privacy
what leaves the room
A sensor sends 68 bytes twice a second and nothing else. This page encodes that frame in your browser from the field layout the firmware uses, so you can see every byte of it. The consent switch zeroes the vital-sign fields exactly as the node does.
Privacy is not a setting here. It is a 68-byte message format.
This is everything a sensor sends, twice a second.
FeatureFrame v1, little-endian, encoded in the page as you watch, exactly as spec/wire.md defines it, including the CRC-32. The field values are examples made up in the page, not a reading from a room. Hover a byte to see its field.
magic0 · u32version4 · u8node_id5 · u8tx_id6 · u8flags7 · u8seq8 · u32uptime_ms12 · u32csi_rate_chz16 · u16loss_permille18 · u16motion_energy20 · f32presence_threshold24 · f32gross_motion28 · f32breath_rms32 · f32breathing_bpm36 · f32breathing_conf40 · f32heart_bpm44 · f32heart_conf48 · f32best_bnr52 · f32calib_age_s56 · u32rssi_dbm60 · i8noise_floor_dbm61 · i8n_subcarriers62 · u8reserved63 · u8crc3264 · u32
Raw radio stays on the sensor
Features leave the node. Raw CSI leaves only in a debug mode, and that mode is flagged in every frame (ADR-001).
Vitals are opt-in, per space
Off by default. The consent gate is a single function on the node, short enough to audit in a few minutes. Heart rate needs a second switch.
No identities, ever
No names, faces, devices or tracks. Saans reports spaces, not people (ADR-005).
Roles see less
Admin, ops, safety and occupancy roles, each optionally limited to certain spaces. Facilities staff see occupied or empty, never vitals. Machines use tokens, people log in, and login is required whenever the API is reachable beyond the gateway itself.
Health reads are audited
Every response that contains vital signs or alert evidence is appended to an audit log.
Retention has an end
Event logs are deleted after 30 days. The gateway runs on the campus network and calls no cloud.
keep reading