What reMaestro Cloud keeps

reMaestro Cloud is optional and paid, and the hub must never need it. Every feature here has a local equivalent that keeps working if the cloud is switched off, unreachable, or shut down for good. If you have not linked a hub to an account, nothing on this page applies to you and nothing about your house exists on any machine of ours.

Read the vocabulary note first if you have not — guaranteed, merely likely and unguarded mean specific things below.

Two things can send bytes to the service, and they are separate decisions with separate switches: cloud backup, and the AI gateway.

What the service knows about you as a customer

From the account page, in full: your email address, an account id we minted, when you signed up, when you last signed in, your plan, and which hubs you have linked.

Signing in is the only thing the address is used for. There is no mailing list.

The AI gateway

The gateway exists so you do not have to bring your own key. It is a metered proxy: a request arrives from your hub, we forward it upstream, and we count what it cost.

What passes through, and where it goes

Be clear about this before switching it on. If you point the hub’s reasoning at the gateway, then the conversation — what somebody said, plus the block of context the hub builds about your house, which includes your device names and your room descriptions — is in the request body that reaches us, and we forward it to OpenRouter, who forward it to whichever model vendor answers.

If you point transcription at the gateway, the audio clip goes upstream too — and it does not all go to one place. Each transcription model on the price list carries the route it belongs to, so which of these applies is decided per model rather than per deployment:

Route	Where the clip goes	Whose key
The speech endpoint	Whatever address the operator set. In practice that is OpenAI — it is the default and it is in live use — or a Whisper server the operator runs, in which case the audio reaches no third company at all	Ours, or none for a Whisper server on a private network
OpenRouter	OpenRouter’s own `/audio/transcriptions`, and on to whichever speech-to-text vendor serves that model	Ours

So a single deployment can legitimately send some clips to OpenAI and others through OpenRouter, and nothing on the hub’s side tells you which — the hub asks for a model, not for a company. If that distinction matters to you, the answer is the same one as for the words: transcribe on a box of your own. An empty price list is also a valid state and means the deployment offers no transcription at all; the hub then declines to offer the switch rather than offering one that refuses every clip.

That is what a gateway is, and the alternatives are on the same settings page: point the hub straight at a vendor on your own key, or run a model on a box in your own house. The recommended setup is a mixture — a cloud model doing the thinking and a local Whisper server doing the listening, so the words leave and the audio does not.

Two things stay behind that you might expect to travel:

Tool calling runs entirely on the hub. The gateway never sees which device the assistant decided to touch, or what it sent it. It sees a conversation and returns an answer.
Nothing in the request is written down. The service is a stateless proxy; what it keeps is the row described below, which has no field capable of holding any of it.

What is actually stored

One row per call, and then hourly totals. Both hold the same kinds of thing:

Recorded	Not recorded
Which account	The prompt
Which endpoint — `chat` or `transcribe`	The transcript
Which model answered	The assistant’s reply
Tokens in and out, seconds of audio	The filename
What it cost	The language hint
How it ended — served, refused, or which rule refused it	Your IP address
How long it took	Your device names, your room names, anything about your house

“How it ended” is a word from a fixed list, not a message. The gateway’s refusal messages are prose written for a person and interpolate figures — “this account has spent $X of $Y” — and none of that crosses into the record. What crosses is which rule fired.

How long

What	How long	Why
One row per call	30 days	Forensics. An hourly total cannot answer “which request took ninety seconds”; these can, for as long as an incident is still worth investigating
Hourly totals	24 months	Two full year-on-year comparisons, which is the shape “what has this cost over time” is actually asked in

24 months is a privacy posture and not only a storage one. These rows are per-account cost figures, so the horizon is finite on purpose: after two years, the record of what one household spent stops existing. Which is exactly why it has to bite — a horizon nothing enforces buys the storage of keeping everything with the appearance of a limit. It prunes on the write path and on the read path, and the tests prove that rows go rather than that a constant says 730.

There is a third window that is not retention and must not be read as though it were: the spend ceiling your plan enforces is measured over the plan’s own window, hours or a day. Widening one of these to the other is a one-word change that would silently break the ceiling, so the two are separate statements with separate reasons in the code and a test that fails if they merge.

The claim this product makes is that we do not read your conversations, and an analytics table is exactly where that claim would quietly stop being true. So it is a guard rather than a promise, in four places:

The type holding every word in the record has a private constructor. Every route and every outcome that can exist is a constant compiled into one file, and the only way to turn a string into one is a lookup that falls back to a known word. There is no expression in the service that produces one holding text nobody wrote down — not “no such expression today”, but no such expression is constructible.
A test reflects over the types on the analytics path and fails the build if a field is anything but a number, an instant, or one of those words, against a named allow-list two identifiers long.
The same test parses the database schema — the actual bytes the service migrates from, read out of the compiled assembly rather than a copy that could drift — and applies the rule to the table’s columns, including ones added by a later alter table, which reflection cannot see. It also asserts the parse found at least ten columns, so it cannot pass by finding nothing.
A behavioural test puts a distinctive phrase through both gateways in every field a caller controls and then hunts for it in what was recorded. That one found a real hole: a leak into the model id was being scrubbed by accident on the served path, so the test only bit on the refused path. It now runs both.

