How I built a webcam posture app where video never leaves the Mac

Taiki Kanai — Fri, 25 Sep 2026 09:45:34 +0000

I kept catching myself slouching. Every webcam posture app I tried either wanted a subscription or left me guessing where the frames went, so I built Kamae with one rule baked in from day one: video and posture data never leave the Mac. This post is about the parts of that decision that were interesting to engineer.

The design constraint came first

Before writing any pose code, I wrote down what Kamae would not do:

No video frames saved to disk.
No raw landmark time series saved or uploaded.
No telemetry, no analytics, no install IDs.
No backend server to sign in to.

That last one is the keystone. Without a server, there is nowhere to upload frames to and nothing to leak. The whole architecture flows from it: everything happens on the Mac, the only outbound requests are license checks, update checks, and feedback the user explicitly sends.

The next decision was where to put the camera logic. MediaPipe Pose runs in a WebAssembly runtime, so Electron was an easy fit. The pose model and WASM are bundled inside the app — nothing is fetched from a CDN at runtime.

How pose becomes three numbers

A hidden detector window calls getUserMedia, feeds each frame into MediaPipe Pose Landmarker (the lite model), and reads five landmarks: the nose, both ears, and both shoulders. From those, I compute three normalized numbers:

Metric	Calculation	Meaning
`neckDrop`	(shoulder-midpoint Y − ear-midpoint Y) ÷ shoulder width	Smaller is more hunched. Primary signal.
`leanIn`	current shoulder width ÷ baseline shoulder width	Larger means closer to the screen.
`shoulderTilt`	angle of the line between the two shoulders (degrees)	Asymmetry.

The comparison is against a baseline you set yourself — three seconds of your own good posture at the start of each session. Absolute numbers vary too much between setups, so the app compares you to you. The display level follows a 60-second majority of good / warn / bad, so a quick sip of coffee does not flip the menu bar red.

The pose logic and the state machine live in packages/core — pure TypeScript, no Electron, no DOM, no Date.now(). Time comes in as milliseconds. This sounds pedantic but it paid off: every threshold and transition is unit-testable without spinning up a renderer.

A simplified version of the metrics function looks like this:

// packages/core/src/metrics.ts (simplified)
export function computeMetrics(lm: PoseLandmarks, minVisibility = DEFAULT_MIN_VISIBILITY): Metrics | null {
  if (!isPersonVisible(lm, minVisibility)) return null  // nobody in frame: a gap, not a zero
  const shoulderWidth = distance(lm.leftShoulder, lm.rightShoulder)
  if (shoulderWidth <= 0) return null
  const shoulderMid = midpoint(lm.leftShoulder, lm.rightShoulder)
  const earMid = midpoint(lm.leftEar, lm.rightEar)
  const neckDrop = (shoulderMid.y - earMid.y) / shoulderWidth  // image y grows downward
  // Always measure from the shoulder on the image's left to the one on its right, so a mirrored
  // camera doesn't flip the angle to ±180 and jump across the baseline
  const [l, r] = lm.leftShoulder.x <= lm.rightShoulder.x ? [lm.leftShoulder, lm.rightShoulder] : [lm.rightShoulder, lm.leftShoulder]
  const shoulderTilt = (Math.atan2(r.y - l.y, r.x - l.x) * 180) / Math.PI
  return { neckDrop, shoulderWidth, shoulderTilt }  // leanIn = shoulderWidth / baseline, computed later
}

Once the three numbers cross IPC into the main process, the frame is gone. No buffer is kept, no toDataURL, no upload. The only thing that gets persisted is per-minute aggregates (good_ratio, warn_ratio, bad_ratio, average deviations) in a local SQLite file under ~/Library/Application Support/Kamae/.

The camera light was the problem I had to solve

The first build kept the camera on continuously. It worked, but the green LED next to the webcam stayed lit all day, and that felt like surveillance even though nothing was leaving the Mac. The fix was intermittent sampling.

By default Kamae opens the camera for about one second every thirty seconds:

Open the camera.
Wait for the first frame (timeout 2 s).
Take three samples at 200 ms intervals.
Close the camera.

Three samples per burst × two bursts per minute = six samples per minute, which is plenty for a 60-second majority. The camera light blinks instead of staying on, and CPU drops with it. On an M4 Mac mini running for an hour with default settings, Kamae averaged 0.5% CPU (cumulative CPU time 19.0 s over 3,655 s). The instant readings bounce between near-zero and a short spike when a burst fires.

