Retention windows have to be stated

What it is

Soft delete is not permanent insurance. The recoverable layer will actually destroy at some point, and that point has to be written where people can still use it: at delete time, in the recoverable list, in a notice as the deadline nears. Unstated, “I can still get it back” is treated as infinite, and the deadline becomes an undeclared hard delete. This entry is only about making the window visible. It is not about whether soft delete should exist, or where the entry sits.

Why it happens

Judgments of “still there” need an explicit time bound. Without a date, working memory fills in an optimistic default (“it should stay forever”), so people neither restore nor back up. If the approaching deadline is silent, recoverability fails quietly on the last day, and slips are often noticed after that quiet point. Stating the window turns “still undoable” from a vague belief into a planable difference: 30 days, until a date, oldest first when capacity fills. The rule may be capacity rather than calendar, but a capacity rule still has to be readable as “how much remains.”

Where it stops holding

When a legal deadline and a product deadline conflict, the surface writes the shorter one; it cannot promise the product window and then destroy early for compliance. Different types may have different windows; write them per type. A vague “will be deleted later” lets people apply the longest window to the shortest type. A user emptying the recoverable layer is immediate destroy; the window sentence at that moment becomes “permanently delete now.” When offline or cross-device clocks drift, use the server date and show that date; do not say “about a month.”

Applying it

• At successful delete, state how long it will be kept; each row in the recoverable list shows an expiry date, not a single sentence in a help article.
• Send one reminder that does not interrupt the main task before expiry, with the object name linking back to restore.
• When the window or capacity rule changes, honor the prior promise for objects already on the layer, or say clearly that destroy will come early.
• Verify by asking someone who just deleted “what is the last day I can get this back.” If they cannot name a date, or they say “forever,” the window was not stated.

Related

• Within the group: H3.08.1 Soft delete turns a point of no return into a delay · H3.08.3 Trash only works if people can find it
• Adjacent: H3.12 Undo window and scope · H8.14 Content lifecycle and archiving · H6.14 Account deletion and data erasure
• Search terms: retention period · trash expiry · soft delete