Technical architecture
Why we cannot read your footage.
Written for the people who will actually check. If something here is wrong or hand-waved, tell us and we will correct it in public.
Where the compute lives
Threat detection runs on an accelerator in the Luna Dock, on your property, on mains power. Not on the aircraft, which has no weight budget for it, and not in a data centre, which is the choice everyone else makes.
This is not primarily an ethical decision, which is why it is durable. A sub-250 gram aircraft cannot carry a useful accelerator, and streaming raw video to a cloud for inference is slow and expensive at scale. Putting the model in the dock is simply the correct engineering, and it happens to make the privacy claim a physical property rather than a policy.
The three loops, and why only one is latency critical
Flight stabilisation runs on the aircraft's own controller at high frequency and never touches a radio. Navigation and obstacle handling run onboard against optical flow and rangefinders, with no neural network involved. Threat classification runs in the dock. Only the first is latency critical, and it is the one with no network in the path at all.
That split is why detection can sit in the dock without making the aircraft less safe. If classification lags 300 milliseconds, or drops entirely, Luna keeps flying its route and you get the alert slightly later. Nothing dangerous happens.
Keys
Recordings are encrypted on the dock with a key derived on your hardware during setup. We never receive it. When you add a phone, the key is transferred device to device, not through us.
The consequence is the entire point. A subpoena served on SmartHomeDrones produces ciphertext we cannot read. There is no key escrow, no recovery service and no support tool that can open your recordings, which also means a compromise of our infrastructure does not expose your footage.
The honest cost of this design: if you lose every enrolled device, your recordings are gone. We cannot recover them. That is the same trade Signal and Apple's Advanced Data Protection make, and we would rather state it plainly than quietly keep a backdoor labelled "account recovery."
The geofence
Your parcel boundary is written to the flight controller at setup and enforced there, below the level the companion computer or the app can reach. It is not a waypoint constraint that software respects, it is a limit the flight controller rejects commands against.
This means a compromised app, a compromised dock, or a compromised SmartHomeDrones cannot fly Luna over your neighbour's garden. Widening it requires physical access to the aircraft.
What we do collect
Device health, firmware version, battery cycles, error codes, and whether a patrol completed. No video, no stills, no detection contents, no audio. This is what lets us tell you a motor is degrading before it fails, and it is a short and boring list on purpose.
What is not built yet
All of the above is the specification we are building to. Luna is not shipping, so treat this page as a commitment you can hold us to rather than a description of a device you can buy today. When hardware exists, this page gets a security audit from a third party and their report gets published here whether or not it is flattering.