Why I'm building a safety sensor that physically cannot spy

My first design for this product was a camera disguised as a smoke detector.

I want to be honest about that, because the story of why that design died explains everything about what I'm building now.

Where it started

Like a lot of side projects, this one started with worry. I wanted to know that the people I love are okay — a baby in a crib at first, and then, the more I looked at it, the bigger version of the same worry: a parent getting older, living alone, and the question nobody likes saying out loud — what if they fall and nobody knows?

The obvious answer is a camera. The obvious answer is also the problem.

The design that died

The v0 concept was, frankly, a gadget-lover's design: a Raspberry Pi, a camera, and a 3D-printed enclosure that looked exactly like a smoke detector. Hidden in plain sight. I was proud of it for about a month.

Then I did the research properly, and the disguise was the first thing to die. Not because it wasn't clever — because it was wrong, in three separate ways:

• Legally, a hidden camera in a bedroom is radioactive. In the Netherlands, where I live, the data-protection authority's position is that cameras in care bedrooms are in principle not permitted, and covert monitoring of people with dementia runs into the Care and Coercion Act. Multiple US states have explicit consent statutes for exactly this. A product built on concealment is a product built on a liability.
• Ethically, the person being watched has the most at stake and the least say. Disguising the device takes their say away entirely.
• Commercially, trust is the entire product. You cannot build trust with a device whose first design decision is deception.

So: no disguise. The device I'm building now is a visibly-branded sensor on the ceiling. Everyone in the room knows it's there and what it does. It turns out that's not a compromise — it's the point.

The bigger problem with cameras

Killing the disguise forced a harder question: even an honest camera that streams video to a cloud is a problem. Not hypothetically — as a documented pattern:

• In 2023 the US FTC settled with Ring over employees and contractors accessing customers' private videos (FTC, May 2023).
• In February 2024, a cloud-camera glitch showed roughly 13,000 Wyze customers thumbnails from strangers' homes (Washington Post).
• In 2022, eufy — marketed as "local" — was found sending unencrypted streams reachable from the cloud (Gizmodo).

These companies fixed their specific failures. The pattern is the architecture: if video leaves the home, someone other than you can see it — an employee, an attacker, a subpoena, a bug. EU regulators have reached the same conclusion from the other direction: the new radio-equipment security rules (EN 18031) explicitly single out childcare monitoring devices as a class needing heightened protection.

I don't want to build a better-defended version of that architecture. I want the failure mode to not exist.

Privacy by architecture

So here is the design principle the whole product now hangs on:

The judgment happens on the device. Only alerts leave.

A small AI model runs on a ~1-watt chip inside the sensor itself. It looks at the room so that no person has to. When it sees what looks like a fall, or hears a sound worth checking — a cry, breaking glass — it sends an alert: a short message, "please check on the bedroom." By default, no video leaves the device. In the care-organization mode there is no live viewing capability at all — there is literally no feature for a human to watch the room through.

I'm deliberately not going to claim this is "unhackable." Nothing is, and companies that say otherwise tend to get educated in public. What I'm claiming is narrower and verifiable: in its strictest mode there is no video stream to intercept, no cloud video account to break into, and no recording for anyone to leak. That's not a security promise; it's a data-flow fact. When the product exists, run a packet capture on it — you should find alerts and heartbeats, nothing else. I intend to make that an open, standing invitation.

What I'm building, concretely

A ceiling-mounted sensor — working name Zenith Safety Sensor — aimed first at elderly safety: people aging at home, adult children who worry, and eventually care organizations drowning in staffing shortages. A child-safety mode on the same hardware comes later. It sends fall-like-event and sound-event alerts, faster than waiting for someone to be found. To be precise about the promise, because precision matters in this category: it's awareness, sooner. It does not prevent falls and it is not a medical device — no sensor is a substitute for human care.

This might not work, and I'll publish either way

The honest engineering problem: looking straight down at a room is exactly the view most person-detection models are worst at — they're trained on photos taken from human height. The commercial ceiling products that work either use special geometry or trained their own models on overhead data. I'm about to find out what a €33 board with an NPU can actually do about that.

So the next post is the test everyone should demand of a claim like mine: a Luckfox RV1106 board and a fisheye lens on my own ceiling, benchmarked against pass/pivot/kill criteria that I wrote down before the hardware was ordered — including the false-alarm counts, which the industry never publishes and which I think is exactly why you should want to see mine.

If the numbers are bad, you'll read the bad numbers here.

— JP