Technical architecture
Why we cannot read your footage.
Written for the people who will actually check. Every claim below is a property of where something runs or where a key was generated, not a policy we are asking you to trust. If any of it is wrong or hand waved, tell us and we will correct it in public.
Where everything lives
Four classes of data. One of them reaches us.
| Class | Where it lives | Who can read it |
|---|---|---|
| Video and stills | Luna Dock, on your property | You |
| Detection events | Luna Dock, on your property | You |
| Decryption keys | Your dock and your enrolled phones | You |
| Device health | Our servers | You and us |
Cloud backup of recordings is opt in, off by default, and still encrypted with a key we never receive. Turning it on moves ciphertext, not footage.
Where the compute lives
Threat detection runs on an accelerator in the Luna Dock, on your property, on mains power. Not on the aircraft, which has no weight budget for it, and not in a data centre, which is the choice everyone else makes.
This is not primarily an ethical decision, which is exactly why it is durable. A sub 250 gram aircraft cannot carry a useful accelerator, and streaming raw video to a cloud for inference is slow and expensive at scale. Putting the model in the dock is the correct engineering first, and it happens to turn the privacy claim into a physical property rather than a policy.
The three loops
Only one loop is latency critical, and it has no network in it.
| Loop | Runs on | Network in path | Latency critical |
|---|---|---|---|
| Flight stabilisation | Aircraft flight controller | None | Yes |
| Navigation and obstacles | Aircraft, optical flow and rangefinders | None | No |
| Threat classification | Luna Dock accelerator | Local link only | No |
That split is why detection can sit in the dock without making the aircraft less safe. If classification lags 300 milliseconds, or drops out entirely, Luna keeps flying its route and the alert reaches you slightly later. Nothing in the flight path is waiting on it.
Keys
Recordings are encrypted on the dock with a key derived on your hardware during setup. We never receive it. When you add a phone, the key is transferred device to device, not through us.
The consequence is the entire point. A subpoena served on HomeHover produces ciphertext we cannot read. There is no key escrow, no recovery service and no support tool that can open your recordings, which also means a compromise of our infrastructure does not expose your footage, because our infrastructure never had it.
The honest cost of this design: if you lose every enrolled device, your recordings are gone. We cannot recover them, and no future version of this company can either. That is the same trade Signal and Apple’s Advanced Data Protection make, and we would rather state it plainly than quietly keep a back door labelled account recovery.
The geofence
Your parcel boundary is written to the flight controller at setup and enforced there, below the level the companion computer or the app can reach. It is not a waypoint constraint that software agrees to respect. It is a limit the flight controller rejects commands against.
So a compromised app, a compromised dock, or a compromised HomeHover cannot fly Luna over your neighbour’s garden. Widening the boundary requires physical access to the aircraft.
What we collect
A short, boring list, on purpose.
- Firmware version
- So we can tell you when a fix applies to your dock
- Battery cycle count
- So a pack gets replaced before it fails, not after
- Motor and controller error codes
- So a degrading motor is a service call rather than a fall
- Patrol completed or aborted
- So a dock that quietly stopped working does not stay quiet
- Dock temperature and mains state
- So a dock that lost power tells you, rather than you finding out
No video. No stills. No audio. No detection contents. Nothing on this list can be assembled into a picture of what happened in your yard.
What is not built yet
Everything above is the specification we are building to. Luna is not shipping, so read this page as a commitment you can hold us to rather than a description of a device you can buy today. When hardware exists, this architecture goes to a third party for audit and their report gets published here whether or not it is flattering.
The wording is versioned for the same reason. Diff this page against what we say next year, and against the commitments, which are the part meant to outlive us.
Early access
Luna ships to the first 500 homes.
Join the list and you take a position. Refer someone and you move up it. No deposit, no card, and we will not sell your address any more than we would sell your footage.
Check your email
Your position is assigned the moment you confirm. Unconfirmed addresses do not hold a place, which is why the number on this page means something.