Short answer: A phone on camera duty gets mounted in the part of a building you wanted watched, and it is usually still signed in to whatever it was signed in to when it was somebody's phone. Notifications keep arriving, and Android has a control for how much of their content is legible before anyone unlocks anything. The two remedies that sound obvious — move the camera into a secondary user, or into private space — both work by stopping the apps of whoever is not in front of you, which is precisely what a camera cannot afford to be. The remedy that works runs the other way round, and takes about a minute. Background Camera RemoteStream is what I build; everything below is about the platform, not the app.
The direction nobody audits
Almost everything written about running a phone as a camera — a good deal of it by me — describes a device that sends pictures out of a room: where the video is stored, who else can reach it, whether it leaves the building, what survives a power cut. That is one direction of travel, and it is the one everybody checks.
The same device also receives. It is a fully provisioned Android phone with an account on it, and it has spent the entire setup process being treated as a camera by everyone in the room, including its owner.
Now consider where you put it.
The mounting position is the whole problem
Nobody mounts a camera phone in a cupboard. You put it where the traffic is, because traffic is the thing worth looking at: a hallway, an entryway, a front room, a shop counter, a window onto the street or the yard. Those are the semi-public parts of a building — the parts a courier, a contractor, a guest, a cleaner, a housemate or a customer passes through without being invited anywhere in particular. That is why they were worth a camera.
And you mount it at roughly the height that gives a useful angle, which is roughly the height at which a screen is legible from where a person stands.
So the object you installed in order to observe the least-private part of the building is a lit display, at reading height, facing the same room.
What is actually on that display
Two things are worth knowing precisely rather than approximately.
Notifications on a phone are a property of the signed-in user, not of the app you are running. The Android Open Source Project's multi-user documentation is explicit: "Notifications appear for all accounts of a single user at once." A phone on camera duty is still signed in as the user it was yesterday, so mail, messages, delivery updates and calendar alerts keep arriving as before.
How much of a notification is legible without unlocking is a setting, and it has a default you did not choose. In Google's own notification documentation the path is Settings, then Notifications, then under "Privacy," Notifications on lock screen, where Show sensitive content can be turned on or off. There is also a Don't show notifications option, and per-app you can set "Hide sensitive notification content" or "Don't show notifications at all." The point is not that any particular device ships one way. It is that this is a real control with real states, you have almost certainly never looked at it here, and the phone is now furniture in a room you chose because other people walk through it.
Many Android devices also keep a notification history — the same documentation warns that "Some devices may not have notification history and the settings can vary slightly among devices" — and where it exists it holds "Snoozed notifications", "Recently dismissed notifications" and "A history of the day's notifications." In a pocket, a convenience. On a phone bolted to a shelf, a scrollable log of your day.
Remedy one that sounds right: give the camera its own user
This is the first thing most technical people reach for, and the reasoning is sound: Android supports multiple users, each user's app data is separate, so put the camera in its own user and leave your accounts in yours. AOSP's own framing of the feature is that "Each user is intended to be used by a different physical person."
A camera, though, is useless unless it is running, and the multi-user design assumes the opposite — one user in front of the device, the others parked. The documentation is blunt about what parking costs:
"Some restrictions exist when a secondary user is in background. For instance, the background secondary user cannot display the user interface or make Bluetooth services active. In addition, the system process halt background secondary users if the device needs additional memory for operations in the foreground user."
Read that last clause as an operator, not as a developer. A camera running as a background secondary user is a camera the system is explicitly permitted to stop when something in the foreground wants memory. You have not isolated the camera. You have given it a lower claim on the device than whatever is on screen.
Nor can you dodge it by leaving the camera user in front, because then your own accounts sit in a user nobody is switched to — and AOSP says of that arrangement: "Notifications for other users do not appear until active." Your messages are not private. They are invisible to you, on a device you were never going to read, and all of them are waiting the moment anyone switches users.
Three more details that matter before anyone spends an evening on this:
- "The multi-user feature is disabled by default." Whether your phone offers it at all, and how many users it allows, is the manufacturer's decision. Plenty of handsets do not show the option.
- Separation is not as clean as the mental model in the other direction either: "Any user can affect the installed apps for all users", and "An admin user can remove apps or even the entire workspace established by secondary users."
- One genuinely useful knob is buried in there. AOSP: "To enable or disable the phone and SMS functions for a secondary user, go to Settings > Users, select the user, and switch the Allow phone calls and SMS setting to off."
Remedy two that sounds right: put the camera in private space
Android 15 added private space, described by Google as "a separate space on your Android device to hide and organize apps" — a "digital safe within your phone." If a secondary user is too heavy, this looks like the lighter version of the same idea.
