Room meshes should stay on the headset by default

I think room meshes should remain on the headset unless a user deliberately chooses otherwise. Shared AR needs a common coordinate frame, but that does not automatically mean uploading a persistent scan of someone’s home, office, or a public interior. Devices can exchange temporary spatial anchors and selected, derived geometry; ARKit’s peer-to-peer collaborative sessions already demonstrate that nearby devices can share environment and anchor data without making a cloud copy mandatory.

There are real trade-offs. Cloud-held representations may make persistence, heterogeneous-device alignment, accessibility features, and remote debugging easier. But “easier” is not the same as necessary, and a mesh can reveal walls, doors, furniture, dimensions, and routines. Who retains each copy—the app, platform, networking provider, or debugging system? How long does it survive, and can deletion be independently verified? Is local-only mapping realistic for social AR, or will useful shared worlds inevitably require a cloud-held copy of the room?

The minimum useful object is probably not “the mesh” but a session-specific coordinate frame plus enough geometry to reject bad matches. That can be exchanged locally. The hard case is relocalization after everyone leaves, where texture and dense features are convenient. Convenient, though—not proof that the raw environment belongs in a durable service.

Persistence is where the product pressure appears. People expect a shared object to still be in the right place tomorrow, on another device, for another participant. Local-only can work for a room full of people right now; the question is whether users accept a less magical experience when the host headset is gone.

The distinction between technical possibility and universal sufficiency matters here. Apple documents peer-to-peer collaborative data exchange, and Meta documents local multiplayer with shared spatial anchors. Neither establishes that local-only mapping meets every accessibility or long-term persistence requirement. So I support the default, but not the claim that the trade-offs are solved.

My threat model counts every derived representation as sensitive until shown otherwise. A semantic room model may be less revealing than a point cloud, but it can still expose occupancy patterns and physical constraints. Also, deletion from the primary database says little about caches, logs, crash reports, or developer exports. The copy inventory is the real feature.

Accessibility is the strongest counterargument, in my view. A service might need a stable shared description so assistive features behave consistently across devices. But that argues for minimizing and explicitly sharing a representation, not silently collecting the whole room. Consent should cover the semantic model too, not just the camera permission.

For a small team, cloud debugging is brutally useful. Reproducing “the anchor drifted near the sofa” from a few device logs is much easier than asking users to recreate the room. I still prefer local by default, but I’d want a user-controlled diagnostic bundle with a clear expiry, rather than pretending developers can debug blind.

I’m less confident that “derived geometry” is a clean boundary. To align mixed hardware reliably, the system may need precisely the visual detail the proposal wants to avoid. If every app invents its own lossy summary, interoperability suffers. Perhaps the better demand is cryptographic retention controls and narrow purpose limits, not local-only as a universal rule.

This sounds like a good local-first design: ephemeral peer exchange for the live session, optional user-owned export for persistence, and cloud services treated as sync rather than the source of truth. The protocol boundary matters. If the only supported path is “send the scan to our server,” deletion settings are mostly theater.

Enterprise buyers will ask for auditability, recovery, cross-site administration, and support access. A headset-only default complicates all four, especially when the mapped space is part of a workplace workflow. Still, governance requirements are not a blank check for raw scans. Retention, access, and export need to be contractual and technically enforceable.