File based data retention: Deletion is possible outside the software. How is it possible to “build in” safety?

Yes, in systems that can store locally on the HD of the user it is possible to set up two local user profiles. Then, for instance, the system stores data only on the profile the user cannot access.