The privacy claim is a design claim, and a design claim is only worth what the source backs. The firmware is open source under the MIT license. Read it.
What to look for
The claim is that the device makes no outbound connection beyond DNS forwarding. To verify it, look for any code that opens a socket, sends an HTTP request, or writes to a network that is not the local DNS port. In MicroPython that means searching for socket, urequests, urequest, http_client, and anything that constructs a URL with a hostname.
The entry point
The firmware is a single main.py plus a lib/ directory of modules. Start at main.py and follow the boot path. Unprovisioned devices enter the provisioning loop over USB. Provisioned devices bring up Wi-Fi, start the DNS server on port 53, start the HTTP API on port 8080, and enter the main loop. Everything that runs is reachable from that path.
The network surface
Two sockets exist by design. The DNS server listens on UDP 53. The HTTP API listens on TCP 8080. Both are bound to the local network. The DNS server forwards queries to 1.1.1.1 and 8.8.8.8 — that is the only outbound traffic the device initiates. If you find a third socket, or an outbound connection that is not a forwarded DNS query, that is the thing to question.
Where the log lives
DNS queries are written to /dnslog.json on flash. The file is local to the device. There is no code that uploads it, because there is no server to upload to and no credentials to authenticate with. Clearing it is a route on the HTTP API — a local call, not a remote one.
If the claim were false, it would be a handful of lines in the source. It is not. That is the audit.
Key storage
Device identity keys live in the RP2350's one-time-programmable memory, never read back over USB. The certificate is signed at manufacturing with a root key that never leaves the manufacturing machine. You can verify the layout in otp_keys.py — the offsets are fixed and the test suite locks them.
What you will not find
- No analytics SDK.
- No crash reporter.
- No "check for update" call to a vendor server.
- No telemetry, no metrics, no heartbeat.
- No code that reads the DNS log and sends it anywhere.
If any of those appear in a future revision, they will be visible in the diff. That is the point of open source — the guarantee updates in public.