

The Cloud Sync Trap

The usual answer — "it's fine, everything syncs to the cloud" — makes the problem worse, not better. Cloud albums mirror your phone. Delete locally, and the cloud often follows. Corrupt the local copy, and the synced copy may follow too. A system designed for effortless synchronization is a system designed so that a single bad action propagates everywhere, instantly.

The same logic applies to every familiar fix. A USB drive in a drawer can be plugged in, reformatted, or lost. A NAS on your home network is reachable by everything else on that network, including the apps on your phone. Hiding files in a folder at home works until someone opens the folder. Each of these solutions shares one flaw: the thing you cannot afford to lose sits next to something that has the power to change it.

Hannah Arendt wrote that the trouble with modern life is not that we are watched, but that we stop noticing the arrangements we have already accepted. Granting full photo access to a shopping app is exactly that kind of arrangement — accepted in a second, forgotten in a minute, and paid for months later when something disappears.

The Problem Is Not One Company. It Is the Structure.

It would be comforting to treat the Pinduoduo episode as a story about one bad actor. It is not. The episode matters because it proved something structural in public: any app installed on your phone, holding full photo access, has the same capability by design. The question is never "would this company do that?" The question is "could it?" If the answer is yes, then your photos' survival depends on someone else's restraint, not on your control.

That is the wrong foundation for anything you cannot afford to be seen, changed, or lost. A promise not to touch something is not the same as being unable to touch it. Promises are revised. Capabilities are exercised. Platforms change their policies, companies change hands, apps update overnight — and the permission you granted two years ago quietly survives all of it.

The Only Structure That Holds: Nobody Has the Ability

This is where the logic turns simple. Something that must not be discovered, altered, or deleted cannot live in a place where someone else holds the ability to discover, alter, or delete it. It cannot live on a phone full of apps with photo access. It cannot live in a cloud that syncs deletions. It cannot live on a drive that anything on your network can reach.

Offline media has no permission list. It has no apps, no background processes, no sync, no remote wipe. Nothing on it can act without a human being physically holding it — and that is precisely the property that matters. Epicurus advised withdrawing from the crowd not out of fear, but because peace of mind comes from reducing the number of things that can disturb you. An offline drive is that advice in physical form: fewer hands, fewer systems, fewer chances for something to go wrong.

But a drive in a drawer is still a drive in a drawer — findable, movable, losable. That is why the last step is not a product but a process: entrusting the material to professionals whose entire job is custody. It is received, numbered, sealed, verified by two people, and photographed on intake. It is stored by dedicated custodians, checked by default only through a semi-annual visual inspection of the seal and appearance, with a photo and zero contact — enhanced checks happen only with the client's written opt-in. Nobody opens it. Nobody edits it. Nobody can reach it from a phone, a cloud dashboard, or another continent.

That is the difference between "we promise not to touch it" and "we structurally cannot touch it." The first is a policy. The second is a fact — and facts, unlike policies, do not get updated overnight.

So check your phone tonight. Look at which apps hold full photo access. Each one is a pair of hands on things you thought were yours alone. The question is not whether those hands will move. The question is whether you are comfortable living with the fact that they can.