Your Smart Home Is Listening — Here's What I Did About It

A few years ago, my wife and I were planning a trip to India. We were sitting at home, talking about flight options, dates, prices — the kind of conversation that happens at the kitchen table with no phone in your hand. And then, in the middle of a sentence, the smart speaker across the room lit up. No wake word. Just woke up, listened, and went back to sleep.

It was a small moment. I almost didn't notice. But the next day, my phone was full of flight ads to Delhi.

I had never opened a flight-search app. I had never typed "India" into a search bar. I just talked about it in my own home.

That's when I stopped pretending the smart home was neutral.

The pattern isn't paranoia

I'm an engineer. I spend my days writing software for systems where every behaviour has to be justified with a log line. So when I started paying attention, the pattern was hard to unsee.

• Lights would glow and answer to nothing — clearly the wake-word detection misfiring.
• Searches I'd never typed would show up in my recommendations the next morning.
• Conversations my wife and I had alone in our living room would shape the ads we saw.

People call this paranoid. It isn't. It's the product working exactly as designed. The business model of mainstream voice assistants isn't to help you turn off the lights — it's to be in your kitchen, learning your habits, and selling that signal to advertisers. The convenience features are the bait. The data extraction is the catch.

If a stranger sat in your living room with a notebook taking down what you said about your flights to India, you would throw them out. We just don't see the device the same way because it's quiet and doesn't make eye contact.

There's a different way to do this

So I rebuilt my house.

Home Assistant on a small server in the corner. Zigbee for the devices — short-range, low-power, no cloud round trip. Local cameras with the internet cable physically pulled, recording to disk in my house. Climate isn't smart yet, voice control isn't either, and yes, I still have some cloud apps I haven't replaced. I'm not 100% there. I'm not pretending to be.

What changed isn't a brand. It's the trust model. In my house now, no automation needs to phone home for permission. When I flip a switch at 11 PM, no server in some other country knows about it. The lights don't watch me. They just turn on.

This is what people mean by "local-first." It's not a privacy slogan. It's a design choice — every decision your house makes happens inside your house.

What does a privacy-first smart home actually look like?

A privacy-first smart home is one where every decision the house makes happens inside the house — no automation phones home for permission, no cloud server logs that you flipped a switch at 11 PM. Built right with Home Assistant, Zigbee, and ESPHome, it costs about three days of maintenance a year and runs in the background unattended the rest of the time. The system survives an internet outage without breaking. Lights still respond. Vacation mode still arms. The water heater still heats on schedule. The trade-off you usually hear — that local-first means fragile, that your family will be stuck in the dark when the server dies — sells cloud subscriptions; it isn't true if every device falls back to a local switch and the controller is dual-rail. The day-to-day automations below are what convinces you it's worth building.

The day-to-day stuff is what convinces you. A few automations from my place:

Vacation mode — one button. When we leave for a trip, I press one tile on a wall panel. Every blind closes. The water heater drops to a holding temperature. Local cameras switch to active monitoring with motion alerts going to my phone. House looks lived-in (random lights through the night), the energy bill drops, and there's nothing to forget. No "did I leave the iron on?" thinking on the plane.

Lights that actually know. Walk into a room, the light is already on. Walk out, it goes off. Leave the house with my wife, the whole place goes dark — every light, every standby gadget. I haven't manually turned off a light in two years.

Master switch by the bed. One physical button next to my pillow turns off every light in the house. If I'm reading and want to sleep, I don't get up. I press a button. It's nothing fancy, but I notice it the second I'm in someone else's home.

Water heater on a schedule. Heats only when we'd reasonably want hot water. No sense heating 200 litres at 3 AM.

None of this is impressive technology. It's basic logic — the kind of thing your house should have been doing the whole time. The reason it doesn't is because mainstream smart home products are built to sell subscriptions, not to be useful.

The trade-off most people get wrong

The story you usually hear about going local-first goes like this: it's hard, it's fragile, and if your server dies your family is stuck in the dark. That story sells cloud subscriptions. It isn't true if you build the system right.

Here's what mine actually costs me:

About three days a year. Adding a new device, tweaking an automation, applying an update I've been putting off. That's the total maintenance bill. The system runs in the background and doesn't ask for attention.

Bi-directional from day one. This is the part I want every reader to take away. My house is fully analog underneath the smart layer. Every light still has a physical switch on the wall. The water heater has a real button on the front. If my server dies tomorrow morning, my family won't notice during the day — they'll just operate the house the way people operated houses for the last hundred years. The smart layer sits on top of a working analog house. The lights don't stop being lights when the brain goes down.

This is the design choice mainstream cloud products quietly skip. With most cloud-tied bulbs, smart locks, and thermostats, the cloud being unreachable means the product is unreachable. With local-first, done properly, the cloud being unreachable just means the automations are paused — the house keeps working.

The honest unsolved problem on my end is voice. Local voice processing exists, but the hardware is still expensive and the experience hasn't caught up to the cloud assistants. I don't have a clean answer there yet. I do without for now. It's fine.

So what should you actually do?

Here's where I get opinionated. There are exactly two reasonable paths if you care about this:

1. Hire someone to build it for you. This is what we do at NeuraByte's NeuraHome practice. You shouldn't have to learn YAML to live in a private home. Someone designs and installs the system, hands you a working setup with documentation, and is on the line if something breaks. You pay once for the build and modestly for maintenance, and the surveillance never enters the house.

2. Just stay analog. Honestly. A regular light switch, a regular thermostat, a regular doorbell — these are not bad products. They were the default for a hundred years. If you don't have the time, the budget, or the appetite to do this properly, the right answer is to skip the smart layer entirely. Better a dumb house than a watched one.

What's not on the list, and this is the part that matters: "I'll just use the cloud version because it's easier." That's the option marketing has trained us to pick. It's also the one that puts a microphone in your kitchen with no rules about what it does with what it hears.

There's no clever middle ground. Either the data stays in your house or it doesn't.

Coming back to the kitchen table

I think a lot about that flight conversation. We were sitting at our own table, in our own home, talking about our own life. And someone we never invited was listening.

I don't think privacy in your own home should be a paid feature, an opt-in toggle deep in a settings menu, or a reward for being technical enough to set up Home Assistant. It should be what "home" means.

Until that's true at the product level — and it isn't, and it won't be soon — the only way to get it is to take it back yourself. Or hire someone who will take it back for you. The walls of your house are the right boundary. Your data shouldn't be allowed past them without your explicit permission.

The smart speaker that lit up at the word "India" has been in a drawer for years now. The lights still work fine. The switch on the wall never needed it.