The most important design decision in sharm is what never leaves your device. A look at the on-device redaction moat.
A model that watches your life is only acceptable if it forgets on your terms. sharm's perception layer runs detection, recognition and redaction on-device, so raw frames are transformed into abstract world state before anything is ever transmitted.
This isn't a policy promise — it's an architectural invariant, enforced by tests: the raw signal has no code path across the network. Cloud compute sees redacted representations, never the original moment.
Privacy-first isn't a feature we added. It's the shape of the system.