privacy first, not privacy theater
Privacy
Hardware mute is real. Local inference is the default. Cloud is optional, metered, and region-pinned when you use it.
Principles
1. Hardware mute wins
Mute switch electrically interrupts the mic path. Not a software promise.
2. The LED is a contract
Coral ring dark → not in a listening path. Lit → assume it can hear.
3. Everyday AI is on-device
Chatter-Local 1.8B runs on the ChatterCore NPU. Wake word detection is on-device. You can use the product for years without ever enabling cloud.
4. Boost is opt-in and explicit
Cloud only runs when policy allows and a turn is escalated. We don’t silently “improve quality” by shipping audio upstairs.
5. History is yours to burn
Default local retention is short. Factory reset wipes local stores. Cloud history (if any) deletes with one control.
6. No ad network. No data brokerage.
We sell hardware + optional Boost. We don’t sell voice snippets.
What runs where
| Data | Where | Default |
|---|---|---|
| Wake audio buffer | Device RAM (ephemeral) | Always local |
| Local conversation | Device eMMC (encrypted at rest) | 7-day retention |
| Boost turn audio/text | ChatterCloud region you pick (US/EU) | Off until you enable |
| Account email | Waitlist / order systems | Only if you join / buy |
Boost-specific promises
- No training on Boost content by default for consumer plans
- Region pin: US or EU routing
- You can export or delete cloud history from the app
- Enterprise DPA available when we ship B2B
What we never do
- Sell voice data
- Require cloud for basic chatter
- Hide a second microphone
- Re-enable cloud after you turned it off without a clear UI action
If your box isn’t chattering, maybe it’s just respecting you.