Almost every consumer IoT product ships an app. Ours ships a URL. That was not a cost decision — it came out of the same boundary document that decides what the device is allowed to claim.
No install on either side
The person being observed does not get an app, an account, a password, a pairing step, or a notification to dismiss. The person who cares opens a browser. That asymmetry is the whole product: everything we could avoid asking of an 80-year-old, we avoided. A native app would have introduced an update cycle, permission prompts, and a login screen into a house where none of those belong.
No notification permission to grant
An app strongly implies push. Push implies the product has decided something is worth interrupting you for, which in turn implies it knows why the room changed. It does not. A web page makes the pull model natural: you open it when you want to know, read two numbers, close it. We also skipped a daily summary email, because a digest invites you to skim a verdict instead of reading timestamps — and it arrives whether you wanted it or not.
No account system, no roles
One device, one family invite. We were asked for an admin panel and a permission hierarchy and left both out: a room-level state is the same fact for a son and a daughter, and building roles would imply there is richer data to protect. What the board shows is deliberately too small to need an access-control matrix. There is no footage to share or leak because there is no lens, and no audio because there is no microphone.
What actually travels upstream
The raw radio waveform never leaves the box. Upstream goes a room-level state plus a timestamp, a few bytes per reading, roughly tens of kilobytes a day. The public board polls that stream at about 1 Hz and renders four states: moving, still but present, no one, no signal. That fourth state is a first-class part of the protocol, not an error toast — a stale "all fine" is the most dangerous thing a care display can show. After a reboot the counters start from zero; we do not backfill a tidy history across a gap.
Static delivery, boring ops
A static page plus a small state endpoint is easy to cache, easy to audit, and easy to keep working on an old tablet or a cheap phone. There is no client-side model to version, no SDK to deprecate, no background service to drain a battery. When the link drops, the page says so plainly rather than rendering yesterday's number in a reassuring colour.
The limits, stated up front
One box covers one room: about 10 metres in the same room, about 5 metres through one ordinary interior wall. Beyond that you get "no signal", which is also an answer. A cat crossing the room looks like a person to this signal; we publish that instead of shipping a pet filter we cannot verify. We do not count people, identify anyone, score a routine, or flag an unusual day. We do not send alerts, do not measure heart rate or breathing, and do not claim to detect falls. Not a medical device, no diagnosis, no emergency response — in an emergency, call 120. Not a replacement for a caregiver or for the daily phone call; the board just means that call can be about something other than "did you get up today".
The public board is at annest.cn/live/, reporting from a real occupied flat rather than a recorded loop. The unit is 499 CNY including the first month of service, then 30 CNY a month. Shipping a URL instead of an app removed far more failure modes than it added features.
