You Deleted Those Photos. Your Cloud Provider Didn't.

The delete button is the most honest-looking lie in software. You press it, the thing disappears, and some ancient part of your brain feels the relief it was promised.

In May 2024, Apple gave a small army of iPhone users a reason to doubt that feeling. People updated to iOS 17.5 and found photos they had deleted years earlier back in their libraries. Not in Recently Deleted. Photos from 2021, from 2020, from a part of their lives they had deliberately ended — suddenly back on the screen, in color, in front of anyone who might be looking over a shoulder.

That is a nightmare scenario with a face: you deleted something because someone could see it, and now it is back, where someone can see it.

What Apple admitted

Apple put out a statement. The company said the reappearing photos came from corrupted database entries on the devices themselves — files that had never been properly cleared from local storage, resurfacing when the update rebuilt the database. Apple was emphatic: this had nothing to do with iCloud sync. Read that carefully, because Apple intended it as reassurance and it functions as an indictment. The problem is not the cloud. The problem is that "delete" on your own phone is a request routed through layers of software you never see, and somewhere in those layers, the request was never completed. A corrupted entry. A flag never flipped. A file left on the floor of a database while the software pointed somewhere else.

The truth is more ordinary and more troubling: the act of deleting was never in your hands. It was a request you filed with someone else's software stack, and the stack nodded and didn't finish the paperwork.

The chain of "delete"

Follow what actually happens when you tap delete on a phone photo. It is not a single action. It is a chain of requests, each owned by someone else:

Layer one: Recently Deleted. Your phone holds the photo for thirty days, in case you change your mind. Your "I want this gone" has already been reinterpreted as "I want this gone in thirty days, maybe."

Layer two: the cloud. If iCloud Photo Library is on, your deletion request gets synced, and the provider's copies follow the provider's retention policy. Soft deletion is industry standard — providers keep data after deletion to recover from mistakes, fraud, and outages. Your request enters a queue. Queues get processed on someone else's schedule.

Layer three: the backups. Cloud providers keep backups of their databases. Your deleted file may be gone from the live system while still sitting in a snapshot taken last Tuesday. Backups age out on the provider's timeline, not yours.

Layer four: the local database. This is the layer the iOS 17.5 incident exposed. Even the phone in your hand doesn't erase the file when you ask. The record is marked, the storage is freed eventually — and "eventually" is doing a lot of work, as corrupted database entries prove. Marking something for deletion is not deleting it. It is writing a note that says "delete me," and notes can be lost.

At every layer, you are asking permission from someone else's system to finish destroying something you supposedly own. Their engineers are perfectly rational about why soft deletion exists. But their rationality is about their operations, not your life. And when the database corrupts, the failure mode is not "your photo is gone" — it is "your photo is back."

Why this matters more than losing things

The Snowden revelations taught a generation that data they could not see could still be read by people they could not see. The 2021 controversy over Apple's proposed on-device CSAM scanning taught something sharper: that your phone, the object in your pocket, could be enlisted to examine your files on behalf of someone else's policy. Neither scandal was about malicious deletion. Both taught the same lesson: what lives inside somebody else's stack answers to somebody else's logic.

For most people, the fear is not the NSA. It is a shared iCloud family album. It is a phone left unlocked on a table. It is a subpoena in a divorce proceeding — legal discovery, in American courtrooms, treats "deleted" cloud data as data you simply have not yet been asked for. Deleted means one thing in your heart and another thing in a database, and the database's definition is the one a court will use.

That is why the iOS 17.5 incident stung more than a technical bug. People had deleted those photos because of someone — an ex, a family member, a future auditor of their past. The resurrection of the files was not a data problem. It was a betrayal of the act of letting go.

Seneca's version of this problem

Seneca had no cloud storage, but he understood the shape of this anxiety. His recurring advice, across the letters, is that peace comes from distinguishing what is up to you from what is not, and refusing to build your peace on the second kind. You cannot audit Apple's database integrity. You cannot inspect a cloud provider's backup retention. You cannot know, this evening, whether the thing you deleted is truly gone.

You can decide where the thing lives.

That is the whole of it, and it is unglamorous enough that nobody's keynote will ever lead with it. Delete is not an action. Delete is a property of custody. When the medium is in your hands, "delete" is a verb again. When it is in someone else's data center, it is a ticket in a queue.

Deletion is decided at the level of custody

Apple's fix presumably fixed the corrupted entries. But the structure that made the incident possible is not a bug. Soft deletion chains are how modern storage works, everywhere, by design. The thirty-day album, the sync queue, the backup snapshot, the database flag — none of it is accidental.

So the question is not "which provider deletes more thoroughly?" It is the one Seneca would ask: which part of this chain do you actually control?

The honest answer is none of it. You control the request. The request controls the software. The software controls the outcome, on its schedule, and sometimes it makes a mistake and hands your past back to you, on a Tuesday, in front of your spouse.

True deletion — the kind that lets you exhale — has exactly one precondition: the medium in someone's hands has to be your hands, or the hands of someone you chose and can hold to account. Everything else is a request, and requests can be misplaced.

Everkeep provides offline custody for hard drives you own and encrypt yourself. We number them, seal them, photograph them, and store them — two copies, two locations — and we never see inside. $199 per device slot per year.