Zero Data Retention: The Privacy Promise Almost Nobody Checks

Two of the dictation apps I've audited for this site advertise zero data retention, and ship it switched off. Not hidden, not dishonest — the feature is real, it's in the settings, and until you go and turn it on, the claim on the homepage is true about the product and false about your account.

That gap is what this page is about. Twenty-plus privacy policies in, it's the single most common thing I find, and almost nobody checks for it — because checking means opening a settings screen rather than reading a landing page.

The direct answer: zero data retention (ZDR) is a data-handling commitment that a service won't store your inputs or outputs at rest once a request has been processed. Audio and text are held in memory long enough to produce a result, then discarded. Nothing is written to a database, nothing sits in a log for 30 days, and nothing survives to be searched, subpoenaed, breached, or fed into a training run. The term came out of enterprise AI contracts — OpenAI and Anthropic both grant it by approval to qualifying organizations — and has since been borrowed by consumer apps, where it means whatever the marketing page says it means.

Three things zero data retention does not mean, and all three get conflated in app copy:

• It's not “we don't sell your data.” Not selling is a promise about commerce. Zero retention is a promise about storage. A company can honestly do the first while retaining everything.
• It's not “we don't train on your data.” No-training is a promise about one use. Data can be retained for years and never used for training — and still be exposed in a breach or produced under a subpoena.
• It's not “encrypted end to end.” Encryption protects data in transit and at rest. Zero retention means there's no “at rest” to protect.

Below: what the term means precisely, the six contract clauses that quietly undo it, why voice is the worst category of data to be wrong about, and a five-question test you can run on any app in about ten minutes. Every policy quote here was checked against the live source on August 10, 2026.

The short version: only two architectures survive scrutiny — audio that's never sent, and audio that's sent under a verified zero-retention commitment. Everything else is a retention window you're trusting someone else to honor.

The Retention Ladder is the framework I use to place any voice app in one of five levels, from safest to worst. It exists because “private” and “secure” are marketing words, while retention level is a factual question with a checkable answer.

The jump that matters most is between levels 1 and 2. At level 1 there's no corpus. At level 2 there's a corpus with a timer on it — and a timer can be extended by a policy update, a legal hold, or an acquisition. The jump between 3 and 4 is smaller than it looks, because the language that permits level 3 usually permits level 4 as well.

Zero data retention started life as something a company's lawyers negotiated, and that origin explains most of the confusion around it now. Both of the largest AI providers still treat it as an approval-gated arrangement, not a default — which tells you how much work the phrase is doing when a consumer app puts it on a pricing page.

OpenAI states that data sent to its API hasn't been used to train or improve its models since March 1, 2023 unless you explicitly opt in, and that abuse-monitoring logs are retained for up to 30 days. Zero data retention is a separate arrangement: it excludes customer content from those abuse-monitoring logs and forces the store parameter to false on the chat and responses endpoints. It covers a specific endpoint list — including /v1/audio/transcriptions, which is the one that matters for voice — and excludes stateful endpoints such as /v1/assistants, /v1/threads, and /v1/vector_stores. You get it by arranging it with your account team, not by ticking a box (OpenAI data controls documentation).

Anthropic describes ZDR as an arrangement that some Claude Platform and Claude Code for Enterprise customers may hold “subject to Anthropic's approval,” under which prompts and responses aren't stored at rest after the response is returned. The published caveat is worth quoting because it's the honest shape of every real ZDR arrangement: Anthropic still retains User Safety classifier results in order to enforce its Usage Policy (Anthropic Privacy Center). We break the whole picture down in our guide to Claude API data retention, and cover the consumer side in is Claude safe.

Two things follow from this. First, real ZDR is narrow and documented: it names the endpoints it covers, the exceptions it keeps, and the approval it requires. Second, when a $10-a-month consumer app uses the same phrase with none of that specificity, the phrase is doing marketing work rather than legal work. That's the gap the rest of this article is about.

