False-wake records should be inspectable and deletable
Aliases: wake history · recording deletion · activity log
What it is
Every wake—intended or not—that produced audio, a transcript, or a cloud session should leave a record the owner can inspect and delete. False wakes need this especially: the person concerned is often absent and can only learn what happened from a log. Uninspectable means unauditable; undeletable means an accidental capture becomes a long-term archive.
Why it happens
A keyword hit yields a timestamp, a device id, sometimes an audio clip and recognized text. If those objects exist only in a vendor back end, the owner cannot check whether a clip was a false trigger or whether a bystander is inside it. Inspectable means the user-facing surface lists time, device, and whether audio still exists—not a sentence that “we protect your privacy.” Deletable means the delete propagates to every copy, including model-improvement queues; otherwise the on-screen delete is fake. Genuine wakes should be equally manageable; false wakes only make “I did not know it was listening” a harder requirement. Expiry after a retention window does not replace a user-initiated delete.
Studying it
Walk the account activity history: do false wakes appear, can audio be played, does a delete survive on other endpoints. Cross-check vendor policy documents against actual APIs. User research asks whether a non-technical person can find and delete one item in five minutes. Reading a privacy policy without asking whether the product has a button yields an overly kind conclusion.
Where it stops holding
Purely on-device keyword spotting that never writes a disk may have no inspectable audio object; it should still expose a count such as “triggers today,” or people cannot know false wakes occurred. Enterprise devices may restrict deletion; that belongs in the deployment policy, not as a consumer default. When legal holds conflict with a deletion right, a separate compliance path is required; hiding every record is not protection. Devices with no cloud account must make records inspectable and deletable on the device.
Applying it
- List every listen in an activity history by time; use the same delete action for false and intended wakes, and state whether audio is gone from servers.
- After a successful delete, recheck the device, the phone companion, and the web console; it should be gone in all three.
- If there is no history UI, audio should not upload by default; make inspectability real before using those clips to improve models.