Say Which Kind of Delete This Is

Trust, Privacy & Ethics · destructive actions, privacy, undo

Updated 2026-08-04

Know that most deletes are soft deletes that hide rather than destroy, and that a hard delete is a different operation. A record marked as deleted disappears from the interface and remains in the database, which is what makes restoring possible and what makes the word delete misleading.
Use different words for the two actions. Move to trash and Delete permanently describe different outcomes, and calling both of them delete is how users discover their data still exists.
Say what remains after a hide, and for how long. Thirty days in trash is a useful promise, and an unstated retention period is an unpleasant discovery.
Be accurate about what support can recover. If a hidden record can be restored by staff, users are entitled to know that before they choose it as their privacy control.
Make permanent actually permanent, and confirm it differently. The irreversible action deserves a distinct confirmation, not the same dialog with a different verb.
Explain what a delete does not remove, because it usually leaves things behind:

Never present a hide as a legal erasure. A request to delete personal data means destroy, and a deleted flag does not satisfy it.
Show the trash rather than hiding it. Deleted items that are invisible until support mentions them are a privacy problem and a storage bill nobody understands.

Delete is the word users trust most and products honor least, so the interface has to say which of the two things it is doing.