It first detects its wake word using pocketsphinx on around the last two seconds of audio. Audio older than two seconds is discarded. After detecting its wakeword it begins recording until when it thinks the user has finished speaking.
I believe the Poketsphinx part is offline so only commands would be delivered to Google.
Another comment mentioned that they use some Google speech recognition component, which probably means all of your conversations are delivered to Google. That's a big red flag for me.