Auto-deleting user uploads within 2 hours: how a privacy promise becomes infrastructure

When a privacy policy says "every upload is deleted within two hours," that sentence has to be backed by infrastructure, not intentions. This post walks through what implementing that promise actually looked like for a browser-based image tool — and the trade-offs nobody mentions when the roadmap says "privacy-first."

Why a hard retention window matters

Image tools touch sensitive casual uploads: product shots before launch, personal photos, screenshots with private data. A retention promise is only credible when deletion is enforced by the storage layer, not by a cleanup job someone can forget to deploy.

Make the storage layer enforce the deadline

The rule we landed on: nothing outlives its usefulness window by default.

1. Ephemeral object storage. Every upload lands in object storage with a lifecycle rule that expires the object two hours after creation. Deletion is not scheduled application code — it is a property of the storage class. If the application dies, the objects still expire.
2. Process in memory wherever possible. The background-removal pipeline runs per request; intermediate frames never touch persistent disk.
3. No analytics on image content. Logs carry event types and timings, never pixels or filenames.

The trade-offs

• No "your recent uploads" gallery. A server-side history would break the model. A session-scoped history held client-side is the honest version.
• Support gets harder. When a user reports a broken output, the artifact may already be gone. You learn to log structured errors instead of keeping evidence.
• Lifecycle rules are eventually consistent. "Within 2 hours" is an upper bound, not a precise instant — say exactly that in the policy, in the same units everywhere (no "60 minutes" vs "2 hours" drift).

The quarterly re-audit checklist

• Do lifecycle rules cover every bucket, including any replica?
• Do logs contain metadata only?
• Can the deletion promise be verified from the outside (policy page vs. observed behavior)?
• Is the retention window stated in identical units across product, policy, and docs?

Disclosure

Disclosure: I build CleanWhiteBG (https://cleanwhitebg.com), a free browser tool that removes image backgrounds and replaces them with white. This post comes from engineering that product; nothing here is sponsored. The user-facing summary of the discipline above: upload without signup, get a white-background result, and every upload auto-deletes within 2 hours.