Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The best private replacement depends on what you want the assistant to do. Choose Home Assistant with a local voice endpoint for smart-home control, OpenVoiceOS for an open and extensible voice-assistant operating system, or self-hosted Open Assistant for broader connections to email, calendars, files, notes and messaging. None is automatically private simply because it is open source or self-hosted: speech-recognition engines, plugins, integrations, logs and optional cloud services determine where your data goes.
This guide compares those three approaches, explains what “local” really means, lists the hardware you need, and gives a practical way to build and audit a voice assistant that does not routinely send conversations to a vendor’s cloud.
As an Amazon Associate I earn from qualifying purchases.
What makes a personal assistant private?
Privacy is a property of the complete configuration, not a permanent feature of a product name. A voice assistant can run on your own computer while still sending audio to a remote speech-to-text service. Conversely, a local smart-home controller can keep device commands and history on your network while using an optional cloud service for one feature you explicitly enable.
Assess a proposed setup at five points in the data path:
#1 Best Overall
- Home Assistant provides a professional and reliable platform for home automation, designed to run continuously 24/7.
- Powered by a 64-bit Quad-Core Cortex-A53 processor, delivering smooth and efficient performance for smart home automations.
- Includes 4GB SDRAM for reliable multitasking and 64GB eMMC
- Features a Mali-450 MP2 GPU for responsive visual interfaces, housed in a compact 85 × 85 × 15mm (3.35" × 3.35" × 0.59") design that fits easily in any space.
- Typical power consumption is under 10W, with fanless operation for quiet performance suitable for any room in your home.
- Wake-word detection: determine whether the microphone is continuously streaming audio or only reacting locally to a wake word.
- Speech recognition: identify the engine that converts speech to text. It may run on the endpoint, on your home server, or on a public server.
- Intent handling: check where the command is interpreted and which model or service receives the transcript.
- Integrations: inspect every connected calendar, mail account, file store, messaging service and smart-home device. Each may have its own retention and access rules.
- Logging and updates: find out where transcripts, recordings, device states and diagnostic data are stored, and whether updates change the selected provider.
Home Assistant’s privacy policy states: “We only ask for personal information where there is a clear purpose for doing so, and we aim to minimize the personal data we collect.” Its policy also distinguishes the non-commercial project from the separately operated Home Assistant Cloud service. That distinction matters: the core software and an optional cloud account are different parts of the system.
Quick comparison
| Option | Best fit | What can stay local | Main limitation |
|---|---|---|---|
| Home Assistant + Voice Preview Edition | Local smart-home control with a purpose-built voice endpoint | The core system, supported device traffic and local protocols such as Zigbee, Z-Wave, Matter, Thread and ESPHome can operate on your hardware without internet access. Cloud features are optional. | Local speech coverage varies by language and capability; some languages and functions are better supported by Home Assistant Cloud. |
| OpenVoiceOS | Tinkerers who want an open, customizable voice-assistant operating system | A fully offline design is possible when every speech, wake-word, intent and text-to-speech plugin is self-hosted or offline. | The default ovos-stt-plugin-server sends audio to a public Whisper server, so plugin selection requires deliberate auditing. |
| Self-hosted Open Assistant | Broader personal productivity across email, calendars, files, notes and messaging | The self-hosted core can run on your infrastructure without a subscription or vendor lock-in. | Connected services such as Gmail, Outlook, OneDrive, Notion and WhatsApp retain their own data practices; self-hosting the assistant does not make those providers local. |
Home Assistant: the practical choice for a private smart home
Why it fits this use case
Home Assistant is designed first as a home-automation platform rather than a general chatbot. It runs on hardware you control, stores its data locally by default, does not require a cloud account, and can communicate with supported devices over local protocols. Zigbee, Z-Wave, Matter, Thread and ESPHome can be used without an internet connection when the devices and their bridges are configured locally.
Recommended Free Tools
That architecture makes it the strongest choice when your main requests are operational: turn lights on, adjust a thermostat, report a sensor value, lock a door or run a scene. It is less suitable when the primary goal is open-ended conversation, research or managing a large set of personal documents.
