The chat gets all the worry. Yet the images are the more exposed part, they hang around longer, and they're the least covered by the fine print people actually read.
Where the file goes
A generated picture is saved to object storage and sent out via a content delivery network, the same plumbing ordinary websites use for their photos. Your gallery is simply an index of those files.
The question is how the file is protected, and the two usual answers aren't equal.
Signed or authenticated links. Either the link times out, or the server confirms your login before releasing the file. Take the address to another browser and you'll get an error.
Long, unguessable links. The file lives at an address nobody could realistically guess, yet anyone who has it can open the file, logged in or not, for as long as it exists.
The second is everywhere because it costs little and loads fast. It's not a crazy choice, since the address really can't be guessed. But the protection is secrecy of the link, not a lock. Once a link is forwarded, dropped in a chat or logged by a browser extension, it's public.
A quick check: open one of your images in its own tab, copy the URL, then paste it into a private or incognito window. If the picture appears, obscurity is its only protection. Worth knowing before you create anything you'd hate to have cut loose from your account.
Why deletion often skips them
Conversations and pictures usually live in different systems. A deletion routine aimed at the chat database doesn't automatically reach object storage, and the content network can hold cached copies for some time after the original disappears.
There's no need to assume bad intent. It's simply what you get when deletion is coded for the main database and the images are stored elsewhere.
Australian angle. Under the Privacy Act 1988, organisations covered by the Australian Privacy Principles must take reasonable steps to destroy or de-identify personal information once they no longer need it (APP 11.2), unless the law requires them to keep it. A photo of you counts as personal information. If a company brushes off a request, complain to it in writing first, and if you're unhappy with the reply, you can take it to the Office of the Australian Information Commissioner (OAIC). Whether a particular overseas app is covered is a separate question, so don't assume.
When you close an account, put the question directly: does this cover generated images, and how long until they're gone from storage and cache? The full process is in deleting an AI companion account.
Flagged images get kept
Pictures get scanned, by software and occasionally by staff. Whatever trips a flag is normally kept longer than routine content, and often excluded from deletion on purpose, as retaining it is how a company proves it enforces its rules.
This is routine and most policies disclose it, but it means an image that set off a filter is the likeliest to survive your account.
Two firm rules
Never upload a photo of a real person. That covers your partner, a celebrity and a stranger from a dating app. All credible operators ban it. In Australia, sending sexually explicit deepfakes of a real adult without consent is a federal criminal offence under the Criminal Code Amendment (Deepfake Sexual Material) Act 2024, and other places are following. It also leads fastest to a permanent ban that can't be appealed.
Practicality and ethics agree here: the person pictured hasn't consented to sit in your chat history, and that history is kept.
Expect the prompt to be stored with the image. The text you typed is normally kept next to the result, and it says much more about you than the picture does. People guard their photos and forget about their prompts.
If you want to keep them
Save anything you care about, and regard the in-app gallery as temporary. Apps rearrange storage, alter plans, clear media from dormant accounts and sometimes just lose files.
Then store them somewhere you actually control, and consider what that means. A camera roll that syncs to a family account, or backs up to a shared drive, just relocates the exposure.
What to check when choosing an app
When you're trying a free tier, add two checks to the consistency and latency tests:
- Do image links require you to be signed in? Use the private-window test above.
- Is there a bulk download, or a data export that includes media?
Apps putting the most effort into media, like Candy AI with images and voice in one subscription, or Secret Desires with images and short video, are where your collection will grow largest. So the link check pays off most there.
