Home robots are cameras that move, microphones that listen, and maps of your living space more detailed than your architect’s drawings — all wrapped in a friendly chassis and connected to a company’s servers. That isn’t inherently a problem. Appliances have earned our trust before. But trust has to be earned one question at a time, and the home robot industry hasn’t answered all of them yet.
Before any robot crosses your threshold, run through this checklist. Two or more fails is a hard pass. One fail is a serious yellow flag. Zero fails means the company is doing the minimum right — and you can watch the breach history before committing.
The 7 questions every home robot buyer must ask
1. What sensors run, and when?
A camera that’s “off” should be demonstrably, verifiably off — not software-off where a firmware update could flip it back, but hardware-off with an LED or physical shutter you can confirm. The same applies to microphones. “Always listening for wake words” is a specific technical claim: it means the microphone is processing audio 24 hours a day and deciding locally what to send upstream. That’s not evil by default, but you deserve to know it’s happening and to be able to stop it.
Pass: Sensors off means off — hardware indicator, verifiable, no exceptions. Fail: “Always listening for wake words” with no physical shutter, or vague sensor disclosures buried in a 40-page privacy policy.
2. Where does footage and audio actually live?
On-device processing is architecturally different from cloud streaming. When your robot processes video locally to detect obstacles, your footage never leaves your home. When it streams to servers to “improve AI models,” it does. Ask directly: what data, in what format, goes to which servers, and where are those servers hosted?
Pass: On-device processing by default, cloud only with explicit opt-in, server location disclosed. Fail: Everything streams to company servers as a condition of function, with no opt-out that doesn’t break core features.
3. How long is data kept — and in what form?
“As long as needed to improve our services” is not an answer. An answer has a number — 30 days, 90 days, 12 months — and a definition of what’s being kept. Raw video is different from extracted embeddings. A map of your home’s layout is different from a timestamped log of which rooms you occupy at which hours. Both matter; the latter is often the one not disclosed.
Pass: Retention period stated in writing, differentiated by data type, with a deletion mechanism that actually works. Fail: Open-ended retention language, no differentiation between raw and derived data, or deletion requests that take weeks to process.
4. Who can see through the robot’s cameras?
Teleoperators help robots navigate novel situations. Support staff diagnose technical problems. “Safety reviewers” monitor anomalies. These are all legitimate roles — and you should know exactly which of them exist, under what circumstances they can access your home’s video feed, whether sessions are logged, and whether you get an in-home indicator when remote access is active.
Pass: Named roles, session logs you can access, unmistakable in-home indicator during any remote session. Fail: Vague “authorized personnel” language with no session logging and no indicator. Our teleoperation explainer covers why this question is the most important one in the category.
5. Is your home map yours — or theirs?
Every robot that navigates your home builds a map of it. That map knows which rooms exist, how they connect, where furniture sits, and often where people tend to be. It’s more intimate than a floor plan because it’s behaviorally current. You should be able to export it, delete it, and be certain it’s not shared with third parties or used to train models sold to others.
Pass: Map is exportable, deletable on request with confirmation, not used for third-party purposes or model training without explicit consent. Fail: Silence on map ownership in the privacy policy. Silence means no — a company that owns this issue says so plainly.
6. What happens to your data at cancellation?
Subscription robots create a specific vulnerability: you’re renting access to a machine that has built a detailed model of your home. When you cancel, what happens to everything the robot learned? Immediate, complete, confirmed deletion is the right answer. “Perpetual licenses to derived data” — language that appears more often than it should — means the company keeps processed versions of your home data indefinitely.
Pass: Full data deletion on request, confirmed in writing, within a defined timeframe (30 days is reasonable). Fail: Perpetual licenses to derived data, no deletion confirmation, or a cancellation process that’s deliberately difficult.
7. What’s the company’s breach and bug bounty history?
A company that pays security researchers to find vulnerabilities and patches them quietly is a company that takes security seriously. A company that threatens researchers with legal action for disclosing vulnerabilities is hiding something. Check the breach history on Have I Been Pwned, look for a published security hall of fame or bug bounty program, and search the company name alongside “vulnerability” and “disclosure.”
Pass: Published bug bounty program, responsive disclosure history, clean breach record or transparent post-breach communication. Fail: No bug bounty, legal threats against researchers, or a breach history with slow or deceptive communication.
The standard to hold
Any company shipping cameras and microphones into bedrooms owes you crisp, written answers to all seven. The answers should be findable in the privacy policy, the terms of service, or a published security page — not only available on request from a support agent who may not know the real answer.
Two or more fails: don’t buy and consider reporting the gaps publicly. The home robot category is young enough that consumer pressure still shapes product decisions. One fail: read the specific clause carefully, ask the company directly in writing, and wait for the answer before committing. Zero fails: you’re buying from a company that’s thought about this — watch the breach history and revisit the policy annually, because privacy policies change.
We grade privacy posture alongside capability in every WhichBot review. If a robot scores well on capability but badly on privacy, we say so — because a robot that watches your home while leaking your data isn’t a home robot. It’s a liability.