How Short-Lived Links Help Keep Photos Private

Short-lived photo links help protect private images by limiting how long a particular image address can be used. The main short lived photo links privacy benefit is a smaller window of access—not a promise that a photo can never be copied. Combined with private storage and account checks, expiring links let an authenticated app show your images without assigning them permanent public URLs.

For travelers, the distinction matters. Seeing a reference photo or Memory inside an app should not require making that image permanently available to anyone with its address. But the address is only one part of the privacy picture.

How Short-Lived Links Help Keep Photos Private

A short-lived signed link provides temporary access to an image that remains in private storage. “Signed” means the address carries authorization that the storage service can check, including its time limit.

In a typical authenticated access pattern, the app first establishes who is signed in. The service checks whether that account should have access to the requested image, then supplies a temporary address the app can use to display it. These are separate jobs: account checks decide who should receive access; the signed link enables the image to load.

According to the Unlocked Privacy Policy, references and Memories live in private object storage. Its API responses contain short-lived signed URLs, never storage object keys or permanent public URLs. The policy also says the service verifies sign-in credentials and determines the application user from that verified identity, rather than accepting a user ID chosen in a request.

That combination matters more than expiration alone. A temporary link is not a substitute for checking which account is asking for a private image.

Short lived photo links privacy: temporary access versus a public URL

An expiring link has a built-in time limit; a permanent public URL does not. A public address can remain usable without another account check unless access is changed or the image is removed.

A signed photo URL instead grants access for a limited period. Once that period ends, the same address no longer supplies valid authorization. The image can still exist privately, and an authorized app can obtain a fresh link when access is allowed.

This limits the usefulness of an old link that has been copied or exposed. It does not make the link harmless while it is valid. As general evaluation advice, treat signed photo URLs as sensitive: possession of a working link may be enough to retrieve the image before expiration.

Expiration also does not reach into someone else’s device and erase an image already downloaded or captured. Nor should you assume that signing out immediately invalidates every previously issued link. Unlocked’s supplied policy does not state an exact link lifetime or promise immediate revocation on sign-out.

Authentication and private storage must support expiration

Private image storage and reliable account checks provide the foundation for expiring links. If either is missing, a short deadline on an address cannot repair the wider access problem.

When evaluating any travel app, ask three separate questions:

• Where are the files kept? Look for an explicit statement about private storage, not simply a gallery described as private.
• Who can request access? Look for verified sign-in and checks that prevent one account from requesting another account’s content.
• Where might working links be exposed? Ask whether image addresses or image contents enter operational logs.

Unlocked documents private storage and verified account identity. It also says image bytes and signed URLs are not logged, and authentication headers and cookies are redacted from structured logs. Its production requirements include encrypted storage, private buckets, restricted service accounts, and encrypted network connections through TLS.

These are documented controls and operating requirements, not grounds for claiming that exposure is impossible. Travelers still need to protect their devices and sign-in methods, a responsibility also stated in the Unlocked Terms and Conditions.

Private viewing is part of the travel experience, not automatic publication

Displaying a Memory privately is different from choosing to publish it. An app needs a way to retrieve an image for its owner without treating that retrieval as a public-sharing decision.

Unlocked is a native travel app built around physical presence: visit a Landmark, Unlock it, choose a curated Experience, create a Memory, and bring it into My World. It is not a generic image generator or a public social network. Temporary image access supports that personal flow without requiring a permanently public image address.

The privacy policy says Unlocked does not automatically publish a gallery. Optional Public Passports are explicitly selected collections that can include individually selected Memories, with dates hidden by default. Public Memory requests recheck publication and deletion rather than exposing signed storage links.

Those are distinct access paths. A private image loading in your account and a Memory you deliberately select for publication should not be treated as the same event. Our guide to travel photos and privacy offers a broader starting point for considering those boundaries.

Private storage does not rule out service-provider processing

A photo can be privately stored and still be sent to a service provider for a requested task. Expiring image links do not explain or limit all such processing.

Unlocked’s policy states that creating a Memory sends reference images and any current-look photo to OpenAI. The accompanying information includes the selected Landmark and Experience, visit date or time-of-day context, and optional aesthetic instructions. This disclosure is separate from how the app later displays the finished Memory.

The policy describes a “Photo permission” sheet and recorded consent for that sharing, with withdrawal available in the Privacy screen. It also documents a configuration-dependent qualification: when consent enforcement is enabled, creation without consent is rejected; when disabled, the sheet is bypassed and the first creation records consent implicitly, without overwriting an explicit withdrawal.

That detail is a reason to read the consent terms rather than infer them from the words “private storage.” Likewise, the supplied sources do not establish a provider retention period or a no-training guarantee. Those assurances should not be inferred from link expiration.

Deletion must work separately from link expiration

Deleting an image and expiring its link are different actions. Expiration closes one temporary access route; deletion addresses the stored content and associated records.

Unlocked lets users remove one reference, all references, individual Memories, or the entire account. Its policy says individual Memory deletion immediately hides the image from product reads and removes feedback and creation provenance. The private image object is permanently removed, with durable worker retries if storage is unavailable.

A historical creation record remains for credits, referral qualification, onboarding suppression, and conversion reporting. Local caches are cleared on the deleting device and reconciled on other devices when they reconnect.

The policy explicitly separates these actions from limits affecting exported or shared copies, previously issued URLs, backups, and provider retention. “Deleted from the app” should therefore not be expanded into “every copy everywhere disappears immediately.”

Before uploading travel photos, look for a clear account of all four boundaries: who can obtain access, how long a link works, who processes the image, and what deletion removes. Use the AI travel photo privacy checklist alongside the privacy policy to identify any unanswered questions before choosing what to share.