No images stored or sent
No frame, face crop, landmark set or video is ever written to disk, logged or sent. Only anonymous counts leave the device.
Testedtest_no_image_persistence_calls_in_device_code
Privacy by design
The camera sees people. Nobody else does.
adDevice analyses each frame in memory on the device, wipes it, and sends only anonymous counts. The guarantees below are written into the product's code and checked by automated tests on every change.
Frames wiped in memory
Each camera frame and every copy used for analysis is zeroed as soon as the analysis finishes.
Testedtest_wipe_zeroes_frame
No recognition
Faces are followed from frame to frame by position only. There is no face recognition and no re-identification. Temporary IDs stay in memory and are dropped when the person leaves.
Payloads checked at every step
Every payload is checked against a fixed schema that rejects any extra field, and checked again for smuggled data before it is sent. The server validates it a third time.
Testedtest_guard_blocks_smuggled_data_in_string
Two outbound connections only
One posts the anonymous statistics, the other downloads your playlist. The playlist code cannot touch the camera code, and vice versa.
Testedtest_only_http_sink_and_content_sync_talk_to_network
Demographics are opt-in
Age band and gender are off by default. When on, each person becomes one fixed label on a temporary track. Only counts per group are sent, and groups under 5 people are hidden on the dashboard.
Testedtest_demographics_are_fixed_labels_and_counts_only
Data flow
Exactly what leaves the device
Sent, every 10 seconds
- Device name and the time window (10 seconds)
- Counts: people present, glances, viewers, engaged viewers
- View durations and attention per ad
- Gaze seconds per cell on a coarse 32 × 18 grid, and per area of interest
- Which ad was on screen, for how long, and how many plays
- Opt-in: counts per age band and gender
Never stored or sent
- Images, video or face crops
- Face landmarks or embeddings
- Identities or IDs that follow a person
- Positions over time or movement paths
- Exact ages or model probabilities
Any field outside the fixed schema is rejected on the device and again on the server. On the device, the only files written are two alignment angles and your downloaded ad files, which are kept only if their checksum matches.
Age and gender
Off by default. Counts only when on.
If your privacy notice covers it, the device can estimate an age band and gender per viewer. Each person becomes one fixed label on a temporary track, dropped when they leave. Only counts per group are sent, and the dashboard hides any group with fewer than 5 people.
GDPR
The device sends no personal images and no identifiers. Age and gender estimation is off unless you turn it on, so you can match the setup to your lawful basis and signage notice.
BIPA and similar laws
No face geometry is stored or sent, and there is no recognition. Because estimating age and gender from a face is regulated in places such as Illinois, it stays off unless the site's notice covers it.
Small audiences
At very low traffic one 10-second window can describe a single person. That is anonymous, but someone who was there could link it. For dashboards shared outside your team we recommend a minimum count.
This page describes how the product works. It is not legal advice.
Honest limits
What we don't control
We would rather tell you than have you find out.
- The camera library keeps its own short-lived internal copy of each image during analysis, outside our control.
- A local debug view exists for installers and is switched off on production devices.
- Age and gender are statistical estimates with known error, larger for some groups. Treat them as trends, not facts about individuals.
Ask us anything about privacy, on site
We can show you the payload the device sends, live, during the demo.
Book an on-site demo