A small computer with a camera, above a lobby screen. Frames live in memory for under 200 ms — counted, then destroyed.
The camera reads the waiting area. No frame survives 200 milliseconds.
Headcount, group mix, wide age bands, seconds of attention. Aggregates only — below five people, bands suppress themselves.
A pair and a solo wait; the screen weighs the mix and picks the message to fit. Under two seconds, gated in preflight.
Boxes, bands, counts — the device’s total perception. No pixels exist behind this view.
[ n=— · groups — · attn — ]
Each claim ships with its verifier. The audit — tools/privacy_audit.sh — runs in front of you, on your device, in your lobby.