The life of one thermal frame

1. t + 0 ms

   A frame is born

   Frame #38,412 of the afternoon: the 32 × 24 thermopile array captures the long-wave infrared your cooktop emits — 768 radiometric pixels, each an independent temperature estimate. No lens pointed at you, no light needed; a thermopile reads heat, so it sees a simmering pan identically at noon and at midnight.

2. t + 4 ms

   It learns what it’s looking at

   Radiometric normalization first: per-pixel gain and offset correction, then ambient-temperature compensation — so a hot August kitchen doesn’t masquerade as a hot burner. Then spatial segmentation: the frame is partitioned into per-burner zones calibrated to your stove’s layout during setup. The frame stops being a picture and becomes five numbers: one peak temperature per zone.

3. t + 9 ms

   It gets a memory check

   A single frame can lie — a steam plume drifts by, a hand reaches across. So each zone’s reading joins a rolling window: exponential smoothing plus median filtering across recent frames. Transients wash out; only sustained heat survives the filter. This is the step that separates “someone is cooking” from “something is wrong.”

4. t + 15 ms

   It is judged

   The filtered values drive a finite-state machine per burner — idle → cooking → unattended-risk → local-alarm → escalation — with hysteresis thresholds (different bars to enter and leave a state, so it never flaps at the boundary) scaled by your sensitivity setting. Today, burner 2 is at a rolling boil with you standing right there: state stays cooking. Nothing is wrong.

5. t + 16 ms

   And then it dies

   Its verdict delivered, frame #38,412 is overwritten in the device’s memory. It was never written to disk, never compressed, never uploaded. On a normal day, this is how every single frame ends — a hundred-million-plus readings live and die on your countertop. Your kitchen’s rhythm — when you cook, what you cook, who wandered past — stays in your kitchen.

6. the exception

   When risk sustains, an event is born instead

   Minutes later: the pot still boils, presence hasn’t been detected, the state machine crosses into unattended-risk. Now — and only now — something leaves the device: a structured event record over TLS 1.2+, roughly the size of a text message. On the Pro, the camera wakes for one still image; a cloud vision model reduces it to a detection result (pot? person? flame? smoke?) and the image is not retained. The audio pipeline works the same way — band-power analysis on the device recognizes a kettle whistle; no recording is ever made.

7. t + 2 s

   The event outlives the frame

   In the cloud (SOC 2 Type II infrastructure, AES-256 at rest), the event opens an acknowledgment window: your phone gets the push while the device sounds its ~85 dB alarm at the stove. One tap resets everything. If the window lapses, escalation proceeds — SMS to up to five trusted contacts, each of whom gave explicit consent before a single message could ever be sent. Every step is idempotent and logged: a network retry can’t double-page your daughter.

The receipts: data minimization at a glance

The binding version of these commitments lives in our Privacy & Data page.