SafeScreen

.env — production CAMERA ACTIVE

Screen protected

Waiting for camera

Protected 0/3 frames

Not a video, and not a mockup — this runs the same state machine as the app. One disqualifying frame hides; three consecutive good ones reveal. Switch tabs or move your cursor off the page and it will protect itself.

SafeScreen home panel: camera, sensitivity and shoulder-surfer settings, ready to start protection

SafeScreen while protecting: screen visible, head yaw and roll, frames held in memory

The app itself. Left, ready to start; right, protecting, with frames held in memory and nothing written to disk.

Platform: Windows 10 (1809+) & 11 · x64
Detection: BlazeFace via TFLite — on device
Network: None. No telemetry, no update check, no account
Install: Unzip and run · no installer · no admin rights
Licence: MIT · built with Flutter
Signing: Unsigned — SmartScreen will warn. Verify the checksum

01In practice

For anyone who has ever angled their laptop away from someone.

You know the moment. You tilt the screen a few degrees, or you casually alt-tab to nothing in particular, and then you feel faintly ridiculous for doing it. This is the fix for that reflex.

→ Trains and planes A tray table is not a private office, and the person opposite has an excellent viewing angle.
→ Open-plan offices Where "have you got a quick second?" arrives from behind you, mid-sentence, at walking pace.
→ Cafés and libraries The best power socket is never the seat with its back to a wall.
→ Getting up for coffee The most common way a screen gets read is nobody being at it. Walk away and it goes dark on its own.

→

A second face is one too many

Shoulder-surfer detection protects the screen when someone else appears in frame — even while you are still looking at it yourself. On by default, and switchable off if you share a desk.

→

Adjustable patience

Five sensitivity steps, from "I fidget constantly" to "what is on this screen must not leave this room". It changes both the angle it tolerates and how eagerly it hides.

→

It learns your face, never your identity

Calibration works out your neutral head position so detection fits your proportions rather than an average. It has no idea who you are, and stores nothing that could work it out.

→

It shows its working

The status panel keeps a live count of capture files erased. A privacy tool asking for your webcam should be able to prove what it did with the frames, rather than asking nicely to be believed.

→

Quietly resident

Minimises to the system tray and keeps working. There is also an in-app mode that blurs only its own window, if you would rather not grant anything system-wide.

→

Breaks safely

Camera unplugged, detector wedged, frames stopped arriving — every one of those hides the screen. It will never leave your work on display because something failed quietly in the background.

02Detection

Geometry, not guesswork.

The Windows face detector reports six facial keypoints and never a head angle. Those six points are enough to recover the angles analytically, which is what makes this more than proximity detection.

 webcam ──▶ Media Foundation ──▶ BMP in memory   ◀── no file is ever
                  │                                    created
                  ▼
             BlazeFace ──▶ 6 keypoints ──▶ head pose
                                              yaw · roll · pitch
                                                    │
                                                    ▼
                                              hysteresis ──▶ ■ / □

01

Yaw, from a cylinder

Model the head as a cylinder: nose at the front, ear points at ±90°. The nose's normalised position t between the two ears collapses to a tangent, so the angle falls straight out.

yaw = atan((t − 0.5) × 2)

02

Pitch, calibrated to you

How far your nose sits below your eye line is a fact about your face, not about your attention — a fixed threshold misfires on real people. SafeScreen learns your neutral value and measures drift.

deviation = ratio − learned_neutral

03

Weighted toward hiding

Hiding takes one bad frame. Revealing takes several consecutive good ones. Flickering to "protected" is an annoyance; flickering to "visible" is a privacy failure. They are not treated as equal.

framesToProtect ≤ framesToReveal

03Frames

Where your camera frames actually go.

The part most tools would leave out of the marketing.

They never touch the disk. Here is how.

SafeScreen captures through its own Media Foundation path, reading each frame straight into memory and handing it to the detector there. No file is created at any point — nothing to sync, index, snapshot, back up or recover.

That matters because the obvious way to do this on Windows is the wrong one. The Flutter camera plugin has no streaming API: its only way to produce a frame is to encode a JPEG to disk first, and by default that lands in your Pictures folder — Search-indexed, thumbnailed, and on most machines synced to OneDrive. A detector sampling several times a second would upload thousands of photographs of you.

That plugin is kept only as a fallback, for machines where in-memory capture will not start, because losing protection entirely would be worse. There it writes to private temp storage instead of Pictures, and each file is overwritten and deleted the instant it has been read. The status console tells you which path is running. Full detail in SECURITY.md →

04Scope

What it is not.

A privacy tool that overstates itself is worse than none at all.

✗ Not a lock screen It authenticates nobody and will not stop someone using your keyboard. That is what Win+L is for.
✗ Not hiding your taskbar on multi-monitor Every display is covered, mixed-DPI included, but the window spanning them does not suppress the taskbar the way single-display fullscreen does.
✗ Not proof against camera effects Background blur erases anyone behind you before SafeScreen sees the frame. It prefers a physical camera and warns otherwise. Windows Studio Effects applies to the hardware itself and cannot be avoided, so SafeScreen asks the camera and warns when blur or automatic framing is on.
✗ Not face recognition It knows a face is present and roughly where it points — not whose it is. Shoulder-surfer detection triggers on any second face, including one on a poster.
✗ Not signed Certificates cost more than this project has, so SmartScreen will warn you. Verify the checksum instead.

05Verify

Check what you downloaded.

Every release is built by GitHub Actions from a tagged commit — never uploaded from a developer's machine — and carries a provenance attestation you can check against this repository.

PS> Get-FileHash .\SafeScreen-windows-x64.zip -Algorithm SHA256

$ gh attestation verify SafeScreen-windows-x64.zip --repo kv4u/safescreen

Download for Windows Star on GitHub

Your screen goes dark when you look away.