What Truthring will keep, and for how long
This is the first question consumers ask and the first question a procurement team asks, which is why it has a page rather than a paragraph. The answer turns on a distinction most services never bother to draw.
A single check produces four separate things: the audio, the features derived from it, the verdict, and the Ringmark that identifies the analysis. They are held for four different lengths of time, deliberately. The audio is the most sensitive and will have the shortest life; the Ringmark is the least sensitive and will outlive the rest.
Every period on this page is unset. Truthring has not launched and the retention windows have not been decided. Rather than print a round figure that sounds responsible — thirty days is the usual choice, and it is usually chosen because it sounds responsible — each one is marked so you can see the difference between a policy and a placeholder. The design that surrounds those numbers is real, and it is described below.
Four things, four lifetimes
Treating a check as one indivisible record is what leads services into the trap of either keeping voice recordings far longer than they need to, or destroying the evidence that a result was ever issued. Separating the four objects avoids both.
| What it is | Why it is kept at all | How long |
|---|---|---|
| The audio The file you uploaded, unchanged. | Only so the analysis can run, and so a failed or disputed check can be re-run without asking you to find the file again. It is biometric material: it identifies a person by the sound of their voice. | [VERIFY: retention period not set] Shortest of the four. |
| Derived features The numerical measurements the engine computes. | To explain a verdict after the fact, and to investigate a suspected fault in the engine. Features are not audio and cannot be played, but some of them still describe a voice closely enough to be treated as personal data. | [VERIFY: retention period not set] Tied to the audio, deleted with it. |
| The verdict The answer, its confidence, the engine version, the quality assessment. | So a result can be reproduced, corrected or withdrawn later, and so an aggregate error rate can be published honestly rather than reconstructed from memory. | [VERIFY: retention period not set] Longer than the audio. |
| The Ringmark The reference code, and a one‑way hash of the file. | So a report handed to a third party can still be traced to a specific analysis of a specific file. The hash cannot be turned back into audio; it only confirms that a file someone else holds is the one we examined. | [VERIFY: retention period not set] Longest of the four. |
Account details, billing records and request logs are held under their own rules, described in the privacy policy. Billing records in particular are usually kept for a statutory period that has nothing to do with voice detection.
Why deleting a submission will not delete the result
When you delete a check, the audio and the derived features go. The verdict and the Ringmark stay. People sometimes read that as a service hedging, so it is worth setting out the reasoning, because it was a real argument and it went the other way at first.
A Truthring result is not private in the way a search history is private. It gets used. Somebody quotes it to a bank’s fraud team, attaches it to a story, or puts it in front of a disciplinary panel. The moment that happens there is a second party who has relied on the result and who is entitled to check that it is genuine and that it says what the person quoting it claims it says. If deleting a submission erased the verdict too, anyone could obtain a favourable result, circulate it, and then remove the only means anybody had of testing it. The person harmed by that is never the account holder.
Keeping the verdict costs very little in privacy terms. It is a short structured record: a probability, a confidence figure, an engine version, a timestamp, a quality band. On its own it says nothing about who was speaking. The audio, which is the part that identifies a human being, is exactly the part that goes. That is the trade, and we think it is the right way round.
If you want the record removed as well, ask and we will do it [VERIFY: record-erasure request process not built] It is not the default because it is not free of consequence: after an erasure, a report you have already given somebody can no longer be confirmed as ours. Anyone holding it is left with a document that cannot be checked, which is the situation this product exists to argue against. The reports page explains what verification is meant to give a recipient.
Four situations that change the answer
Checking without an account
An anonymous check produces the same four objects, but nothing links them to a person. There is no profile, no history and no login. That cuts both ways: there is nothing for you to sign in and delete, and if you lose the Ringmark we cannot find the result for you, because we have no way of knowing it was yours. How many anonymous checks will be allowed is [VERIFY: anonymous-use allowance not fixed]
Closing an account
Closing an account will remove the account and every piece of audio and derived feature attached to it, on the same reasoning as a single deletion. Verdicts and Ringmarks associated with the account will be detached from your identity rather than destroyed, unless you separately ask for erasure. The mechanics, including how long a closure takes to propagate through backups, are [VERIFY: account closure process not built]
retain=false on the API
For programmatic use, this parameter will instruct the engine to discard the audio and the features as soon as the response is written — no convenience window, no second chance to re‑run. The verdict and Ringmark come back in the response and are recorded. It is intended for callers who process high volumes on behalf of other people and have no business holding their voices. The API is not built yet.
Legal holds
A preservation obligation or a lawful order can suspend deletion of an identified item, and where that happens the automatic timer is stopped rather than allowed to erase material we are required to keep. It applies to specific items, never as a standing reason to retain everything. What we receive and what we produce will be counted on the transparency page.
Backups are the part everyone skips
Deletion from a live system is quick. Deletion from backups is not, because a backup is a frozen copy of a moment and you cannot reach into it to remove one file without breaking what a backup is for. The honest statement is that a deleted item can persist in backup media until the backup itself expires, and that we will state that expiry period rather than imply an instant erasure. [VERIFY: backup rotation period not set]
Our commitment is narrower and testable: backups will be encrypted, they will not be used to restore an individual deleted item, and the gap between a deletion request and the last surviving copy will be published as a number rather than described as “promptly”.
No certification stands behind any of this
Retention promises are usually verified by an auditor rather than taken on trust. Truthring has none. There is no SOC 2 report, no ISO 27001 certificate and no third‑party assessment of Lacewing Technologies or any of its products. What you have is a dated public commitment and the ability to hold us to it in writing. That is less than an attestation and we are not going to describe it as more. Security says the same thing at greater length.
Common questions
How long will Truthring keep my recording?
The period has not been set, and we are not going to invent one for a website. What is decided is the shape: the audio has the shortest life of the four things a check produces, and it is the only one of them that can identify a person by the sound of their voice. The number will appear here, dated, before the service opens.
If I delete my submission, does the result disappear too?
No, and that is deliberate. Deleting a submission removes the audio and the derived features. The verdict and the Ringmark survive, so a result somebody has already acted on stays checkable. If you want the record gone as well, that is a separate request and we will honour it, but you should understand what it costs: anyone holding a copy of your report loses the ability to confirm it came from us.
Can I use Truthring without creating an account?
The intention is that a small number of checks require no account. An anonymous check leaves no profile to attach a history to, which means there is nothing for you to log back in and delete, and no way for us to restore a result you lose. Whether the free allowance survives launch is not yet fixed.
What does retain=false do on the API?
It is the instruction that the audio and its derived features are discarded the moment the response is written, rather than surviving any convenience window. The verdict and the Ringmark are still returned to you and still recorded. The parameter is described in the API documentation and is not implemented yet, because the API is not built.
Does a legal hold override deletion?
It can. If material is subject to a preservation obligation or a lawful order that we cannot resist, deletion of that specific item is suspended until the obligation ends, and no automatic timer will quietly erase it in the meantime. This is a narrow exception applied to identified items, never a general licence to keep everything.
Results and reports
Elsewhere
Reviewed