Privacy
Hall Check stores counts, never frames.
A frame is read from the university's public stream into memory, passed to a person detector, and discarded in the same step that produced it. What is kept is a single number per hall per reading, plus the information needed to interpret it: which hall, when, which detector version, which confidence threshold, which queue region, and which camera placement.
What is never stored
Images, video, crops, thumbnails, embeddings, bounding boxes, tracks, or face data of any kind.
Bounding boxes get their own sentence because they are the tempting exception. A box is a position, a sequence of positions is a trajectory, and a trajectory through a public room is behavioural data about someone who never agreed to be measured. The detector's output is reduced to a count inside the same function call that produced it.
How that is enforced
- The frame is held by a context manager that overwrites it before returning, so there is no code path that hands pixels to a caller.
- A test parses every module in the worker and fails the build if a call that could write image data appears in it.
- Every change is reviewed against a checklist that asks this specifically.
The code is public. If you find a path that contradicts any of this, it is a bug of the highest severity in the project — please open an issue.