Most people run Home Assistant so that their home is not in somebody else's cloud. We think a company saying that should be able to show its working, so twice a year we go through the whole product asking one question — what do we hold, who else sees it, and can you get it all back? — and publish what we found, including the things we got wrong.
This is the first one. It was prompted by adding AI features, on the principle that if we are going to show people the exact data those send, the rest of the product should survive the same question.
Four things. All fixed in the same week, none of them comfortable.
Erasure removed your published score cards and your account row, and left the rest: your servers, your health reports — which quote entity names and log lines from your house — every message you had written to support, your API tokens, and your email address in our email delivery log. Nothing was exposed by this and nobody's data went anywhere. It simply would not have been the deletion we promised.
Erasure is now driven by a list of every table that can hold something of yours, and a test walks our live database schema and fails our build if a table appears that is on neither that list nor an explicit "contains nothing about a customer" list with a written reason. In other words, the next feature cannot quietly keep a copy of you.
Health check findings, support conversations, the log of what has acted on your instance through the portal, and our email delivery log were all real, all reasonable, and none of them mentioned in the privacy policy. Our policy also said we do not copy data out of your VM, which the health report quietly contradicted. All four are now described in the policy, and the VM paragraph says which two features read a slice of it and what each keeps.
Our stylesheet, icon font and scripts came from a public CDN, so your browser announced each page view to a third party — including public score cards, opened by people who never signed up for anything.
Those files are now served from our own domain, and our content security policy permits no external host at all, so it cannot come back by accident. Loading a Vome page now talks to us and to nobody else.
Taking a copy of your data, or closing your account, worked — by asking a person, who then did it by hand. A right you have to request politely is not much of a right, so both are now buttons under Your data in the menu: one downloads everything we hold about you as a file, the other deletes it, including the instances themselves. Neither asks you why.
The features shipped before the policy caught up. Anthropic is now listed with what it receives, what its terms say about training, and a link to its own policies — plus a page, on every report and every assistant thread, that shows you the exact request rather than describing it.
Nothing from this sweep — the last item, an unused earlier sign-in integration still sitting in our codebase, was deleted along with the two packages and the dormant callback route that came with it. The next sweep is due February 2027, and it will be published here in the same shape whether or not it makes us look good.
A sweep is a snapshot, and we would rather tell you about a new store when we build it than when we next go looking. Since August we keep two more things, both disclosed in the privacy policy:
Questions, or something we have missed? privacy@vome.io. If it is a vulnerability rather than a privacy question, please use security@vome.io and the disclosure process.