Six clauses account for almost every gap I've found between what a voice app says on its homepage and what its account settings actually do. None of them require the company to break its own terms. That's the point — agreeing to terms and conditions without reading them is what makes each one work.

1. The default-off toggle

The most common one by a wide margin. The app supports zero retention, and ships with it switched off, so the marketing claim is accurate and your account isn't covered by it.

• Wispr Flow: Privacy Mode is zero data retention, and per Wispr Flow's own Security Overview it's off by default for non-HIPAA users — when off, dictation data may be used to improve Wispr Flow. Signing Wispr's self-serve HIPAA BAA irreversibly locks Privacy Mode on, which tells you the company knows exactly which setting the promise depends on. In August 2026 a Wispr Flow team member published word-frequency analyses of user dictations, segmented by country, on LinkedIn — an illustration of what the default enables, not a breach of the stated policy.
• Aqua Voice: Privacy Mode is also off by default for individual subscribers. The privacy policy states verbatim that “for users with Privacy Mode disabled, we may securely store transcript data on our servers.”

2. The de-identified and aggregated carve-out

Retention and training promises are frequently scoped to personal data, then a separate clause exempts data that has been de-identified or aggregated. Otter.ai trains automatically on de-identified user data unless you find and flip the opt-out in account data controls — opt-out, not opt-in. For voice specifically the carve-out is weaker than it sounds, because the acoustic characteristics that make a recording useful for training are also the characteristics that identify the speaker.

3. The metadata and service-generated data carve-out

Content deletion and metadata retention are separate promises, and companies are careful to keep them separate. After Zoom's 2023 terms controversy, the revised position was that Zoom won't use audio, video or chat customer content to train its AI models without consent — while Zoom continued to assert ownership of “service-generated data” covering telemetry, product usage and diagnostics (Variety). In dictation apps the same split appears as session metadata that survives Privacy Mode: Aqua Voice's policy notes timestamps, device type and performance metrics may still be collected with Privacy Mode enabled.

4. The subprocessor gap

An app's retention promise binds the app, not the vendors behind it. Your effective privacy is the intersection of every perimeter your audio crosses. Voicy routes audio through its own servers and then to Groq, and states in its privacy policy that it enabled Groq's zero-data-retention setting — Groq's own default is a retention window. That's a good-faith configuration, and it's also self-attested with no audit behind it. Wispr Flow publishes a full subprocessor list naming Baseten for audio and OpenAI, Anthropic and Cerebras for text, which is more transparency than most peers offer; Aqua Voice's public policy lists service categories without naming vendors at all.

5. The promise that lives on the marketing page, not in the policy

Homepages aren't contracts. Voicy's homepage says “we do not use your recordings to train an AI model,” while neither its security policy nor its privacy policy contains any training language at all. Aqua Voice's privacy policy doesn't address AI training either way — the silence is itself the finding. When you evaluate an app, the only sentences that count are the ones in a document with a version number and an effective date.

6. The unilateral amendment clause

Nearly every terms of service reserves the right to change the terms, with continued use as your acceptance. This is the clause that makes the other five durable: today's zero-retention promise is only as good as tomorrow's revision, and revisions are announced by email at best. Zoom's disputed Section 10.4 was added in March 2023 and only noticed in August, five months later (TechCrunch). Nobody read the diff. Almost nobody ever does.

Notice what the six have in common: every one of them is defeated by an architecture where the audio never leaves your machine. Data that was never collected can't be re-scoped by an amendment, exempted as aggregated, or handed to a subprocessor.

Voice is the worst data to get retention wrong about because it's three sensitive things at once: a biometric identifier, a record of what you said, and — since generative audio got good — a template for impersonating you. You rotate a leaked password in a minute. You can't rotate your voice.