It fails for the same reason, and this time Google says it out loud. When private space is locked, the apps inside it are:
"Completely stopped. These apps can't perform foreground or background activities, like showing notifications."
And the documentation goes on to give the warning in plain language:
"You should not use private space for apps that need to provide you with functionality in the background when your private space is locked."
A camera is the canonical example of such an app. The same passage makes the point with a different one: "medical apps can't track health information when the device is locked." Private space is a vault, and a vault is a bad place to keep something whose entire job is to be awake.
Two adjacent facts, because both surprise people: "You can't use private space when… It is within a secondary user" — so the two remedies cannot be stacked — and "Private space apps bypass virtual private network (VPN) on the device", which is a hole in any model of this phone that assumes a device-wide VPN covers everything.
The inversion that actually works
Here is the part worth the whole article. That same documentation says:
"Apps installed outside of private space won't be affected by these restrictions, even if you also have a private space on your device simultaneously."
The instinct is to isolate the camera. The platform rewards isolating everything else.
Leave the camera app in the main space, where it can hold a foreground service and stay awake. Put the messaging app, the mail client, the banking app — the ones you would not want legible from the hallway — into private space, and set it to lock automatically. Locked private space apps are "Hidden from the launcher, recent views, sharing apps like photopicker and docs UI" and, per the line quoted above, cannot show notifications at all. The camera is unaffected, because it is not in there.
One real caveat from the same page: private space "doesn't automatically read the accounts in your main space", and signing into it with an account you use elsewhere leaks "photos, files, emails, contacts, calendar events" back out. Google's recommendation is a dedicated account — more work than most people will do, which is why the boring list below matters more.
The boring version, in order
If you do one thing, do the first one.
- Look at the notification settings on the camera phone. Settings, Notifications, and under "Privacy," Notifications on lock screen. Decide, deliberately, whether Show sensitive content should be on for a device mounted in a hallway. Don't show notifications is a legitimate answer for a phone whose job does not involve you reading it.
- Then do it per app, for the two or three that matter. "Hide sensitive notification content" and "Don't show notifications at all" are per-app options.
- Check whether notification history is on here, and turn it off if it is. Settings, then Notifications.
- Sign out of what the camera does not need. Showing you a picture of your own hallway requires nothing signed in to anything. Whatever is still there is there because nobody made a decision, not because the job asked for it. (Do it in the right order — the account hygiene when you inherit a family phone piece covers the sequence.)
- Set a screen lock on the camera phone. Physical access to a mounted phone is a slower and more deliberate thing than opening a URL. Worth keeping that way.
Total time: under five minutes. No profiles, no second user, no vault.
Why the primitives are the wrong shape
Users, guest users, work profiles, private space — all good tools, and they share one assumption. They exist because a device is shared between people who take turns. AOSP's own examples say exactly that: "parents might allow their children to use the family tablet, a family can share an automobile, or a critical response team might share a mobile device for on-call duty." Somebody switches in, does something, switches out, and the platform's job is to keep one turn out of the next.
A camera phone has no turns. One identity, permanently present, permanently unattended, and the entire value of the arrangement is that nobody has to come back to it. Android's separation model answers "who is using this device right now?" A mounted camera is a device nobody is using and everybody can see.
That mismatch will not be fixed, because the assumption is correct for phones and a camera phone is a phone used against type. It is the same shape as every honest limitation in this category: a repurposed phone inherits the assumptions its designers made about phones, and one of the loudest is that a person is standing in front of it.
The limitation on my side, stated plainly
A camera app cannot fix any of this for you, and you should be suspicious of one that offers to.
Reading or suppressing another app's notifications on Android requires a notification-listener grant — access to the full contents of every notification on the device. That is arguably the single permission you would least want a camera app to hold. An app that asked for it in order to tidy your hallway display would have bought something small with something enormous. The right place for this control is where Google put it: in the system settings, owned by you, applying to everything.
Which is the answer this category keeps arriving at from different directions. What a local-only camera does and does not protect you from is a question about boundaries you control. Whether a second person can watch the same feed is a question about your network. What survives a power cut versus an internet outage is about the building. This one is about the phone still being a phone.
Further reading
- How an Android phone keeps recording video with the screen off — the foreground-service and Camera2 lifecycle underneath all of this.
- The best way to watch an old Android phone as a camera in your web browser — the plain setup, if you have not done it yet.
- Six signals that tell you a free camera app is selling your data — the other half of the trust question.
The app I build for this is Background Camera RemoteStream — screen-off recording and live viewing over your own network. More at superfunicular.com.
Top comments (0)