The cadence is decided by a pure function in core, so it can be tested:

// packages/core/src/intermittent.ts (simplified)
export function planBurst(input: BurstInput): BurstPlan {
  if (input.config.mode === 'continuous' || input.state === 'CALIBRATING' || input.continuousRequested) {
    return { mode: 'continuous' }
  }
  let periodMs: number
  if (input.state === 'AWAY') periodMs = AWAY_PERIOD_MS                    // 30 s: notice when you come back
  else if (input.displayLevel === 'warn' || input.displayLevel === 'bad') periodMs = BAD_PERIOD_MS  // 10 s
  else periodMs = clampPeriodMs(input.config.periodMs)                    // user setting, 10–120 s, default 30
  if (input.onBattery) periodMs *= BATTERY_PERIOD_FACTOR                  // 2x on battery
  return { mode: 'burst', periodMs, samples: BURST_SAMPLES, gapMs: BURST_GAP_MS }
}

So while you are slouched, Kamae checks every ten seconds. While you are sitting well, every thirty. On battery, twice as long. Calibration and the live preview switch to continuous mode automatically.

"We do not upload" is not a claim, it is a feature

Saying "no frames are uploaded" is cheap. Letting the user verify it is the actual product feature. Two things make that possible:

1. A visible connection log. Every time the main process makes a network call, it appends one row to net_log — timestamp, kind (license-activate, update-check, feedback, …), destination host, success, note. Settings → Privacy → Connection log shows the last 20 entries, plus a summary of the last 24 hours. A quiet day shows up as "0", not as a blank, so an empty log is an answer rather than a gap.

2. CI watchdogs that prevent regressions. scripts/check-no-egress.mjs scans the detector renderer and the main process for any API that could exfiltrate frames — fetch, WebSocket, XMLHttpRequest, fs.write*, MediaRecorder, canvas.toDataURL, and so on — and fails the build if any of them appear where frames are handled. scripts/check-net-log.mjs is its twin: every file that calls fetch( or imports electron-updater has to also reference netLog.record, so no outbound traffic can sneak in unlogged.

The watchdogs are dumb on purpose. They do not understand intent; they just refuse certain symbols from appearing in certain places. That is the kind of test you can leave running for years.

Things I was careful about in Electron

Electron is easy to make insecure by accident. The configuration I checked twice:

contextIsolation: true and nodeIntegration: false in every renderer.
Every IPC entry point declared in src/preload/index.ts. Nothing else is reachable from the renderer.
The production renderer is served from a custom kamae:// scheme registered in src/main/protocol.ts, not from file://, so a renderer never has a path into arbitrary local files.

The other thing I would flag is bundle hygiene. The MediaPipe WASM, the .task model, and the language files all ship inside the app. There is no runtime CDN call. That decision predates the privacy story — it is also the difference between an installer that works offline and one that doesn't.

What I gave up on purpose

A few honest trade-offs:

Apple silicon only. macOS 11 Big Sur or later on M1 and newer. I would rather test one architecture properly than two halfway, and a universal build would roughly double a DMG that is already about 140 MB for everyone on an M-series Mac.
It is not a medical device. Kamae is a habit tool that helps you notice how you sit. I deliberately avoided the kind of language that would imply a medical effect. If you have pain, see a professional.
No analytics. Instead of an event pipeline I added an opt-in one-question survey on day 7 and day 13 of the trial. The data only moves when the user presses the button.

Try it

Kamae is $19 one-time (a year of updates included) with a 14-day free trial and every feature unlocked. One license covers up to two Macs. Sales are handled by a Merchant of Record so tax and VAT are not my problem. The full pricing breakdown and the download are at kamaeposture.com.

If you are evaluating any webcam posture app, the checklist I wrote at kamaeposture.com/guides/posture-app-privacy/ — read the privacy screen, watch the camera light, watch the network, look for an in-app connection log — applies to any of them, not just mine.

If you'd like to try it on the early-bird price: the first 100 buyers get 20% off until Oct 31 — https://buy.polar.sh/polar_cl_SHRn2QFrDF3mttSDCHvcJwIvFsZQUGWbexb2G1vIzEN?discount_code=EARLYBIRD.

Built by FUNBREW. Feedback welcome — the in-app Feedback button is the fastest way to reach me.

DEV Community: Taiki Kanai