Privacy should be understandable before anyone reaches a legal policy. Oneira’s core direction is consent-first: sensitive voice and camera features require a deliberate owner action, the processing purpose is narrow, and firmware never receives the secret API key used by the server.

The default state matters most

A sensor that is technically secure but constantly active can still create discomfort and risk. Owner-triggered activation makes the physical action part of the permission model. The device should show that the sensitive mode began and stop when the action ends or the request completes.

If the system cannot verify consent, connectivity, device credentials, or the current policy version, the protected feature should stay unavailable rather than silently weakening its rules.

Different features need different rules

Voice, scene description, text reading, and stylized image generation do not have identical data paths. Each feature needs its own explanation of what is sent, which provider may process it, what JML stores, and when any temporary result expires.

Oneira Sight and Oneira Dream therefore use separate consent language. A broad one-time checkbox for every future sensor use would be easier to build but harder for an owner to understand.

Limits protect the whole system

Server-side authentication, request-size limits, daily breakers, and device credentials reduce abuse and unexpected cost. They also prevent a copied client from turning the Oneira service into an open relay.

No design eliminates all risk. The honest standard is to minimize collection, explain remaining provider processing, avoid identity inference, and give owners a way to revoke optional features.

The short version

  • Sensitive features begin with deliberate owner activation.
  • Each feature needs specific consent and retention language.
  • Server-side credentials and limits protect privacy as well as cost.

questions, answered.

Are AI provider credentials stored on Oneira hardware?

The Oneira architecture keeps the OpenAI API key server-side and says it must never be provisioned to firmware.