-
-
2-figure-beside-box.jpg
-
1-outline-drawing.jpg
-
5-still-on-the-porch.jpg
-
4-receipt.jpg
-
6-privacy-check.jpg
-
3-confirmed.jpg
Inspiration
Selling something locally ends the same way every time: two strangers trying to be in the same place at the same time. The usual answer is to leave the item on the porch and hope. Nobody can prove the buyer took it, and nobody can prove they didn't.
A doorbell camera already watches that spot. It just can't say anything useful about it, and nobody wants a stranger's camera feed, or their own hallway, shared with a buyer.
So we built a witness instead of a camera: the seller marks where the item is, the buyer taps a private link, and the camera answers one question — did the item leave while the buyer was there?
What it does
The seller names the item, picks a pickup window, and draws a rectangle around the box on an outline drawing of the camera view, never a photo. The app creates a private link to send the buyer.
The buyer opens the link on their phone, with no app and no account, and taps "I'm collecting". The app watches the porch for 30 seconds. If the item goes while someone is there, both sides get a receipt. If nothing happens, it says so: "the box is still on the porch."
The seller's screen shows the porch as a 3 × 3 grid: the box, and one plain figure, identical for every person, in whichever direction movement is. No outlines, no body shapes, no faces.
How we built it
Python, FastAPI, SQLite, aiortc and OpenCV. Three Ring API calls happen while it runs: list the account's cameras, open a live WebRTC video session, and close it.
Frames never touch the disk. They are decoded to grayscale in memory, compared against the baseline taken when the pickup was armed, and dropped. Confirmation needs three things together: the box area changed, the surroundings settled again, and movement near the box before it went. Anything less is "unconfirmed", never "theft".
To keep ourselves honest we built a second, separate open-source tool, the Privacy Audit Harness. It scans a folder and its databases for stored pictures, video or face data, and states plainly what it cannot check. We run it against our own app in the demo video. It reports zero findings, and it names its own blind spots: what the app held in memory, what it sent over the network, and that Ring keeps its own video.
Challenges we ran into
The simulator's test video has no pickup in it. Its "Package" clip shows a parcel that nobody ever takes, so the success case could not be demonstrated with it. We recorded our own doorstep clip and labelled it as ours, on screen and in the README.
Detection has to survive compression. Live video flickers enough to look like motion. The threshold is a fixed floor, set from measurements on the simulator's video rather than guessed.
Night is still untested. Two night recordings had to be thrown away: one ended before the porch settled, and in the other the camera moved, so the whole picture changed instead of the box. We left that in the known limits rather than claim it works.
Tokens expire mid-demo. The app now re-reads its token from the settings file on every session, so a fresh one can be pasted in without restarting and losing armed pickups.
Accomplishments that we're proud of
What we learned
Every claim needs a check that can fail. We kept an evidence register, wrote a friction log as we hit each problem with the tools, and built automated checks that rejected our own first attempts — including a test that only passed because a real token had expired, and a page that reported "the box is still on the porch" even when the camera had failed.
72 automated tests in the app, 49 in the privacy harness.
What's next for Porch Pickup
Ring account linking and an app-store install, so sellers choose their camera once and our server keeps the keys fresh; a message to the seller when the item is collected; and proper testing at dusk and at night.
Log in or sign up for Devpost to join the conversation.