The law already treats your voice as biometric data

• Illinois BIPA lists voiceprints explicitly as biometric identifiers, and requires written notice of the purpose and duration of collection plus written consent before collection. Statutory damages run to $1,000 per negligent violation and $5,000 per intentional or reckless violation (740 ILCS 14).
• The GDPR defines biometric data in Article 4(14) as data resulting from specific technical processing relating to physical or behavioral characteristics that allows unique identification, and Article 9 makes biometric data processed for the purpose of uniquely identifying a person a special category requiring an explicit legal basis (GDPR Article 9).
• California's CCPA, as amended by the CPRA, includes biometric information in its definition of sensitive personal information, with a consumer right to limit its use (California Attorney General).

The enforcement is no longer theoretical

Three developments in the last eighteen months changed the risk profile of retained voice data:

• Apple's $95 million Siri settlement. Lopez v. Apple, filed in 2019 after The Guardian reported that contractors regularly heard confidential material in Siri recordings, received final approval on October 16, 2025. Class members could claim up to $20 per Siri-enabled device for unintended activations between September 17, 2014 and December 31, 2024, with payments issued from around January 23, 2026 (Courthouse News). The complaint was about human review of retained audio — a level-3 retention problem, not a training problem.
• The May 2026 voiceprint class actions. Illinois journalists, voice actors, podcasters and audiobook narrators filed a coordinated set of BIPA class actions against Adobe, Alphabet/Google, Amazon, Apple, ElevenLabs, Meta, Microsoft, NVIDIA and Samsung, alleging their voiceprints were extracted from publicly available recordings and used to train AI systems without consent (Loevy + Loevy, Capitol News Illinois).
• The Otter.ai litigation. In re Otter.AI Privacy Litigation (5:25-cv-06911, N.D. Cal.), consolidated from four suits filed in August and September 2025, alleges Otter recorded private conversations and trained AI on meeting data without all-participant consent, invoking the federal Wiretap Act, CIPA and biometric privacy statutes. No court has ruled on the merits (ZwillGen case analysis). Our full breakdown is in is Otter.ai safe.

Why dictation and note-taking apps are the sharp end of this

A smart speaker hears you order groceries. A dictation app hears you draft the thing you were most careful about writing. That asymmetry is the whole argument:

• The content is your most sensitive material by construction. People reach for dictation for long-form work: case notes, patient summaries, incident reports, therapy notes, salary conversations, source protection. See HIPAA-compliant dictation for the clinical version of this problem.
• The volume is enormous and continuous. A heavy dictation user produces hours of clean, close-mic, single-speaker audio every week — close to the ideal training corpus for both speech recognition and voice synthesis.
• Note-takers capture other people, who never agreed to anything. A meeting assistant records every participant. Consent obtained from the host doesn't extend to the room, which is precisely the theory being litigated against Otter.
• Your voice is the credential. Retained audio of you speaking naturally at length is the raw material for synthetic-voice impersonation, and banks and helpdesks still use voice as an authentication factor.

So the requirement for a voice app is stricter than for a text tool. It's not enough that the company won't sell your data. The correct standard is that your voice should never enter a training set or an analytics corpus at all — which in practice means level 0 or a verified level 1, and nothing lower. Our voice data privacy guide covers what apps collect beyond the audio itself.

Zero retention and on-device processing solve overlapping problems with different guarantees. Zero retention is a promise a company makes about data it holds. On-device processing removes the need for the promise. Both are legitimate; they fail in different ways.

The honest trade-off: on-device transcription is bounded by the hardware in front of you, which is why cloud modes exist at all. Zero-retention cloud gets you server-class models with no stored corpus — but it's a commitment, and commitments depend on the party making them. If your work is privileged, clinical, or carries source-protection obligations, prefer level 0 and treat level 1 as the fallback for the machines that can't run a local model. Our cloud vs. local dictation comparison goes deeper on the speed and accuracy side of that choice.

