Valetudo is free, open-source firmware ('a cloud replacement for vacuum robots') that a user flashes onto a supported robot vacuum to strip out the manufacturer's cloud dependency entirely, replacing it with a local-only web interface and MQTT/Home Assistant integration. It requires no account, no phone number or email, and its own documentation states the only two things that ever connect to the internet are an optional NTP client and a manual, user-triggered GitHub update check. Its own maintainer states plainly that the goal is to keep floor-plan and camera data at home rather than uploaded to a vendor's cloud. The project is a single-maintainer effort (GitHub user, not an organization) written in the first person by its creator, released under the Apache-2.0 license, with no registered legal entity, company, or nonprofit behind it — a real ownership-transparency wart the project itself does not hide. No published security advisory for the project was found on GitHub at draft time.
TIMELINE
1 ENTRY
[2026-08-31] · NEW RECEIPTS
7 new sources on file for Valetudo.
Valetudo's file gained 7 new sourced claims since its last review.
Valetudo's 'Why Valetudo?' documentation states that using Valetudo means a user never has to give anyone a phone number or e-mail address just to use the robot vacuum they bought, and frames this as privacy by design (citing the German word 'Datensparsamkeit').
Valetudo's own 'Why Valetudo?' page, written in the first person by its creator, states the project exists because the maintainer personally wanted a vacuum robot but did not want to be forced to install a vendor app — confirming the project is the work of a single named individual rather than a company or registered organization.
GitHub's API record for the Hypfer/Valetudo repository confirms the project is owned by a single GitHub user account (type 'User', not 'Organization'), is licensed under the Apache License 2.0, and is described by its own maintainer as 'Cloud replacement for vacuum robots enabling local-only operation' — no separate company, foundation, or legal entity is associated with the repository.
Valetudo's 'Why Valetudo?' documentation states that by removing cloud connectivity and not uploading data such as floor plans or robot-camera images to a vendor's servers, the risk of that data ending up in a third-party cloud bucket or leaking onto the internet becomes far less likely.
GitHub's Security Advisories page for the Hypfer/Valetudo repository shows no published security advisories, indicating a clean disclosed-vulnerability record at draft time, though without a named third-party audit or bug-bounty program to independently verify the codebase's security posture.
Valetudo's MQTT integration documentation states that connecting the robot to home automation software (Home Assistant, openHAB, Node-RED, or others) requires the user to configure their own MQTT broker address in Valetudo's web interface, confirming that home-automation integrations communicate with a broker the user controls on their own network rather than a Valetudo- or vendor-operated cloud service.
Valetudo's FAQ states that only two things in the entire system ever connect to the internet: an NTP client (which can be disabled or pointed at a local time server), and the update checker, which only ever contacts the GitHub API when the user explicitly clicks 'Check for Updates' — no background telemetry, analytics, or automatic phone-home mechanism is disclosed.