V.O.I.C.E.

Data retention

Data should have an expiration date. This schedule is published before any of the data it governs exists — so the rules can't be written after the fact.

The schedule, in plain terms:

  • Identity verification records (when participant systems launch): deleted within 30 days of a deletion request, or one year after last account activity — whichever comes first.
  • De-identified research responses: kept up to 7 years so published findings can be checked and replicated, then deleted.
  • Published aggregate findings: kept permanently as part of the public record — a finding that’s been cited shouldn’t silently disappear.
  • Operational logs (server, security): 90 days, then deleted.

Deletion will be automatic at the end of each retention period — data won’t linger because nobody got around to removing it. And participants will be able to request deletion of their data at any time, with a public commitment on how quickly those requests are honored.

Because Phase 2 collects no participant data, there is currently nothing to retain or delete. The schedule above is a forward commitment: the rules exist before the data does.

Controls in this area

Each safeguard below carries an honest status: proposed means committed but not yet built, implemented means live today, and verified means checked by an independent party.

  • Published retention schedule

    Implemented

    How long each category of data is kept is written down on the Data retention page, in public, before any of that data exists.

    Where to check it: The Data retention page in this Transparency Center.

  • Automatic deletion at schedule end

    Proposed

    Data will be deleted automatically when its retention period ends — not kept because nobody got around to removing it.

  • Respondent right to deletion

    Implemented

    Participants can request deletion of their identity data at any time, with a public commitment on response time.

    Where to check it: The deletion request flow at /deletion-request: email-verified, erases every identity record tied to the address. Answers are anonymous and unlinkable, so there is nothing to erase on that side.