For reference, this is how Voibe — the app we build — is structured, since it's the example I know line by line. On Apple Silicon Macs, on-device mode runs Whisper locally and the privacy policy states: “No audio is transmitted to our servers at any point.” The private cloud mode, which powers Voibe on Windows and on Intel Macs, states that audio is “transcribed by open-source models, and deleted the moment transcription completes,” with the resulting text “never stored and never used to train AI models.” We wrote up why that constraint shaped the product in the Windows and zero-retention cloud launch post. Pricing is $7.50/mo, $59/yr, or $149 once for a lifetime license — against a cloud-only peer like Aqua Voice Pro at $96/yr, three years costs $288 versus Voibe's $149, a $139 saving of 48%.

The Five-Question Zero-Retention Test is a verification sequence you can run on any voice app before you trust it with real work. It takes about ten minutes, and it's deliberately ordered so that a failure early on saves you the rest.

1. Is the claim in a policy, or only on the homepage? Open the privacy policy and the terms, and search for “retention,” “train,” and “improve.” If the no-training promise appears only in marketing copy, it isn't a commitment you could ever enforce. Check for a version number and an effective date while you're there — a policy with neither hasn't been maintained.
2. Is the privacy setting on by default — on your account, on this device? Don't infer this from the website. Open the app's settings and look. Then check the second device you dictate from. This single step separates most of the field.
3. Who else touches the audio? Find the subprocessor list. A named list — which vendor does speech recognition, which does text cleanup, which region hosts it — is a strong signal. Generic categories such as “hosting services and data analytics” with no vendor names mean you can't evaluate the chain at all.
4. What is excluded from the promise? Look specifically for metadata, session data, de-identified or aggregated data, and abuse-monitoring logs. A real zero-retention statement names its exceptions. One with no exceptions is usually unexamined rather than airtight.
5. Is there a mode where the audio never leaves the machine? If yes, you can stop evaluating retention policy for that mode, because there's nothing to retain. If no, your privacy ceiling is whatever the company's current terms allow, revisable by the amendment clause.

Here is the test applied to tools we've already documented, so you can see what each answer looks like in practice:

One nuance that question 5 doesn't catch on its own: “on-device” is a claim about transmission, not about what gets written to your own disk. Superwhisper saves audio recordings to local disk by default, and 23 users have voted on its public feedback board to make that opt-in. Local recordings are a far smaller exposure than a vendor-side corpus — they are on hardware you control — but they are still a file someone else could read, and worth turning off in settings if your machine is shared or backed up somewhere you haven't thought about.

We maintain the wider version of this comparison in the AI Privacy Tracker, and the per-tool detail lives in the dictation privacy hub. If a tool you use isn't covered there, run the five questions yourself — the answers are all public, they are just not on the page the ads point to.

What zero data retention means for you depends on what you dictate. The framework is the same; the threshold moves.

• Lawyers and anyone handling privileged material: level 0 only. Retained audio at a third party is discoverable and creates a waiver argument you don't want to have. Start with dictation software for lawyers.
• Clinicians and anyone touching PHI: level 0, or level 1 under a signed BAA — and confirm the BAA locks the privacy setting on rather than merely permitting it. See HIPAA dictation requirements.
• Journalists and researchers with source obligations: level 0. The threat model includes subpoena of the vendor, not just breach, and only “nothing was collected” answers a subpoena cleanly.
• Developers dictating into an IDE: level 0 or 1. Your dictation contains internal names, credentials spoken aloud by accident, and unreleased architecture. See dictation software for developers.
• Everyone else: level 1 or better is a reasonable bar, and level 2 is defensible for routine work — provided you know that's what you chose. The failure mode this article is about isn't choosing level 2. It's believing you're at level 1 when your account is at level 4.

Two practical habits are worth more than any single product choice. First, check the privacy setting on every device after every major app update — defaults get reset, and new devices start fresh. Second, when a terms-of-service update email arrives, search the new version for “train” and “retention” before clicking through. Zoom's clause sat unnoticed for five months because nobody did that.

