What makes an AI voice recorder private?

Privacy has to be product behavior

A privacy policy cannot compensate for a recorder whose everyday behavior is unclear. The person wearing it and the people nearby need to understand when recording begins, when it ends and what happens next.

For a wearable, privacy starts at the physical interface. BEFORE is designed so only a deliberate gesture can begin capture, with a visible state that remains active for the recording interval. Exact feedback still depends on hardware acceptance and should not be claimed as proven before that gate passes.

Intentional is different from ambient

An ambient device collects continuously or waits in the background for a trigger. An intentional device remains inactive until the user makes a clear recording decision. That difference changes the amount of unrelated speech collected and makes the social boundary easier to explain.

BEFORE has no wake-word or always-listening mode in its product design. It is intended for a thought or consented conversation the user chooses to preserve, not for building a silent record of every interaction.

Separate recordings, transcripts and context

Raw audio, a transcript and extracted context are not interchangeable. Audio contains voices and background detail. A transcript contains the words. Structured context may contain only a relevant decision, task or idea.

A privacy-preserving system should treat these as separate data domains. In BEFORE’s design, raw audio is available only to the trusted processing and owner-controlled retention or export path. It is never an agent permission. Transcript and extracted-context access use distinct scopes.

Retention should be explicit

Encryption protects stored and transmitted data, but it does not answer how long the data remains or who can retrieve it. A private recorder should disclose retention, provide deletion and export, show connected services, and let the user revoke future access.

BEFORE’s recommended design removes raw audio after a verified transcript by default while keeping user-controlled exceptions. Production retention windows, processors and regions must be finalized in the legal notice before real user data is accepted.

• A clear start and stop state.
• No hidden remote recording command.
• Separate scopes for different data types.
• Access history, correction, export, deletion and revocation.
• An honest statement of what remains unverified or unfinished.

Privacy also includes other people

A visible indicator does not replace consent. Recording rules differ by jurisdiction and situation, and the person using a recorder remains responsible for obtaining any permission required from others.

The safest product language is therefore specific rather than universal: deliberate capture and visible state can support understandable recording behavior, but they do not create legal authorization to record.