Privacy and retention
Élise only keeps the normalised facts needed for reassurance. All processing happens inside the home.
Retention
Section titled “Retention”| Data | Duration |
|---|---|
| Detailed sensor observations | 90 days |
| Completed jobs and technical records | 30 days |
| Journal summaries | Up to two years by default |
| Accounts and audit | Until the account or household is deleted |
| Camera alert images | 24 hours, excluded from backups |
What leaves the home
Section titled “What leaves the home”- Nothing by default. There is no Élise cloud.
- Relatives reach Élise through the family’s private Tailscale network.
- Push notifications carry a generic text and the alert’s type, identifier and priority. The details stay in the home.
- Webhooks are off until configured. Each delivery is signed (
x-michel-signature: sha256=…). - Exports should be encrypted before they leave the hub.
Cameras
Section titled “Cameras”Cameras form a separate media plane. Video and audio never enter observations or learning; a camera can only contribute the normalised person_presence fact. Live video is relayed on demand, with a signed five-minute session. Audio is only available while the intercom control is deliberately held, and is never recorded. See Cameras.
Secrets
Section titled “Secrets”Internal passwords (PostgreSQL, MQTT, sessions, camera encryption, media tickets) are generated on first start in a private Docker volume. No secret is written to the repository or an image.