The moment right before you hand it over
You're about to sell your old phone on a marketplace, trade it in at a store, hand it down to a family member, or return a company device. You did the obvious things: deleted the photos you didn't want the next owner to see, then ran a factory reset. It feels done.
But there's a gap between "looks empty" and "actually gone everywhere it's ever been copied" — and that gap is exactly where most of these stories go wrong.
Where copies actually hide
Recently Deleted holds on for 30 days. Deleting a photo from your library doesn't erase it immediately — it moves to a Recently Deleted album, still recoverable, still syncing with the rest of your library, until it ages out or you empty it yourself.
iCloud Photos means "deleted here" isn't "deleted everywhere." If Photos sync is on across an old phone, an iPad, a Mac, and iCloud.com, all of them are mirrors of the same library. A factory reset wipes the device, not the account behind it — sign into the same Apple ID on a new phone and the whole library reappears.
Shared Albums and Family Sharing keep independent copies. Once a photo has been added to a Shared Album, everyone else in it has their own copy. Removing it from your library doesn't remove it from theirs.
Old computer backups don't know your phone was reset. A Finder/iTunes backup, or photos once exported over AirDrop or a USB cable, live on independently of whatever you do to the device afterward.
Erasing the device is necessary. It just isn't sufficient on its own if the account and the copies behind it are still holding everything.
A checklist that's more than "delete, then reset"
- Empty Recently Deleted manually (Photos → Albums → Recently Deleted → Select → Delete All) instead of trusting the 30-day timer.
- Turn off iCloud Photos for the device, or sign out of the account entirely, before you reset it.
- Review any Shared Albums you own or contribute to — leaving one doesn't delete it, and deleting one removes it for everyone in it, which is worth doing deliberately, not by accident.
- Check for old backups if the phone was ever connected to a computer — an external drive or a forgotten Time Machine backup counts too.
- Only then: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. Confirm the device also disappears from Find My afterward.
- If there are photos on it you actually want to keep, back them up somewhere you control first — don't assume the cloud copy will still be reachable once the device and account are gone.
Why this is worth doing carefully
None of this requires a sophisticated attacker. A phone bought secondhand that's still lingering in someone's Shared Album, or a family member never removed from one, is enough. The real risk here isn't dramatic — it's mundane: photos quietly outliving the device you thought contained them.
A library that was never tangled up in this to begin with
This whole checklist exists because Photos syncs everything into one shared trust boundary by design — your library, your backups, and your Shared Albums are all branches of the same tree. Privately's Locked Albums live outside of it: move a photo into one and it stops appearing in your regular Library, Camera Roll, and iCloud Photos sync entirely, kept instead in an on-device vault behind its own password. Handing off a device matters a lot less to a locked album, because it was never part of the library that travels with the account in the first place — though you should of course still export anything you want to keep before wiping a device.
If you're about to hand off a phone, it's worth also knowing exactly what's still embedded in the photos you're keeping — GPS, device details, timestamps, or seeing what a truly independent, encrypted album looks like next to the built-in Hidden album. And if you'd rather not run this whole checklist again next time, Privately is free to download — Locked Albums and its other Pro features are a straightforward subscription upgrade, no trial gimmicks.