I've just heard from a phone client that he'd 'saved' the photos from my private gallery on his phone. How stupid am I to think they weren't in lockdown??

All AW really does is try to make sure people have paid to see them and stop them simply doing 'right click, save image as..'

The latter is just a gesture - at least one browser can be told not to let the website see that the user has right clicked, for example - and there are about a dozen other ways that would work. But there is nothing they can do that's more than a gesture.

So if it's on the web, someone has a copy. Very probably several someones.