Voice Preview Edition and local speech options
Home Assistant Voice Preview Edition is a dedicated physical voice endpoint built around the project’s local and private voice-assistant goal. It can act as a microphone and speaker for an Assist pipeline running in your Home Assistant installation, so the endpoint does not need to send every command to a vendor-controlled assistant.
Home Assistant documents two local speech paths:
- Speech-to-Phrase: a compact, local recognizer intended for defined home-control phrases. It can be fast and lightweight, but its language and command coverage are narrower than a general speech model.
- Whisper running locally: a more general speech-recognition option that can cover broader wording, at the cost of more processing and potentially greater latency. Language support and hardware requirements vary.
Some languages are better supported by Home Assistant Cloud. Treat that as an explicit trade-off rather than assuming that every language can use the same offline pipeline. You can keep the rest of the system local while enabling cloud speech for only the languages or capabilities that require it.
Rank #2
- Custom fit design provides a snug and secure hold for your compatible with Home Assistant Green, ensuring stability and easy access at eye level.
- Space-saving wall installation helps declutter surfaces by moving your smart home hub off counters and onto the wall for a cleaner setup.
- Durable construction crafted for reliable long-term use with quick and straightforward mounting on various wall surfaces.
- Sleek minimalist style complements modern home aesthetics while keeping ports and displays accessible.
- This product is a third-party accessory designed to be compatible with Home Assistant. Our products are not affiliated with, authorized, or endorsed by it and are mentioned for compatibility purposes only.
How to set up a local Home Assistant voice pipeline
- Install Home Assistant on hardware you control. Use a supported small computer, virtual machine or other host that remains on your home network. Keep the host on a wired network where practical and restrict administrative access to your LAN or a secure remote-access method.
- Pair devices using local protocols. Prefer Zigbee, Z-Wave, Matter, Thread or ESPHome paths that communicate with your local controller. Verify that a device does not silently require a manufacturer cloud account for ordinary operation.
- Connect the voice endpoint. Add Voice Preview Edition or another compatible microphone and speaker endpoint to the local installation. Treat each satellite as an endpoint that can be independently muted or removed.
- Create or edit an Assist pipeline. In Home Assistant’s voice-assistant settings, select a local speech-to-text engine, intent language and local text-to-speech engine where available. Do not enable a cloud provider merely because it is the default.
- Choose the narrowest engine that meets your needs. Use Speech-to-Phrase for a defined set of home commands. Choose local Whisper when you need more natural wording and your host can process it reliably.
- Test with the network disconnected. Turn off the host’s internet route temporarily and try representative commands. A command that still works demonstrates local operation for that path; a failure identifies a dependency that must be replaced or accepted.
- Review logs and integrations. Check Home Assistant logs, the voice pipeline configuration and each integration’s documentation for outbound connections. Repeat the review after adding a new device, custom component or cloud service.
Where Home Assistant can still send data
Home Assistant’s core can operate without a required cloud account, but optional services change the data path. Cloud speech, remote access, weather feeds, music services and manufacturer integrations may transmit text, audio, account identifiers or device states. Enable only the services you need, and record which functions depend on them so an outage or policy change does not surprise you.
Free tools Windows power users keep installed
One-click scans. No signup required.
OpenVoiceOS: an open voice platform for builders
What it offers
OpenVoiceOS describes itself as “a community-driven open-source project dedicated to creating a secure, private, and customizable voice assistant operating system that respects user privacy and freedom.” It is closer to a voice-assistant platform than a preconfigured smart-home appliance. You can assemble wake-word detection, speech recognition, intent handling, skills and text-to-speech components to match your hardware and preferred services.
This flexibility is its advantage and its responsibility. A platform can be private only when every plugin in the chain is private. An offline wake word paired with a remote speech recognizer is still a cloud-dependent design.
The default Whisper plugin warning
OpenVoiceOS’s technical security documentation warns that the default ovos-stt-plugin-server communicates with a public Whisper server. Audio therefore leaves the device. Anyone requiring local processing must replace that plugin with a self-hosted Whisper service or a fully offline speech-recognition plugin, then verify that the replacement does not call a remote endpoint.
