How to Build a Privacy Threat Model for Home Companion Robots

Companion robots function as small distributed systems, combining onboard sensors, mobile apps, cloud services, and third-party SDKs — each introducing distinct privacy risks. A practical threat-modeling approach maps five key components: the physical robot, home network, companion app, vendor cloud, and external parties. Developers and buyers are advised to trace every data flow from sensor to storage, asking whether processing could happen locally, whether active sensors are clearly indicated, and how long data is retained. Sensitive risks include guests being recorded unknowingly, compromised accounts exposing interaction history, and discarded devices retaining maps or user tokens. The framework recommends evaluating concrete threats across prevention, detection, and recovery to make privacy controls reachable, understandable, and verifiable.