Data Retention Statement

Effective July 8, 2026 · Version 1.1 · Operated by LiberaVoice LLC (Ohio)

This page explains, in plain terms, how long SpeechBuddy keeps each category of your data — and why. It's a companion to the Privacy Policy and gets the same version-bump-and-notify treatment for material changes.

The short version. Almost everything stays until you delete your account. Two specific categories — support-agent conversations and error logs — expire automatically after 180 and 90 days, because they can carry sensitive text and we don't need them long-term. Session cookies and password-reset links expire on their own timers.

1. Kept for the life of your account

SpeechBuddy is a communication tool that gets more useful the longer you use it. Progress charts, longitudinal insights, matching accuracy — all get better with real history. Aggressively pruning non-sensitive telemetry would give up product value with no meaningful privacy benefit.

The following are kept for as long as your account exists and are deleted within 7 days of your deleting your account (or the individual item, where deletion is per-item):

Content you create

Data	Where it lives	How you delete it
Account (email hash, hashed password, username, display name, signup date)	`users` table	Settings → Danger Zone → Delete account
Phrase library (text, categories, image references)	`corrections`, `phrase_embeddings`, `presets`	Per-phrase deletion via Library, or full purge on account deletion
Voice recordings (audio files)	Encrypted volume storage; path in `phrase_embeddings.audio_filename`	Per-recording delete via detail modal, or full purge on account deletion
Voice model (per-user LoRA adapter, ~25 MB)	Per-user directory on encrypted volume	Rollback via Train tab, or full purge on account deletion
Caregiver notes (About-the-person free text)	`user_profile_notes`	Manual clear via Settings, or account deletion
Favorites & pin state	`presets`	Unpin, per-phrase delete, or account delete

Usage & telemetry that powers product features

Data	Why we keep it long-term
Utterance history — what was heard, what was matched, what was spoken	Powers the Progress tab, use-count and last-spoken stats on every phrase, and the longitudinal view a caregiver actually wants ("500 unique phrases over the last year"). No pruning; disclosed here honestly.
Match feedback (thumbs-up/down on a matched phrase)	High-value training signal for per-user matching accuracy. Low volume, real product value; kept for the life of the account.
Session metadata (mode, duration, speed-to-utterance) — no content	Enables A/B analysis of features like next-phrase suggestions, plus long-window WPM trends. No content, no sensitivity.
Suggestion impressions and outcomes (which suggestion was shown, tapped, or dismissed)	Feeds rule-tuning for coaching cards and next-phrase suggestions. Volume is small; long history helps rare events surface.
AI call ledger — endpoint, model, token counts, timestamp (no prompt content)	Cost auditing, runaway-cost detection (v365 anomaly agent needs a real baseline), and Anthropic-billing reconciliation. Zero content, zero sensitivity.
Operational-health log — agent runs, alert firings, incident history	Incident history for postmortems and health trending. No user content.
Admin audit log — privileged actions taken on your account	Standard accountability trail. Retained per usual audit-log practice.

2. Kept only as long as we need to

Two categories have real retention limits — because their content carries meaningful sensitivity and long-term retention would add risk without adding proportional value.

Data	Retention	Why the limit
Support-agent conversations (in-app chat with SpeechBuddy's help agent)	180 days	Caregivers type genuinely sensitive text into support chats — questions about a loved one's condition, frustrations, sometimes medical or mental-health context. 180 days is enough for us to debug open issues and retrain the support prompts; a longer window would sit on years of sensitive caregiver text with no clear benefit. Message rows delete along with the conversation.
Client-side error reports (JavaScript errors and network failures)	90 days	JavaScript stack traces and failed-request bodies can carry incidental personal information — URLs with query parameters, in-progress form input captured at the moment of crash. 90 days is enough for pattern analysis and post-incident triage; longer would compound the incidental-PII surface for no analytical gain.

3. Ephemeral — expires automatically

Data	Lifetime
Password-reset tokens	1 hour after issuance; unusable after that. Expired rows are automatically purged 7 days later.
Auth session cookies	30 days from last activity; you're signed out when it expires. Expired rows are automatically purged 7 days later.
Signed download URLs (for voice-recording downloads, exports, etc.)	Short, per-request lifetime. Expired rows purged as soon as they lapse.
Text-to-speech audio cache	Cached by (text, voice) — not by user — so common phrases replay instantly. Entries expire when unused; not a personal-data category.
Service worker cache	Static app assets cached on your device by your browser. Lives on your device, not on our servers.

4. How deletion works

When you delete a phrase, a recording, or your whole account, the delete is cascading — the primary record and every child row that depends on it are removed together. This includes:

The phrase text and its saved corrections
The associated voice recordings (both database rows and audio files on disk)
The phrase embedding used for matching
Favorites / pin state referencing the phrase
Suggestion-dismissal rows referencing the phrase

Full-account deletion additionally purges the caregiver notes, the LoRA voice model, utterance history, session logs, telemetry, and support-agent conversations. Backups are overwritten on our normal rotation, so a deleted account will not persist in backups longer than 30 days.

5. Custom retention windows

Two categories have per-user overrides available in Settings for caregivers who want a tighter window than the account-life default:

Match log — how long we keep detailed per-attempt matching data. Default: keep until account deletion. Adjustable to any positive number of days, or 0 to keep forever.
AI activity log — how long we keep the endpoint / token-count ledger. Default: keep until account deletion. Adjustable to any positive number of days, or 0 to keep forever.

Both are non-content categories, so most caregivers won't need to change them. The controls exist so a caregiver who wants belt-and-suspenders privacy can shorten either one without waiting for us.

6. What can survive account deletion (and why)

A minimal residue of your usage may remain after account deletion, in strictly limited ways:

Aggregated, de-identified statistics — like "median session length across all users this month" — do not resolve back to you and are not deleted with your account.
Anonymized error logs — client_error_log rows have their user_id set to NULL on account deletion rather than being deleted outright, because trend analysis needs error counts to survive individual account changes. Once the user_id is NULL, the row is not linkable back to your account and is subject to the 90-day cap in Section 2.
Server access logs maintained by our hosting provider (Fly.io) may retain IP addresses and request paths for a short window under their own retention terms.

None of these residual records contain the content of what your daily user said or the voice of that user.

7. How to request an export

Ask for an export of Your Content at Speechbuddy33@gmail.com. We'll deliver a JSON archive of your account settings, phrase library, category assignments, and utterance history within 30 days. Voice recording exports are available on request as a ZIP of the underlying audio files.

8. Changes to this statement

If we materially change retention windows or add categories, we'll bump the version number at the top and notify you in-app and by email at least 14 days before the change takes effect.