This is a useful example of why “open source” and “offline” are not synonyms. The operating system can be privacy-focused while a convenient default component sends data away from the home.
Rank #3
- [Multi-Protocol Hub with Matter Bridge] The Aqara Hub M200 is a versatile smart hub that supports multiple advanced features, acting as a Matter Controller, Thread Border Router, and Matter Bridge. It integrates third-party devices into the Aqara Home app. With advanced Matter bridging functionality, it syncs Aqara-exclusive features with ecosystems like Home Assistant, Apple HomeKit, Alexa, and Google Home for seamless integration. Supports up to 40 Aqara Zigbee devices and 40 Thread devices.
- [Smart IR Blaster with Feedback and Learning] The 360°IR blaster not only sends commands but also provides accurate status updates by detecting traditional remote use. It connects IR air conditioning units to Matter, functioning as an AC thermostat when paired with an Aqara Temperature and Humidity Sensor. (Note: Only one AC device can be exposed to Matter. Functionality may vary based on the Matter integration app. For Apple Home exposure, use Matter integration instead of HomeKit.)
- [Wired & Wireless Connectivity with PoE Support] Enjoy flexible setup with dual-band Wi-Fi (2.4/5 GHz) using advanced WPA3 security, and Power over Ethernet (PoE), making the M200 a versatile PoE Ethernet Smart Home Hub. The USB-C port supports mini-UPS or power bank connections for uninterrupted operation, ensuring your energy-saving and security automations stay online. (*2A USB power adapter is not included. )
- [Home Automation and Alarm System] Works with all Aqara devices to create a comprehensive, smart home automation system. The Aqara Hub M200 is equipped with a built-in speaker that can be used in a variety of ways: security alerts, doorbell, alarm clock, and custom audio messages. (** 𝐍𝐨𝐭 𝐭𝐡𝐢𝐫𝐝-𝐩𝐚𝐫𝐭𝐲 𝐙𝐢𝐠𝐛𝐞𝐞 𝐝𝐞𝐯𝐢𝐜𝐞𝐬)
- [Local Automation for Reliable Performance] Supports local execution of automations for Zigbee and Matter devices, ensuring smooth operation even without Wi-Fi or cloud access. Enjoy millisecond response times for a more stable and reliable smart home experience. (Some automation, such as cloud push notifications, will still require the cloud connection to be executed.)
OpenVoiceOS setup sequence
- Select the host and audio hardware. Choose a supported computer or single-board system, a microphone with clear pickup and a speaker or audio output. Keep the host on a network segment where you can monitor outbound traffic.
- Install the OpenVoiceOS image or packages. Follow the project’s installation method for your hardware and change the default credentials immediately.
- Map the complete voice pipeline. List the wake-word, speech-to-text, intent or skill, and text-to-speech plugins before enabling them. Note whether each component is local, self-hosted on your network or remote.
- Replace remote speech defaults. Do not use
ovos-stt-plugin-serverwhen audio must remain on-device. Configure a self-hosted Whisper deployment or an offline plugin instead. - Restrict outbound access. Use router or firewall rules to block internet access for the assistant host, then add only the destinations required for updates or deliberately selected services.
- Run offline tests. Disconnect the internet and test wake word, transcription, intent execution and spoken response separately. A failure in any stage identifies a hidden dependency.
- Audit after updates. Plugin defaults and endpoints can change. Recheck configuration files, release notes and network connections whenever you update the operating system or a skill.
Self-hosted Open Assistant: broader productivity, more integration risk
What it is intended to do
Open Assistant’s official site presents a self-hosted assistant that can connect to email, calendars, files, notes and messaging. This makes it the most relevant option when “personal assistant” means finding information across your accounts, preparing a calendar action or retrieving a note—not only controlling lights.
The self-hosted core is described as requiring no subscription or vendor lock-in, with the core deployment staying on the user’s infrastructure. That protects the assistant service itself from a third-party hosting provider, but it does not override the policies of services you connect.
