Private by design

An appliance that connects to the internet from inside a home has to answer for what it sees and what it says. Genie's answer is short. It sees its own energy use and its own health. It says the same. Nothing about the home network, the devices on it, or the people in the house is part of what Genie knows, and so none of it can be part of what Genie shares.

What Genie knows about the home

Genie watches the home's energy flow, because that is how it tells surplus from shortfall. That reading is about electricity: what the panels are making against what the home is using. It is not a picture of which appliance is running or who is in which room. Genie uses it to decide whether to draw power and for nothing else.

Genie does not look at the home network. It does not inventory the devices connected to the router, inspect their traffic, or notice when a phone comes and goes. It does not watch the people in the house, and it is not built to want to. The household is not data to Genie.

What leaves the house

Genie reports its own energy use and health. That is the complete list. The energy report is what makes the app's figure for energy used truthful, and the health report is what lets a fault be noticed. There is no other category of information leaving the appliance.

The sealed jobs that leave the house are not the home's data either. They arrive encrypted from E31 Cloud, run without Genie or the household being able to read them, and return encrypted. The customer can verify exactly what ran. The household provides surplus and an internet connection, and the job provides nothing to the household and takes nothing from the home.

Outbound only

Genie makes only outbound connections and never accepts incoming ones. It reaches out to E31 Cloud to fetch work and to deliver results; nothing reaches in. This is a design property, not a firewall rule the household has to maintain. There is no port to forward and nothing listening for a connection from outside.

An appliance that never accepts an incoming connection is an appliance that cannot be used as a door into the home network, because it has no door. That is the whole reason for the rule. It also means Genie needs nothing more than an ordinary home internet connection, with no special setup on the router.

Privacy in both directions

The same design that keeps the home private from the work keeps the work private from the home. Genie cannot read the jobs it runs, and the jobs cannot see the home they run in. Element 31 built it this way because the alternative, a machine that could see either side, would be unacceptable to the business sending the work and to the family hosting the machine, and no amount of policy would make it acceptable.

The household can turn Genie off at any time, for as long as they like, with no penalty; nothing runs and nothing is earned while it is off. That is the final privacy guarantee: the machine is in the house on the household's terms. Genie is in development, and these rules are listed with the rest on the principles page. For how a sealed job moves through the machine, see Jobs that arrive sealed and leave sealed, and for the complete account of what Genie needs and leaves alone, see that article.