What we send to AI, and what never leaves your house

Vome uses AI in exactly two places. Here is the payload each one sends, why it is that shape, how to switch it off, and how to read the real thing rather than take our word for it.

Updated 28 August 2026 privacyaihealth-reportassistant

Most people run Home Assistant so that their home is not in somebody else's cloud. Adding AI to a product like that is a promise you have to be able to show, not one you can make in a sentence — so this page is the long version, and every claim on it has a page in the portal where you can check it against the real request.

The short version

There are two places where anything leaves your instance, and both of them send a small, specific payload:

• The health report summary. After the checks run, the findings — not your system — are sent to be written up in plain English.
• The assistant. When you send it a message, or ask the AI Doctor about a finding, the conversation is sent so it can be answered.

Nothing else in Vome talks to an AI. Backups, remote access, monitoring, the score card, your dashboards: none of them.

The findings are ours, not the model's

This is the part that surprises people, so it comes first. When you run a health check, our own code reads your instance and decides what is wrong with it — a flapping sensor, a flat battery, an automation that never fires, a disk filling up. Each finding is produced by a function you could read, with a measured number attached.

The model is handed those finished findings and asked to write them up. It does not see your system, does not decide what counts as a problem, and is not asked to diagnose anything. Every number it writes is checked back against the findings before you see a word of it; if it states one that is not there, the answer is thrown away and asked for again.

That is why unticking the AI box costs you the prose and nothing else. The score, the findings, the evidence and the recommendations are identical. The summary is just written by a template instead.

What the health summary actually sends

For each finding: the severity, the category, the one-line title our code wrote, the line of evidence behind it, and the recommended fix. Plus the name you gave the server, so the write-up can call it something.

The evidence line is the one worth looking at closely, because it is the only field that can contain anything from inside your house. A finding about chatty devices names the entity. A finding about log noise quotes one truncated example line. That specificity is what makes the report worth reading — and it is why the portal shows you the exact text before it goes anywhere, rather than describing it.

What is not in there: your device states, your history, your statistics, your configuration, your automations, your dashboards, your full logs, your backups, your media, your cameras, your tokens, your IP address.

What the assistant sends

The messages in that one conversation, our own public guides (so it can point you at a real one), our public version-testing notes, and your server's name, state and reported versions. The versions are there so it does not ask you for numbers the portal can already see.

A conversation is different from a report in one important way: you type into it. Whatever you write is what gets sent, so it is worth knowing that the thread is the payload.

Where it goes, and what happens to it

To Anthropic's Claude API. Anthropic's commercial terms state that inputs and outputs sent through their API are not used to train their models. They may retain a copy under their own abuse-monitoring policy — that half is theirs, and we link to it rather than paraphrase it. Our half we can promise: we keep nothing.

We store no copy of the request. It is built in memory when the feature runs, sent, and dropped when the answer comes back. It is not written to our database and it is not written to our logs — the failure logs record what went wrong and never what was in the request.

What we do keep is the answer, because it is your report and your ticket: the summary on the report page, the replies in the thread. Both are yours to delete.

Reading the real thing

Every finished report has a See the exact data link, and every assistant conversation — including an AI Doctor visit — has a See exactly what is sent link. Those pages do not describe the request — they build it, using the same function that sends it, and print it. Alongside it you get every field with a plain sentence about why it is there, the instructions we send with it, and the list of what stays behind.

If we ever add a field and forget to explain it, that page prints it anyway and says no description has been recorded. A transparency page that can only show what we remembered to document is not a transparency page.

Turning it off

• The health check: untick Let AI write the summary before you run it. The report page then says, on the report itself, that nothing was sent — and still links to what would have gone, so you can see what you declined.
• The assistant: simply do not use it. It has no background behaviour, no scheduled runs and no automatic replies; it answers when you write to it and at no other time.

The privacy policy lists Anthropic as a sub-processor and states the lawful basis for both features.