A security researcher, Karan Saini has found that Twitter doesn’t really remove direct messages from it’s servers even after you delete them.

Saini found many years old messages in a file from an archive of his data received through the website from accounts that were no longer on Twitter.

He also reported an identical bug, found a year before but did not disclose till now, that allowed him to use a since-deprecated API to regain direct messages even after a message was deleted from both the sender and the recipient though, the bug could not recover messages from suspended accounts.