Privacy you can measure.

• Speech stays home

  Wake word on the hub, transcription and synthesis on the property. Cloud inference exists only as an explicit switch on your home, off by default, never a request parameter.

• Words are stored only if you say so

  Every turn keeps metadata. The transcript is kept only when the household turns it on, and the switch is checked before anything is written.

• Delete means delete

  Any voice turn or all of them, hard-deleted on request. Everything is swept after 90 days.

• The share is computed

  Your voice page shows the percentage of turns answered entirely at home, from the turns themselves. It shows nothing at all until there are turns.

• No location, no geofence

  The phone picks the nearest home in the foreground and never sends a position. Presence is proven by the home's own Wi-Fi, not by tracking.

• Nothing secret in the firmware

  A hub ships knowing only its serial. Credentials arrive at provisioning and live in secure storage.

• Isolation proven by test

  A cross-tenant read is impossible to express. A test reads the query itself, because deleting the filter once left every other test green.

• Hashes only

  Refresh, reset, pairing and invitation tokens and broker passwords are stored as hashes. A password reset revokes every session.

• Revocation first

  Removing a person revokes their sessions before the removal is recorded. If revocation fails, the removal is aborted.

• Backups that are restored

  Nightly dumps, and every Sunday a real restore into a throwaway database with row counts compared. A backup nobody has restored is a file.

• Cameras on your terms

  Live view is capped, a stored picture never wakes a camera, and watching never asks for the microphone.

• Closing an account

  One request with your password. A home nobody else is in goes with it; a shared home asks you to transfer ownership first.

The legal versions of these statements live in the privacy policy, the data retention notice and the AI notice.