History and privacy

These controls describe the latest app and service source and require an upgrade from older development builds.

Read saved calls

Open a contact and choose Call history to read that contact’s calls, or use the main history for all contacts. Both load pages, with transcripts fetched separately when needed. The contact view is filtered by the service before pagination, so older calls remain reachable even when other contacts have many recent calls. The agent can use search_calls and follow get_call_transcript cursors for its own saved calls. An active call’s transcript also requires the approved session and consumer lease. An opening question is separate from a recorded conversation; a missed call does not prove that question was heard.

Phone-authorized clients can use GET /v1/agents/:id/calls/page for that contact’s paged history. Keep its returned cursor with the same contact; a cursor from the main history or another contact is rejected. This phone endpoint is separate from the agent-scoped MCP history tools.

Explicit progress and results are saved independently of a speech turn and can arrive after hangup. Call details show an Updates section only when such output exists. Ordinary spoken replies remain in Transcript; internal task-dispatch records are not presented as completed work. A saved result does not prove it was played aloud. Keep full work artifacts in the original agent’s chat.

Retention and disconnecting

The default is retain until explicitly deleted. There is no automatic history expiration, and upgrading does not purge old calls.

Disconnecting a contact removes its access and receiver configuration while preserving saved calls. Disconnecting the phone revokes that credential and preserves the server’s data. Export or delete calls first if that is what you intend. A newly paired identity does not inherit a disconnected phone’s history; an operator can use the supported identity-preserving credential recovery.

Export

In current app builds, open Settings → Call history → Export call history. The native share sheet lets you choose where to save the private export. Suzo removes its temporary shared copy afterward; the destination copy is yours to manage.

The phone-authorized GET /v1/history/export streams NDJSON containing ended calls, their events, and saved task records, including late results. It excludes credentials and other phone identities. A successful file starts with a version-1 format record and ends with a complete record. Without that final record, treat the export as incomplete. A long export can be affected by concurrent deletions.

This is a readable history export, not a restorable account backup. It contains conversation text and panel values; store and share it accordingly.

Delete

Open an ended call’s details, choose Delete call, and confirm. Only the paired phone can delete its calls. Active calls must end first. Deletion removes the call, events, transcript search data, recorded panel actions, and associated task records. Repeating the same deletion is harmless.

For phone-authorized API clients, DELETE /v1/calls/:id deletes one ended call. POST /v1/history/delete accepts an explicit end-time cutoff:

{"before":"2026-01-01T00:00:00Z","confirm":true}

The bulk response removes up to 1,000 calls and includes deleted, hasMore, and eventCursor. Repeat the same confirmed request while hasMore is true, then refresh history and its event cursor. These routes belong to your service origin and require the phone credential; they are not agent MCP tools.

Minimal agent/call IDs and a hash of the request ID remain to prevent replaying a deleted request from ringing again. New-per-call assignments also retain minimal session UUIDs and conversation-identity/credential hashes after child expiry and history deletion, preventing reuse for a different call. These receipts contain no bearer credential, question, reply, transcript or panel values. Deletion also removes local usage history; it does not change provider billing.

Deleting live database records does not erase older backups, exports, the original agent’s chat, provider records, or every SSD/SQLite free block. Those copies have their own retention and deletion rules.

Diagnostics and backups

Native diagnostics exclude transcript text and credentials, retain at most two 256 KiB cache files for seven days, and clear on disconnect. Helper timing instrumentation is optional and excludes audio, transcript text, and credentials.

For a restorable backup, an operator stops the service and preserves the entire private data directory, including SQLite companion files and the matching provider-vault key. Verify the backup before starting a restored service; see self-hosting. TLS/WSS and scoped credentials protect transport and access, but the service can access relayed media and persisted transcripts. See security for provider-specific paths and the limits of vault encryption.