Privacy & Trust

The short version: the microphone data stays in your house, and we designed the system so we could not change that quietly even if we wanted to.

What never leaves your house

Raw audio. Ever. Wake-word detection runs on each speaker; speech-to-text runs on the Hub, in your home. Microphone audio is processed there and discarded; there is no code path that uploads it. (How that works without training, and without a GPU: How Olsie hears.)
Voice prints. Speaker recognition profiles are computed and stored on the Hub only. Never synced, and a factory reset destroys them.
Logins and browsing. Anything Olsie signs into for you lives in a vault on the Hub; sessions and cookies never leave it.

Routed transcripts only. When a request genuinely needs cloud-scale reasoning, the Hub sends the text transcript of that request - never the audio - to our cloud, gets an answer, and that's the end of it. Simple commands (lights, timers, music control) never leave the Hub at all.
Your household ledger - encrypted, yours. What Olsie remembers (names, preferences, routines, notes, the conversation history as text) lives on the Hub and in your household's own locked corner of the Olsie cloud, so your app works away from home and nothing is lost if the Hub dies. Every household has its own encryption key; nothing is ever shared across households, and none of it is ever training data. Honesty over slogans: because our service acts for your household (answering you away from home), it can read your household's synced text when doing so - never your audio, never your voice prints, and every key access is logged. Deleting your household is cryptographic: we destroy your household's key and the stored data becomes unreadable noise, then the records themselves are erased.
Heartbeats and updates. Devices report their own health (version, uptime, temperature, battery - about the machine, never the household) and download signed software updates.

Olsie knows who is speaking, so permissions are per-person:

Adults can do everything their household role allows.
Kids mode: recognised children get age-appropriate answers, no purchases, no device settings, and quiet hours that actually hold.
Guests (unrecognised voices) get a minimal, harmless command set.

No ads. Ever. We sell hardware and a subscription. You are the customer, not the product.
We do not sell, share, or broker your data. Nothing about your household is for sale, to anyone, full stop.
Devices are outbound-only: nothing on the internet can connect in to your Hub or Minis. They dial out to fetch updates and deliver heartbeats, and that is the only direction a connection is ever made.

Support access to your Hub (for white-glove debugging) happens only with your explicit consent per session, and every session is logged and auditable.
Software updates are cryptographically signed; devices refuse anything unsigned.
When we get a transparency-report request, the honest answer about your audio is: we do not have it, and cannot get it.