Connected accounts remain separate privacy domains
If Open Assistant connects to Gmail, Outlook, OneDrive, Notion, WhatsApp or another provider, that provider still processes the account data under its own terms. A locally hosted interface may fetch a message, calendar entry or document into your server’s memory and logs; the original provider may retain copies, metadata and access records.
Use least-privilege credentials, separate accounts where possible and narrowly scoped permissions. Avoid granting full mailbox, drive or messaging access when a read-only calendar or a single folder is sufficient. Decide how long the assistant should retain imported content and disable transcript logging for sensitive workflows when the software allows it.
Practical deployment steps
- Define the tasks first. Separate read-only searches from actions such as sending mail, editing events or posting messages. Start with read-only access.
- Host the core on your infrastructure. Place the service on a machine with encrypted storage, regular backups and an account model that separates administration from everyday use.
- Add one integration at a time. After each connection, inspect the permissions requested, tokens stored and data written to logs.
- Protect credentials. Keep service tokens in the deployment’s secret store or environment configuration rather than in prompts, notes or source files. Rotate them if a device is sold, compromised or repurposed.
- Test destructive actions manually. Require confirmation before sending messages, deleting files, changing appointments or controlling security devices.
- Review provider policies. Self-hosting the assistant does not make third-party account data private from those providers. Revisit permissions when a provider changes its API or retention terms.
Hardware: what you actually need
There is no single required hardware specification for all three approaches. The right choice depends on whether speech recognition runs on an endpoint, on a local server or through a cloud service.
Rank #4
- 💡 EASIEST WAY TO GET STARTED WITH HOME ASSISTANT - With Home Assistant already installed, it only requires plugging the included power supply and Ethernet cable to get started.
- ✅ OFFICIAL - This official Home Assistant hardware is built and supported by Nabu Casa, the team driving the development of Home Assistant.
- 🏡 DESIGNED FOR THE HOME - The small, fanless, and silent design packs a quad-core processor, 32GB of storage, and 4GB of RAM.
- 📱 ONE HUB TO CONTROL THE WHOLE HOME - Cut down hub and app clutter and control your whole home from Home Assistant Green.
- 🤖 AUTOMATE EVERYTHING - Make all the devices in your home work in harmony - have your lights dim when you start watching a movie, or turn off your heat when you’re away from home.
| Component | Purpose | Privacy considerations |
|---|---|---|
| Local host | Runs Home Assistant, OpenVoiceOS services or Open Assistant | Use hardware you control, encrypt storage, restrict administration and plan for updates and backups. Processing-heavy local speech may need more CPU, memory or acceleration than simple home-control intents. |
| Microphone and speaker endpoint | Captures requests and returns spoken responses | Provide a physical mute control where possible; place endpoints away from private conversations and treat each room as a separate trust boundary. |
| Zigbee, Z-Wave, Matter or Thread radio | Connects compatible smart-home devices locally | Choose a coordinator and devices that continue operating locally rather than requiring a manufacturer account. |
| Network equipment | Connects endpoints, servers and devices | Use separate network segments or firewall rules for IoT devices, assistant hosts and personal computers. Monitor unexpected outbound traffic. |
Exact purchase prices, marketplace availability and seller terms for Voice Preview Edition and related accessories are not established here. Verify current availability directly before buying. Home Assistant identifies Connect ZBT-2 and Voice Preview Edition as accessories, while its privacy guidance lists the local protocols above; compatibility still depends on the specific device and integration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing between the three approaches
Choose Home Assistant when
- Your priority is lights, climate, sensors, scenes, locks or other home automation.
- You want a supported local controller with optional cloud features rather than an entirely DIY voice operating system.
- Your preferred language and commands work with Speech-to-Phrase or local Whisper, or you accept cloud speech for selected cases.
Choose OpenVoiceOS when
- You want to assemble and modify the full voice stack.
- You are comfortable checking plugins, editing configuration and troubleshooting audio or network dependencies.
- You require an offline design and are prepared to replace the default public Whisper server plugin.
