I've ranted about this and the IoT and how we've came to it. IoT is awesome, and super, as long as you don't buy products that require to beg for your data from some website API. What makes more sense? Local device ->Internet ->Someone else's server(cloud) ->API ->Your cell/computer -or- Local Device ->Local controller I extensively use Node-Red and Apache NiFi both. Node-Red is built on Node.js and is a graphical fl…
Hue's hub works both ways, locally Smartphone -> Hub over WiFi (via a shared LAN connection, the Hub isn't it's own WAP), or remotely Smartphone -> Hue.com -> Hub over the internet. The remote mode has profoundly more lag, but also means you can turn on your lights from anywhere. The connection from Hub to the bulbs is always Zigbee. Unless/until Zigbee is built into smartphones this seems like a nearly ideal set up.
I also use Node-red on a Raspberry Pi. It's slim and as small as a base station. I also have Bluetooth, wifi, and nRF24L01+ boards on it, talking all those protocols. No reason for Zigbee, but it would be doable for $15 (I assume the price).
I've found the "from anywhere", at least for Node-Red is to use a static IP. If you dont have that, a dynamic one will work. If that doesn't work, a ToR hidden service works well.
My control over my hardware is always advantageous over control by a 3rd party entity.