Sabotage any of the four and the build goes red. That was checked rather than assumed.

Cost is never quoted back to your hub

The service does not tell a hub what a call cost, so the hub’s own usage screen shows usage but no money for anything that went through the gateway. That is a rule rather than a gap: a hub that guessed would be inventing a figure about somebody else’s price list. It is enforced where the hub builds its record — a gateway call’s cost is forced to nothing on the way in, so a figure worked out elsewhere cannot be smuggled into a row.

The prompts are visible, your context is not

An admin on the service console can read the prompts reMaestro ships — the static instruction text compiled into the product, the same on every hub. That is deliberate: it is our text, and being able to read what the assistant is told is how anybody checks a claim about it.

What is never shown is a hub’s per-request context — the block naming your devices, your rooms and your activities, which is assembled fresh on your hub for each turn. The console shows what the product says, never what your house said.

Cloud backup

Optional, and separate from the gateway: you can use one without the other.

Encrypted, and what that means precisely

Each backup gets a fresh random 256-bit data key. The backup is encrypted with it, and that key is then wrapped separately by each unlock method you have. The server stores the ciphertext and the wrapped keys, and never the data key — enough to store a backup and never enough to open one.

Unlock method	Used when	Held by
Hub key	Restoring to the same box — the ordinary case, no prompt	Your hub, in its own data directory
Recovery code	New or reflashed hardware	You, shown once at setup

The recovery code is the one thing you must keep. It is shown once, with a confirmation and a download option. The alternative designs are a password you can forget — and a password change means re-encrypting everything — or us holding a key, which defeats the point. A written-once code is the smallest honest ask.

Note that regenerating the code does not rewrap backups already uploaded. The old code still opens old backups and the new one opens only new ones, so both are worth keeping until the old backups age out. The console says so rather than implying otherwise.

What the server can see either way

Size, timing, count, and which account it belongs to. Not contents. Worth stating, because “encrypted” without a threat model is marketing.

The unencrypted opt-out, stated plainly

You may choose unencrypted backups instead — no recovery code, nothing to lose. If you do, reMaestro can read the contents, and the contents are a credential dump: device API keys, pre-shared keys, your AI key, a TLS private key, and whatever anybody has configured your plugins with. The settings screen says that in those words.

One qualification, in the direction that helps you rather than us. A value a device’s driver or a plugin declared to be a credential is encrypted before it is written to your hub’s database at all, under a key that lives on the hub and is deliberately kept out of its own backups — so those particular values are ciphertext inside the bundle whichever way you set this switch. That is a narrower protection than it sounds and it is stated narrowly: it does not cover a credential typed into a field nobody declared as one, it does not cover your TLS key, and the flip side is that a backup restored onto different hardware cannot open them, so those fields arrive blank and are typed in again.

Encrypted is the default. The opt-out exists because “I’d rather never be locked out” is a legitimate position, and hiding it behind a false promise of both would be worse.

What is deliberately not in a backup at all

Two stores on your hub are excluded by name, so they cannot reach the service even inside a sealed blob:

The conversation log, if you switched it on. Enforced three ways, including on the import direction — see the hub page.
The hub’s own usage history. It is history rather than configuration, so a rebuilt hub works exactly the same without it; and restoring onto a second hub would import the first hub’s record of who asked for what as though it were the second’s.

The honest summary for the cloud

Guaranteed

No prompt, transcript, reply, filename, language hint or IP can enter the analytics record. Private constructor, reflection over the types, a parse of the actual schema including later migrations, and a behavioural hunt for a planted phrase.
Retention horizons are enforced by deletion, and the tests assert that rows go rather than that a constant says 730.
The spend ceiling and the retention horizon cannot silently become one window.
The server cannot open an encrypted backup — it never holds the data key.
A gateway call’s cost cannot be recorded on your hub, so no invented figure about our prices can appear there.
The hub’s conversation log and usage history cannot enter a backup bundle.

Merely likely

That you keep your recovery code. Nothing can help if you do not; that is the design, and it is the honest cost of the server not being able to read your backups.
That an unencrypted backup is a choice somebody made deliberately rather than clicked past. The screen says what it costs, in those words, and nothing makes anybody read it.

Unguarded

What happens to a request after it leaves us. Conversations go to OpenRouter, who forward to a model vendor. Audio goes to OpenAI or to OpenRouter, per model, or to a Whisper server the operator runs — see the routing table above. Their retention is theirs, and nothing described here reaches into it. If that matters to you, the answer is not to use the gateway — point the hub at a vendor on your own key, or at a model in your own house. Both are supported and neither is a downgrade.
Which upstream transcribed a given clip. It follows the model, and a hub asks for a model rather than for a company. There is nothing on the hub’s side that reports it back.
Where this service physically runs, and therefore which country’s law it sits under. The hardware is the operator’s and where it sits may change; neither this page nor the customer-facing summary commits to a location. What the hardware holds is ciphertext and counts — see the backup section above for what that does and does not protect.
Operational logs. This page describes what the product stores as a design. A service that serves HTTP has an operator, and ordinary infrastructure logging is not the analytics record and is not covered by the guards above.

What the hub keeps — the box under your television, and the only place a conversation is ever written down.
The AI assistant — why it is off until you give it a key, and how to point it somewhere other than us.