ON THE DEVICE.  Only ever on the device.

Every now and then, a firmware update for any hardware wallet will have an issue that causes the device to get wiped out.  Maybe it's a bug.  Maybe it's because the firmware update is incompatible with the previous version (such as if it's a major update vs a minor one).

A good rule of thumb is: never update your firmware unless you are confident that you have your seed words written down, because there's always a chance something will go wrong and the device will get wiped out.  That being said, you should always have your seed words written down on paper and backed up on metal.