Privacy layers: how to sell a robot that watches the room without being creepy

A companion robot with a camera and a radar faces a trust problem long before it faces a technical one. Buyers ask: is it watching? Who can see? Can I turn it off? Products that answer with architecture sell; products that answer with marketing copy churn.

Layer 1: hardware mute

The strongest answer is physical: a camera shutter, or a mode where the radar runs and the camera’s power rail is cut. Mechanical choices communicate in a way settings menus never do — the user can see that the lens is covered.

Layer 2: on-device inference

Detection runs on the device; raw video never leaves it. What travels upstream is metadata — event type, timestamp, confidence — plus, when the user opts in, a snapshot. This is also the cheapest architecture to defend in regulatory review.

Layer 3: transport

Device-initiated TLS connections, authenticated endpoints, replay protection. The device pushes to the cloud, not the other way around; there is no path for the cloud to open the camera.

Layer 4: accounts

Family members see different things: a caregiver sees alerts, a parent sees history, a guest sees nothing. Access is scoped and revocable, and revocation takes effect on the device, not just in the dashboard.

Privacy is a selling story, not a compliance tax

We build these layers into hardware proposals from the start because they change component selection (a shutter is a part; radar-only mode is a firmware power state). Clients who present the four layers in their launch material consistently see fewer returns and better reviews than those who treat privacy as a settings page.