Every household we set up gets a piece of hardware. It is not a router and it is not a smart speaker; it is a small computer that holds the household's working record and does the coordinating. People ask why, given that a cloud service would be cheaper for us to run and simpler to ship.
The answer has three parts, and the third one is the part most privacy marketing skips.
What actually lives on the hub
The household's working record stays in the house. That means the memory — preferences, decisions, the history of what has been asked and done — along with uploaded documents, the model of the home itself and its devices, and the enrolled face and voice references used to tell family members apart.
That last category is the one that matters most. Biometric references are the single most sensitive thing a household assistant handles, and shipping them to a vendor's servers to sit indefinitely is a decision you cannot walk back later. They stay on your hardware.
What still leaves the house
Here is the honest boundary, and we would rather you read it here than discover it later.
Limited audio, text, images, or relevant context is processed by contracted services when that is what completing a request requires. When your Chief reasons about something complex, researches a question, or speaks in a natural voice, that work happens on AI infrastructure outside your home. There is no way to do it otherwise at present, and any vendor telling you their household assistant is fully local either has a much less capable product or is being loose with the word.
What we can tell you precisely is the shape of it: what leaves is scoped to the request rather than being a continuous upload of household life; personal data is not sold; and it is not used to build advertising profiles. The Privacy & Oversight page states the full boundary in detail, and it is deliberately written to be accurate rather than reassuring.
A test worth applying to any assistant: ask the vendor to state plainly what leaves the premises and what is retained afterwards. A precise answer is a good sign. “Your data is secure” is not an answer to that question.
Part three: what the hub is actually for
Privacy is the reason people ask about the hub. It is not the only reason it exists.
A household assistant has to do things that a cloud service is genuinely bad at. It has to talk to devices on your local network — lights, locks, climate, cameras, media — with low latency and without a round trip to a data centre for every switch. It has to keep working, at least in a reduced form, when your internet goes down. And it has to hold a large, constantly-referenced body of household context close to where the work happens.
When connectivity fails, a deterministic local mode keeps essential low-risk functions available where technically possible: basic home state and controls, timers, and connection troubleshooting. Anything that genuinely requires a cloud service is queued or reported plainly rather than guessed at. A system that invents an answer during an outage is worse than one that says it cannot reach the service.
The trade we accepted
Putting hardware in a customer's home is operationally harder than running a website. It has to be provisioned, monitored, updated, and backed up, and when something goes wrong it is forty miles away in someone's utility room. That is our problem to carry, and it is why this is a managed service with engineers behind it rather than an app you download.
We took that trade because the alternative — holding every customer's household record, documents, and biometric references in one central place — creates a target we do not want to be, and a promise we could not honestly make.
If you want the mechanics rather than the philosophy, How It Works walks through the setup, and the comparison page sets this against what a general chatbot or a smart speaker is architecturally able to do.