Why Public Avatar URLs Break in Private Storage and Why Expiry Is Not Deletion

The article explains that marketplace avatars need an explicit access model, since a public delivery contract yields durable URLs while private objects require short-lived signed download links. It argues that an expired signed URL only means access has lapsed, not that the stored image was removed. The author recommends storing an opaque object key in the database rather than a signed URL, and generating fresh signed links per request. It also advises tracking access and retention as two separate clocks, so that deletion and reconciliation can be audited instead of appearing as rendering failures.