Joining a federated service isn't quite like signing up to a website. Your posts don't sit in one place, delete is a request rather than an order, and the server you joined is one of thousands that might end up holding a copy. None of this is secret. It's just that nobody tends to mention it until after you've posted something you'd rather you hadn't.
So here's the model, and then a sandbox where you can break it yourself. Three minutes, give or take.
On a normal service your post is one row in one database, and deleting it means deleting that row. Federation doesn't work like that. Publishing means copying: your server hands a full copy to every other server with a reason to want one.
It gets written to your home server. Right now it exists in exactly one place, and deleting it really would be the end of it.
Your server works out who wants a copy: anywhere with a follower, a room participant, or a subscribed relay. Not the whole network. Just the interested parties.
Each of them stores its own independent copy. Other people's machines, other people's rules.
Your server drops its copy and asks everyone else to do the same. Most of them will. Nothing makes them, and some won't.
Assume anything you publish is permanently public. Not because people are acting in bad faith, but because there is no mechanism in the architecture that can promise removal. If that's not an acceptable risk for some particular thing, then don't post that thing.
I run all three here. They agree that copies travel. They disagree about who ends up holding one, and what your identity is tied to.
Copies go to: every server with at least one follower of yours.
Your identity: tied to the server. Moving means migrating, and your
old posts don't come with you.
Delete: a delete activity gets pushed out. Honoured by convention,
not by force.
Copies go to: every server with someone in the room. Room history is
replicated, not fetched on demand.
Your identity: tied to your homeserver, though the room outlives any
single one of them.
Delete: a redaction request. Encrypted rooms are unreadable to server
operators anyway, which is the far stronger protection.
Copies go to: whichever relays you or your readers push to. Relays
don't talk to each other, clients do the spreading.
Your identity: a keypair you hold. No server owns it, so there's
nothing to migrate.
Delete: a request a relay may honour. Anyone can run one and copy
freely, so assume they won't.
A client to try:
Vector,
an open-source private messenger built on Nostr.
Five objectives. The fourth is the interesting one, and you're supposed to fail it.
All of this runs in your browser. Nothing gets posted anywhere and no real server is contacted. archive.example is made up, though servers that behave exactly like it are not.
Yes, with your eyes open. The same property that makes deletion unenforceable is the one that stops anybody switching the network off, selling it, or quietly changing the deal. Nobody can deplatform the whole thing. That includes me.
If that trade sounds reasonable, the Mastodon instance takes open signups and the Nostr relay needs no account at all. And if something here needs removing, the reporting and takedown page explains what I can and can't actually do about it, which should read rather differently now.