Disappearing message don't work to prevent long-term private data retention

[martin-v]

• I have searched open and closed issues for duplicates
• I am submitting a bug report for existing functionality that does not work as intended
• I have read https://github.com/signalapp/Signal-Android/wiki/Submitting-useful-bug-reports
• This isn't a feature request or a discussion topic

---

Bug description

A a heavy Signal user for multiple years a have a shit-load of private data of a lot of people on my phone right now.
And also all my contacts (if they didn't mess with their backup) have a shit-load of private data from me.
I'm pretty sure that far more than 98% of the data that is older than 15 months is no longer useful in any case for one of the communication participants.
So their isn't any justification that this data still exists.

Disappearing message don't work, because they do not function retroactively.
This is important because:

• Relationships between people change, so my data retention policy with these people change.
• People are becoming more political and are therefore more in the focus of authorities.
• People move/visit to country with laws that force them to enter passwords.

Disappearing message time frame is to short for a lot of cases, e.g.

• Working together with people, e.g. what was the solution we agreed upon 3 weeks ago?
• What was his private address that he sent me 1 month ago when we agreed that I would visit him?
• I know we had this issue at the event last year, we chatted about it.

There are many more cases I can think of.
It is realy hard to think of good values for all of my contacts, but 1week is in almose all cases to short and infinite is definitv to long in all cases. It whould be good if it's posible that all messages disapear (retroactively) after 3, 6, 12 or 18 month depends on contact or group.

Steps to reproduce

• Using signal with contacts for a long time period
• The data collected over the years gets into the wrong hands
  • Some contacts maybe lost their phone without any good protection
  • Some contacts maybe get forced by authority's to enter their passwords
  • Crypto breaks after some years
  • ... feel free to think about the many other options
• The privacy was injured more than could be justified

Actual result: All my chat content stay forever (except my contacts mess with their backup)
Expected result: All my chat content disappears after a reasonable long time

Related #6219 #6814 #6197 #7324

[greyson-signal]

We don't have any plans to support bulk, unbounded, retroactive message deletion on other user's devices. It opens up a lot of vectors for abuse. As far as longer durations are concerned, it's tricky, because backups do not include disappearing messages. That can cause unexpected behavior for a user that set their timer to 18 months. Something that might be more reasonable is time-based message trimming. We already offer count-based message trimming in the storage settings.

Also, I would classify this as a feature request/discussion topic, so please continue this in the forum. Thanks!

[martin-v]

Simple alternative would be allow the disappearing message for more than 1 week? 1month and 3month? Then the existing disappearing message feature is not only for "burn after reading" usage. I'm understand that there a corner cases but they also exist if I use 1week.

This will not fix all the issues mentioned, but it will limit the shit-load of private data on a lot phones at least a bit.