A new report from TechCrunch today reveals that Twitter holds on to deleted direct messages for years, in some cases even for accounts that have been suspended or deactivated.

Security researcher Karan Saini discovered DMs on Twitter in an archived file that had previously been deleted. Twitter even retained messages from accounts that were deactivated or suspended.

Further, Saini previously found another bug that allowed him to access deleted Twitter DMs last year, but was just reported recently. That bug involved an API that has now been deprecated.

Saini told TC that he had “concerns” about how long Twitter was storing deleted data. The publication also confirmed Saini’s findings as they found messages that had been deleted when requesting the data that Twitter keeps. That’s despite Twitter stating that an account and its data will be deleted after a 30-day grace period once a user has deactivated their account.

But, in our tests, we could recover direct messages from years ago — including old messages that had since been lost to suspended or deleted accounts. By downloading your account’s data, it’s possible to download all of the data Twitter stores on you.

In related news, Twitter’s CEO, Jack Dorsey, yesterday said that the platform might offer a “clarify” feature instead of an outright edit option that the community has been wanting for a long time.

FTC: We use income earning auto affiliate links. More.

Check out 9to5Mac on YouTube for more Apple news:

You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

About the Author

Michael Potuck

Michael is an editor for 9to5Mac. Since joining in 2016 he has written more than 3,000 articles including breaking news, reviews, and detailed comparisons and tutorials.