Choose self-hosted Open Assistant when
- Your assistant must span mail, calendars, files, notes and messaging.
- You can administer credentials, backups, updates and access controls.
- You understand that every connected provider remains a separate privacy boundary.
A privacy-first build plan
- Write a data-flow map. For each request, record where audio starts, where text is produced, where the intent is interpreted, which service receives the command and where logs are stored.
- Set a no-cloud baseline. Start with the internet disconnected. Enable only local functions that work, then add a cloud dependency only when its benefit justifies the data disclosure.
- Use minimal permissions. Give integrations the smallest scope possible, separate read and write actions, and require confirmation for irreversible operations.
- Control retention. Remove stored recordings and transcripts you do not need. Protect backups because they may contain the same sensitive history as the live server.
- Monitor egress. Review router logs or firewall alerts after installing a plugin, integration or update. Unexpected outbound traffic is a reason to disable and investigate the component.
- Document the configuration. Keep a private inventory of enabled speech providers, integrations, tokens, local protocols and cloud features. This turns “private” into an auditable state rather than an assumption.
Common failure modes and fixes
“It works locally, but only when the internet is connected.”
The speech recognizer, text-to-speech engine, device integration or authentication flow is probably remote. Disconnect the network and test each stage separately. Replace the remote component with a local or self-hosted alternative, or mark the feature as intentionally cloud-dependent.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute“The assistant understands commands but cannot handle my language.”
Local language coverage differs by engine and capability. Home Assistant documents that some languages are better supported by its cloud service. You may need a different local model, narrower command vocabulary or an explicit cloud exception. Do not claim the whole system is offline if only one language uses a remote provider.
“A new plugin changed the privacy posture.”
OpenVoiceOS demonstrates this risk: a default plugin can send audio to a public server even when the platform’s mission is privacy. Recheck endpoint URLs and plugin documentation after every update, and block network access until the component is verified.
“The assistant exposes too much of my account.”
Remove broad permissions and reconnect with a dedicated account or limited folder. Separate read-only retrieval from actions such as sending messages or deleting files, and require confirmation for those actions.
Best Value
- EASIEST WAY TO GET STARTED WITH HOME ASSISTANT: With Home Assistant already installed, it only requires plugging the included power supply and Ethernet cable to get started
- DESIGNED FOR THE HOME: The small, fanless, and silent design packs a quad-core processor, 32GB of storage, and 4GB of RAM
- ONE HUB TO CONTROL YOUR WHOLE HOME: Simplify your smart home with HA70. Built with official Home Assistant OS and a professional Zigbee coordinator, it brings local control, powerful automation, and seamless device management into one compact hub
- AUTOMATE EVERYTHING: Make all the devices in your home work in harmony - have your lights dim when you start watching a movie, or turn off your heat when you're away from home
- YOUR HOME, YOUR DATA: Your home's data will be kept in the home on your HomeAssistant. You can easily view, share, and export that data anywhere you want
“Voice activation picks up private conversations.”
Use hardware mute controls, place endpoints carefully and disable rooms that do not need voice control. Review stored audio and transcripts, and avoid putting a microphone in spaces where confidential discussions occur.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What “private” should mean in your final configuration
A defensible privacy claim is specific: for example, “Home Assistant controls my Zigbee lights locally; Speech-to-Phrase handles English commands on the home server; cloud speech is enabled only for a second language; my calendar integration is read-only.” That statement is more useful than saying an assistant is simply private.
Before relying on any replacement, verify the complete chain:
- Which components receive raw audio?
- Which components receive transcripts or documents?
- Can the core functions operate with the internet disconnected?
- Which integrations retain data under their own policies?
- Where are logs, tokens, backups and model caches stored?
- What changes when software or plugins update?
For most households, Home Assistant provides the clearest path to local voice control. OpenVoiceOS is the better fit for people who want to engineer the voice stack themselves and can avoid its remote default plugin. Self-hosted Open Assistant is the broadest productivity option, but its privacy boundary ends at each connected email, calendar, storage or messaging provider.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
