Why we don't upload your bedroom audio (and never will)

The short version: because the moment raw audio leaves your phone, "privacy" becomes a word you can no longer use in good faith. The longer version is about engineering trade-offs that turn into user trust.

Every major sleep-tracker pitch deck eventually slides over a "smart insights" feature that requires server-side processing. The implication is always that the raw audio — eight hours of you, your partner, your dog, your conversations — has to travel somewhere to get smarter. At SleepTrace we made the opposite trade: we made the insights run entirely on-device, and we never accept a feature suggestion that requires uploading raw audio.

The legal and reputational surface of raw audio

Raw audio is not metadata. It is a room recording. Eight hours of bedroom audio contains enough personal data to reconstruct a surprisingly detailed picture: who lives there, the schedule of their partner, whether someone is sick (from cough and congestion), whether children are present (from voices), and — in a not-insignible number of cases — the actual content of private conversations at night.

That is not hyperbole. It is a discovery obligation in a divorce deposition. It is a subpoena target in a custody case. It is a breach waiting to happen. One database exposure, and you are the company that kept everyone's bedroom recordings.

What users actually trade their privacy for

They trade it for convenience or accuracy, and they almost always overestimate both. The accuracy gap between on-device classification and cloud classification, for sleep audio, is noise today — the discriminative features (spectral tilt, zero-crossing, harmonic structure) are cheap to compute and run in real time on modern phones. The convenience is already maximal: the phone is on the nightstand. There is no compelling reason to ship the audio.

The engineering discipline that protects users

We enforce a single rule in code review: any path that touches the network with raw audio payloads is a build-breaking bug. Not a flag. Not a config you can flip. A compile error. This catches the "just add server-side re-scoring" feature request before it ships.

The on-device pipeline is designed around that rule. Features are extracted and the raw PCM ring buffer is overwritten every morning. The only things that leave the device, if you opt into improvement analytics, are aggregate event counts bucketed by hour and confidence level — data that cannot be traced back through an acoustic fingerprint.

The trust dividend

Users notice. Retention on privacy-forward sleep apps tracks the explicit privacy promise: the headline is "audio never leaves your phone," and users quote it back in reviews. Privacy is not a cost center here. It is the feature that distinguishes a product that earns trust from one that rents access to it.

The full on-device acoustic pipeline is documented at the SleepTrace engineering blog.