If you want the architecture rather than the promise, try Voibe for free — on-device mode on Apple Silicon means the retention question never arises. Our getting started guide walks through the setup.

Basics

What is zero data retention in simple terms? Zero data retention means a service processes your input and then keeps nothing. Your audio and the resulting text exist in memory long enough to produce a result and aren't written to storage afterwards. There's no database row, no log entry, and nothing left for a breach or a subpoena to reach.

Is zero data retention the same as end-to-end encryption? No. End-to-end encryption protects data while it moves and while it sits in storage. Zero data retention means there's no stored copy to protect. A service can be fully encrypted and still keep your voice recordings for years.

Does zero data retention mean the company can't train on my data? In practice yes, because training requires a stored corpus and zero retention means no corpus exists. But the two are separate commitments, and a no-training promise on its own says nothing about how long your data is kept.

Verification

How do I check whether an app really has zero data retention? Run five checks: confirm the claim appears in a dated policy rather than only on the homepage; open the app's settings and confirm the privacy mode is enabled on every device you use; find the named subprocessor list; read what the policy excludes, such as metadata and abuse-monitoring logs; and check whether a fully local mode exists. If the claim survives all five, it's credible.

Why would a company make zero retention off by default? Because retained dictation data is useful to the company — for debugging, for product analytics, and for improving models. A default-off toggle lets a vendor advertise the capability while most accounts continue to generate usable data. It's legal, it's disclosed in the terms, and it's why reading the settings screen matters more than reading the homepage.

Can a company change its zero-retention policy after I sign up? Yes. Almost every terms of service reserves the right to amend the terms, with continued use as acceptance. Zoom added the disputed AI-training clause to its terms in March 2023, and the change wasn't widely noticed until August 2023.

Voice and the law

Is my voice legally considered biometric data? Yes, in several jurisdictions. Illinois BIPA lists voiceprints as biometric identifiers requiring written notice and consent, with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation. GDPR Article 9 treats biometric data processed to uniquely identify a person as a special category. California's CPRA includes biometric information within sensitive personal information.

Why does it matter if my voice is used to train AI? Because a voiceprint is permanent and can't be reissued after exposure, and because retained natural speech is the raw material for synthetic-voice impersonation. In May 2026, Illinois journalists, voice actors and narrators filed BIPA class actions against Adobe, Alphabet/Google, Amazon, Apple, ElevenLabs, Meta, Microsoft, NVIDIA and Samsung alleging their voiceprints were used to train AI systems without consent.

Tools and practice

Which dictation apps have zero retention on by default? Among the tools we've documented, Voibe's private cloud is zero-retention with no toggle to forget, and its on-device mode on Apple Silicon transmits nothing at all. Wispr Flow and Aqua Voice both offer zero-retention Privacy Modes that ship switched off, and Wispr Flow locks Privacy Mode on permanently for users who sign its HIPAA BAA.

Is on-device dictation always better than zero-retention cloud? For privacy, yes — on-device removes the vendor from your threat model entirely and keeps working offline. For raw capability, not always: cloud modes can run larger models than the machine in front of you. The practical answer for most people is on-device where the hardware supports it, with a verified zero-retention cloud as the fallback.

Zero data retention is the right standard for voice apps, and it's worth insisting on. It's also just a sentence, and sentences are cheap. The gap between the sentence and your account is where every case in this article lives: a toggle that ships off, a carve-out for aggregated data, a subprocessor with its own defaults, an amendment nobody read.

So take the ten minutes. Open the policy, open the settings, find the subprocessor list, read the exceptions, and ask whether a fully local mode exists. Then choose deliberately — level 2 for routine work is a perfectly reasonable decision, as long as it was a decision.

And if you would rather not have to trust anyone's retention policy, the architecture that makes the question disappear already exists. Audio that never leaves your Mac can't be retained, re-scoped, breached, or trained on. Try Voibe for free, or read why offline dictation matters for the longer case.