Privacy Model
This device has a camera and a microphone pointed at your home. The boundaries are deliberate.
-
Wake word and capture stay on the Pi. Audio is held in a rolling in-memory buffer and never persisted by default. After VAD end, utterance PCM is POSTed over LAN to the STT endpoint in use (Ada when Reach speech is enabled; otherwise often
127.0.0.1). - No inference leaves the LAN. Vision, orchestration, and (when enabled) speech compute run on the AI server. Nothing goes to the public cloud in Phase 1. PCM leaving the Pi for Ada speech is the same trust boundary as CPAI frames.
- Camera frames are transient. Sent to CodeProject.AI for inference, not written to disk by COMSTAR.
-
Face descriptors live in CodeProject.AI, on your server, under
userids you chose. - Transcripts are session-scoped and retained under AO's session memory policy — configure retention there.
- There is a hardware kill. Wire a physical switch or use the mic array's mute. Software mute is not a promise you can make to a guest.
systemctl --user stop comstar-bridge comstar-audio comstar-kiosk comstar-stt comstar-tts
systemctl --user disable comstar-bridge comstar-audio comstar-kiosk comstar-stt comstar-ttsNetwork isolation: unplug Ethernet / disable Wi-Fi on the Pi to confirm offline fallback lines still play.
Production WebSockets bind 127.0.0.1 only. Binding to the LAN requires the triple gate. Production configs ship with dev.bind_lan: false.
Unrecognised faces get restricted overlays — no Home Assistant, no Google, no terminal control. See Attention Model.