What we keep,
and what we destroy.

This page used to say that everything expired after twenty-four hours. It was not true, and it had been on the site for months. Here is what is actually deleted, what is kept, and why the true version is a better promise than the one we had written.

An expiry you do not enforce
is a sentence, not a protection.

What is destroyed

Photographs and video sent between the two of you are hard-deleted within forty-eight hours of being sent — not of being opened. That is a scheduled job that reaches into storage and removes the object, not a flag on a row, and neither of you can switch it off.

Sign-in codes and pairing codes stop working after twenty-four hours and are single-use. That is the only twenty-four hour rule in the product, and it was never the one being described.

What is kept, and why

Your messages. The questions you have answered. What each of you has said yes to.

The reasoning is unglamorous. A conversation you cannot re-read is not a conversation, it is a notification history. And the overlap — the one mechanism the whole product is built around — is computed from two sets of answers. Delete the answers every night and you have a room neither of you can ever finish, which asks the same questions again on Thursday and calls that privacy.

So we keep them. The honest thing is to say so on the page where somebody is deciding whether to trust us.

The protection is not a clock

Here is the part the old sentence was obscuring, and it is stronger than the thing it claimed.

Your answers are not protected by being deleted later. They are protected by being unreadable across the pair, permanently. They live in a schema the application is not granted permission to select from. The only thing that ever comes out of it is the list you both said yes to.

Not a count of what you declined. Not an ordering that could be differenced. Not a subtle absence somebody could infer from. There is no screen in the product on which your partner could learn what you said no to, because there is no query that would return it — and that is enforced in the database rather than in the interface, which is the difference between a rule and a policy.

A timer protects you later.
A permission protects you now.

Why the wrong version was written

Because it sounds better, and because at some point somebody wrote the sentence before the mechanism existed and nobody went back. That is how almost every false claim in a privacy policy gets there — not deceit, just a good line that outlived its accuracy and was never re-read against the code.

It is worth saying plainly that this is the failure mode to watch for in any product making promises like these. Not villainy. Drift.

How to check us

Two things you can verify without taking our word for anything.

Send a photo and wait two days. It will be gone, and it will be gone whether or not it was opened.

Then go looking for a no. Answer a set in Desire, have your partner answer the same set differently, and try to work out from anywhere in the interface — a number, an order, a gap, a total — which ones they declined. If you can, we have a bug and we want to hear about it. That is a more useful test of a privacy claim than any sentence on this page, including these ones.

And when you leave

Unlinking or deleting removes it. Deleting ends the world for both people, because a world with one person in it is not a thing this product has — and a copy of a shared conversation kept by whoever left last is exactly the artefact this whole design exists to prevent.