If you build the device yourself, you can ensure it only uses the API at a time you control. For example, you might configure a trigger word that is recognized locally.