Deletion authority is deliberately separate from the public URL
The public link contains only the share slug. The delete URL adds a random token whose SHA-256 hash is stored with the chat. The plaintext token is returned to the client and saved in the local sidecar; it is not stored in the chat document as plaintext.
Opening the delete URL shows a confirmation step. Confirmed deletion removes the chat document and requests deletion of image blobs recorded for that share. The public route then returns not found.
Device revocation solves a different problem
A claimed device token can associate new uploads with an account and authorize updates to its shares. Revoking that device marks its current token unusable. The next skill upload starts with a fresh anonymous device identity and can be claimed again if desired.
Revocation does not delete earlier content. This prevents a lost or retired device from continuing to act, without unexpectedly destroying the historical shares already managed by the account.
Deletion cannot retract copies already received
Removing the hosted share stops future access through InstaShare, but it cannot erase screenshots, copied text, downloaded images, browser caches, search-engine copies, or other reproductions made while the link was available.