Protecting one copy protects one copy
A private-photo workflow can leave uncounted copies even when the vault itself works. A photo imported into a vault may still have an original in the camera roll, an editor export, or a copy in a message thread.
An audit makes these locations visible. Its duration and findings depend on the devices, apps, accounts, and sharing history involved.
Start at capture and follow forwards
Begin with how the item entered your control — the system camera, a download, a scan, a message attachment, or a vault camera. Each origin implies a different initial set of copies.
A system-camera photo begins in the camera roll and may be uploaded by enabled cloud settings before you move it. A vault-camera capture can take a shorter path. Knowing the origin tells you where to look first.
The locations people forget
Some copies are obvious and some are byproducts of ordinary use. The byproducts are the ones that survive an incomplete cleanup.
- Edited versions saved separately by a photo editor.
- Downloads folders holding a file you re-saved to view it.
- Message threads, in both directions, on your device and the recipient's.
- Cloud library copies uploaded automatically before you took any action.
- Trash and Recently Deleted, which are retention periods rather than deletions.
- System and app backups capturing the state at an earlier date.
Build the map, then act on it
- Identify the capture origin: system camera, download, scan, or vault camera.
- List every app that opened, edited, backed up, or shared the item.
- Check local folders, cloud libraries, messages, Trash, and any recipients.
- Decide for each copy whether to retain, move, revoke access to, or delete it.
- Record the decision, so the audit does not have to be repeated from scratch.
Assumptions that leave copies behind
- Deleting a gallery thumbnail and treating the item as gone.
- Assuming a recipient's copy disappears when you delete yours.
- Forgetting edited and downloaded versions created along the way.
A fictional example
Priya starts with a non-sensitive test: “Start with capture: system camera, downloaded file, scan, or vault camera.” Next, Priya follows the second check: “List every app that opened, edited, backed up, or shared it.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Deleting only the gallery thumbnail
- Assuming a recipient's copy follows your deletion
- Forgetting edited and downloaded versions
What this workflow does not change
- Deleting only the gallery thumbnail
- Assuming a recipient's copy follows your deletion
- Forgetting edited and downloaded versions
Questions people ask
Can moving to a vault remove all copies?
No. A vault controls the imported copy and any source deletion it explicitly performs; external copies require separate action.
Should I delete first?
Verify the protected copy and recovery path before removing an irreplaceable source.