What actually rides along in a photo file
Cameras write EXIF metadata into every file: capture timestamp, device make and model, lens and exposure settings, orientation. Phones add GPS coordinates when the camera has location permission. Editing apps may append their own history, and some formats carry embedded previews of earlier, uncropped versions.
None of this shows in the image itself. It shows to any app, service, or person that reads the file — which is what makes it easy to forget and easy to weaponize. The stalking and doxxing cases you read about often start with coordinates inside an innocently shared file.
Where metadata leaks — and where it doesn’t
The channel decides. Many messaging apps re-encode images on send and drop most metadata in the process. Email, AirDrop, cloud-drive shares, and generic uploads usually preserve the original file byte-for-byte. The same photo can be safe in one channel and revealing in another, so the only reliable rule is: strip first, then share.
iOS gives you two controls worth knowing: the share sheet’s Options row lets you turn Location off per share, and Settings can deny the camera location access permanently. Third-party "metadata remover" shortcuts and apps exist, but the built-in controls cover the common case.
What this means for a private photo collection
For photos that stay private, metadata is part of what you are protecting: coordinates of your home, a timeline of your movements, the device that took them. Inside an encrypted vault all of it is ciphertext. The vault cannot help with copies that left before you locked things down — old uploads, old shares, old sync targets keep whatever they got.
A practical audit for sensitive photos: check what carries location (swipe up on the photo), fix the camera permission going forward, move the collection into encrypted storage, and clean originals plus Recently Deleted. From then on, capture directly in the vault and metadata never touches the outside world.