Design Disappearing Messages

Ephemeral Messaging Scope and Interview Frame

Disappearing messages require deterministic expiry semantics across sender, receiver, and every linked device. The interview-grade solution must explain how TTL metadata is authored, propagated, indexed, enforced, and audited without blocking hot write paths.

Core design intent

• Maintain user trust by making expiry behavior predictable and verifiable.
• Preserve legal and abuse-report pathways without violating privacy promises.
• Keep online and offline devices convergent even under delayed delivery.

Implementation notes

• Note 1: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 2: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 3: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 4: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 5: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 6: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 7: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 8: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 9: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 10: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 11: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.
• Note 12: enforce monotonic message-state transitions with explicit tombstone events and replay-safe consumers.

Why interviewers care

Disappearing Messages interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

The failure that defines the design

The outage to narrate is the surviving copy. The message is deleted on the server at its TTL, but it lingers on a recipient's device that was offline at expiry, or in a backup, or in a push-notification preview, or in a cache — and the privacy promise the user relied on is silently broken. Deletion that is not complete across every copy is not deletion. The fix is the spine of the design: a TTL is authoritative metadata, an expiry scheduler fires deletion at the deadline, tombstones fan out to purge every device (offline ones on next sync), and crypto-shredding destroys the per-message key so even a copy you cannot reach becomes unreadable. State guaranteed multi-copy deletion with crypto-shred up front, because for disappearing messages the engineering problem is completeness of deletion, not the act of sending.