Legal & Operational Transparency
Biometric Retention & Privacy Policy
OpenVoiceGate provides passwordless, privacy-preserving voice identity and returning-visitor recognition. This policy explains what audio data is collected, how biometric voiceprints are generated and encrypted, our written retention and destruction schedules, our server hosting locations, and how you can exercise your deletion rights at any time.
1. Operator Identity & Contact
The data controller and service operator responsible for OpenVoiceGate is:
Apollo Street Company
Render — Oregon Region (US West, Oregon, United States)
2. Biometric Data Notice & Collection Purpose
Under applicable privacy laws—including the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq., "BIPA"), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001, "CUBI"), and Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR" Article 9)—voice recordings and derived speaker embeddings constitute biometric data and biometric identifiers (voiceprints).
Purpose of Collection: When you choose to enter using voice, we process your spoken recording strictly to verify compliance with a timed, fresh challenge phrase and compute a statistical acoustic centroid (a 192-dimensional numerical vector). This template is compared against the active profile directory to recognize returning visitors without requiring passwords, emails, phone numbers, or corporate SSO accounts. We do not sell, lease, trade, or otherwise profit from biometric voiceprints.
3. Written Retention & Destruction Schedule
In accordance with 740 ILCS 14/15(a) and Tex. Bus. & Com. Code § 503.001(c)(1), the following is OpenVoiceGate's written schedule and guidelines for permanently destroying biometric identifiers and biometric information:
- 180-Day Normal Profile Expiry: All active voice profile templates automatically expire and are permanently deleted from primary storage 180 days after the visitor's most recent successful verification or interaction, unless earlier deletion is requested by the visitor.
- Active Ban Exception: If the service operator enables ban-template retention, an encrypted biometric template associated with an actively banned subject may be retained beyond deletion or normal 180-day expiry solely for the duration of the active ban, strictly for operator review and preventing ban evasion. Upon expiration or reversal of the ban, the retained template is permanently destroyed.
- Playable Audio (Default Zero Retention): Raw, playable audio is never saved by default. Audio is decoded in memory, checked for phrase correctness and embeddings, and immediately discarded upon completion of verification. If and only if the operator enables raw retention AND the visitor explicitly checks an optional consent checkbox, a copy of the new enrollment audio is stored encrypted at rest for a maximum of 7 days, after which it is permanently purged.
- Backup & Snapshot Lifecycle: Encrypted system database backups and filesystem snapshots follow a rolling 30-day retention schedule. Backups older than 30 days are permanently and automatically purged. Restored databases re-apply all expired row and profile cleanup immediately upon startup.
- Early Purpose Satisfaction & Destruction: When the initial purpose for collecting a voiceprint has been satisfied, or within 3 years of the individual's last interaction with the service (whichever occurs first), all biometric data is permanently deleted.
4. Geographic Restrictions (Illinois & Texas Exclusions)
Due to specific statutory requirements and private right of action provisions under the Illinois Biometric Information Privacy Act (BIPA) and Texas Capture or Use of Biometric Identifier Act (CUBI), OpenVoiceGate is not offered or available to individuals located in the State of Illinois or the State of Texas.
Prior to issuing any challenge phrase or initiating any microphone recording, OpenVoiceGate requires an explicit affirmative attestation
(not_il_tx: true). Any request without this attestation is immediately rejected with HTTP 403 Forbidden
(region_not_supported) before any audio data can be captured or transmitted.
5. Locator-Independent Deletion Rights & Procedure
You have the right to request deletion of your voice profile and any associated biometric data at any time.
If you have an active session or a stored browser locator (voice_key), you can click "Delete profile"
under "Your voice profile" in the application interface. Completing a fresh voice check will instantly remove your template from
the active gallery.
If you have lost your browser data, cleared cookies, changed devices, or cannot complete a voice verification check, you do not need
to possess a voice_key to request deletion. You may submit a deletion request locator-independently:
- Email: Send a deletion request to privacy@openvoicegate.com with the approximate date and time of your visit, the relying site URL, and any guest identifier or pseudonym you used.
-
API Endpoint: Submit a request via our programmatic deletion endpoint:
POST /v1/privacy/deletion-requestwith JSON payload{"contact": "your-email-or-handle", "details": "context"}.
Our operators will inspect the directory and purge matching profile records within 30 days without requiring biometric re-authentication.
6. Encryption, Security & Telemetry
Encryption at Rest: All biometric centroids and optional raw audio recordings are encrypted at rest using authenticated AES-256-GCM cryptography with rotating keys. Decrypted centroids are held ephemerally in RAM only during directory matching.
Anonymous Client Diagnostics: If microphone capture fails (e.g. silent audio or muted device), the client component
offers an optional anonymous diagnostic beacon (POST /v1/client-diagnostics). This endpoint records only coarse
daily counters (reason code, browser family, OS family, sample rate bucket, attempt bucket). It stores zero cookies, zero IP addresses,
zero ticket IDs, zero audio samples, and zero personal identifiers, and all aggregate daily counts are automatically deleted after 30 days.