Most people's instinct before trading in a phone is: factory reset, hand it over. On a modern iPhone or Android 10+ device, that instinct is close to correct — the reset destroys the encryption key stored in a hardware security chip, turning every byte still on the flash storage into unreadable noise. But there's a gap the reset doesn't close: the cloud. Photos you synced to iCloud Photos or Google Photos are still there, on Apple's or Google's servers, completely unaffected by what you did to the hardware. Sensitive photos need to be handled before the cloud sync cycle runs — not after.
What a factory reset actually does
On a modern iPhone, "Erase All Content and Settings" uses a technique called cryptographic erasure. The device doesn't overwrite every file — that would take minutes on a 256 GB phone. Instead, it destroys the master encryption key stored in the Secure Enclave, a dedicated security coprocessor that sits separately from the application processor and that the operating system itself cannot directly read. Without that key, every file remaining on the device's flash storage is permanently indecipherable. This architecture has been in place since the iPhone 5s and iOS 7 (the A7 chip, introduced in 2013), and Apple documents it in their Platform Security Guide.
On Android, the picture is similar for devices that launched with Android 10 or later (2019 onwards). Android 10 mandated file-based encryption on all new devices. Factory reset discards the encryption keys from hardware-backed secure storage — on Pixel phones, that's Google's Titan M2 chip; on other Android devices, ARM TrustZone or equivalent. The result is the same: data on the device becomes cryptographically inaccessible.
Older Android devices are a different story. Research from the University of Cambridge in 2015 tested Android 2.3 through 4.3 handsets and found recoverable data on every tested device after factory reset — contacts, photos, and in most cases, authentication tokens. Those devices were often not encrypted by default, so the reset was closer to a format than an erasure. If you're selling a phone more than five or six years old, verify that device encryption was enabled before trusting the reset. For anything running Android 10 or later, cryptographic erasure applies.
What a factory reset doesn't touch
The reset erases the device. It does not reach the cloud.
When you use iCloud Photos, every photo you take is uploaded to Apple's servers and stored there, separately from the copy on your phone. Erasing the iPhone signs the device out of your Apple ID — but the photos in iCloud stay exactly where they are. The same applies to Google Photos: the library lives in your Google account, not on the device, and factory reset doesn't affect it. The new owner cannot access your cloud account without your credentials — but your photos remain in Apple's or Google's cloud, syncing to any other device you sign into.
There's a subtlety with the native "Hidden" album on iPhone and similar features on Android: photos moved there are still in your iCloud Photos library and still sync. They're hidden from the main grid, not removed from the cloud, and not separately encrypted. Hiding a photo is not the same as making it private.
The specific problem with sensitive photos
The gap between "device wiped" and "photos gone" is widest for photos that have already synced to the cloud. The moment a photo is added to your camera roll on an iCloud-enabled device, it uploads — often within seconds over Wi-Fi. Reviewing your photos, deleting the sensitive ones, and then wiping the phone closes part of the gap, but deleted photos sit in a "Recently Deleted" folder for up to 30 days on both iOS and Android before permanent removal. If you delete a photo from your iPhone, it's still in iCloud's Recently Deleted for 30 days. You have to empty that folder explicitly.
A 2022 study of second-hand mobile phones from the UK resale market found that nearly half of devices showed no erasure attempt at all — the sellers simply handed them over. Around 20% of devices contained enough personal detail to identify the previous owner. These weren't sophisticated forensic recoveries; they were devices with live accounts and accessible data.
Photos that were never in the camera roll — stored instead in a local-first encrypted vault — don't have this problem. They were never synced; there's no cloud copy to clean up. The vault is a single encrypted file on the device, and it travels with you to the new phone as an offline export.
The right sequence before you sell
- Move sensitive photos out of the gallery first — before sync runs. Import them into an encrypted local vault. With Kistvault, the vault file is stored entirely on-device; it never touches iCloud or Google Photos. Once photos are in the vault, they're in an AES-256-GCM encrypted container, not your camera roll, not syncing anywhere.
- Flush Recently Deleted. Both iOS and Android keep deleted photos for up to 30 days. On iPhone: Photos → Albums → Recently Deleted → Delete All. Then also check iCloud.com → Photos → Recently Deleted, since iCloud can hold items there even after the device shows them cleared. On Android, check the Trash folder in Google Photos and empty it.
- Export and transfer the vault. Export your vault as an offline
.kistfile and transfer it to your new phone via cable, AirDrop, or LAN transfer — no cloud involved. The file is AES-256-GCM encrypted; nothing inside is readable without your password. Verify it opens on the new device before wiping the old one. - Sign out of iCloud / Google. On iPhone: Settings → [your name] → Sign Out. On Android: Settings → Accounts → remove your Google account. This disables Find My / Find My Device, which must be off before most trade-in programs will accept the phone.
- iPhone only: deregister iMessage if you're switching to Android or retiring the number. If you skip this step, iMessages — including images — sent to your number by other iPhone users may be routed to your old device number instead of your new phone. Apple's official deregistration page is at support.apple.com/en-us/102455.
- Remove the SIM card and any microSD. Physical SIM, or eSIM profile — the phone's reset menu will prompt you about eSIM.
- Erase All Content and Settings (iPhone) or Factory Data Reset (Android). This destroys the hardware encryption key and returns the device to factory state. On modern hardware, this is the step that provides the actual security guarantee for the device itself — everything before it was about cleaning up the cloud and account layer.
What about the carrier or retailer's wipe?
Major trade-in programs — Apple, Samsung, Verizon, T-Mobile — all state in their terms and conditions that data deletion is the seller's responsibility. Samsung's terms explicitly disclaim liability for personal information "not removed prior to return." T-Mobile says it is "your sole responsibility to protect your privacy." Some programs perform an additional wipe as part of their inspection process, but that is not guaranteed, and it happens after the device has already left your hands. Do not rely on a third party to handle this.
The key idea
The factory reset closes one threat: a buyer recovering files from the device's flash storage. It doesn't close the cloud threat, because the cloud isn't on the device. For sensitive photos, the right model is: move them to a local-first vault before they ever sync, transfer the vault to the new phone as an encrypted file, then wipe. The photos are always with you, never in a cloud, and the old device leaves your hands clean.
Questions
Does factory reset delete photos from iCloud or Google Photos?
No. Erasing the device removes data from local storage and signs it out of your account — but photos already synced to iCloud Photos or Google Photos stay in the cloud. You need to manage cloud photos separately if you want them permanently gone from your account. Deleting from the device moves them to "Recently Deleted" for 30 days; permanently deleting from that folder removes them from the cloud too.
Is factory reset safe enough to sell a modern iPhone?
Yes, with two steps first. Sign out of iCloud and disable Find My before resetting — this removes Activation Lock and prevents the new owner getting stuck on the setup screen. Also flush your Recently Deleted album, since deleted photos remain there for up to 30 days and sync to iCloud. After those two steps, "Erase All Content and Settings" is genuinely effective: it destroys the encryption key stored in the Secure Enclave, making remaining data on the device unrecoverable.
What is the safest way to handle private photos before selling a phone?
Move sensitive photos out of your gallery — where they sync to iCloud or Google Photos — and into a local-first encrypted vault before the cloud sync cycle runs. With Kistvault, the vault file never touches any cloud: it stays on your device, encrypted with AES-256-GCM. Export the vault as an offline .kist file, transfer it to your new phone, then wipe the old one. The photos travel with you, encrypted, and nothing was ever in the cloud.