If you build a sleep, meditation, or "smart home" app that records audio, the most important architecture decision you will make has nothing to do with the ML model. It is whether raw audio ever leaves the device. Raw audio is your worst privacy liability. A ten-minute bedroom recording contains more about a person than their entire chat history. It reveals when they sleep, when they are sick, how many people are in the room, and in a surprising number of cases, the content of conversations happening at night. Up it "to the cloud for analysis" is a design decision that no privacy policy can walk back.
Tier 1 — Raw audio to the cloud. Simplest to build, hardest to defend. Every frame you upload is a legal and reputational time bomb. One breach, one subpoena, one angry reviewer with a decompiler, and you own the story.
Tier 2 — Features to the cloud. You run the classifier on-device and upload only the outputs: "snoring: 23 events", "deep sleep: 41%". This is what most serious sleep apps do. The privacy surface shrinks dramatically, but you still need to be honest about what the feature vectors could be reversed into.
Tier 3 — Nothing leaves the device. All analysis runs locally; the cloud only ever sees an anonymous aggregate or nothing at all. This is the position no one can attack you for.
The common objection is battery and CPU. On a modern phone it is far more tractable than people assume — if you structure the pipeline correctly:
We applied exactly this approach in SleepTrace, a no-wearable sleep tracker: the iPhone sits on the nightstand, the app records the night, and every stage classification and sound detection (snoring, gasping, sleep talking, grinding) happens on the device. Nothing is uploaded. The App Store page explains the privacy model up front — because that is the feature.
Privacy is not a cost center; it is the product differentiator for consumer health. Wearable makers have a hardware excuse to collect data. A phone app that records your bedroom has no excuse — and users know it. Making "nothing leaves your phone" a headline feature converts your biggest liability into your strongest pitch.
If you are building audio-based health software, decide on Tier 3 before you write the first classifier. Retrofitting privacy is a rewrite; building it in is a design statement.