Skip to content
Early access — free while we polish. Send a note

Security review one-pager · August 23, 2026

LaptopNeck for IT

Print this page or Save as PDF. Intended for a security or endpoint team deciding whether a posture webcam app can run on a work laptop.

What it is

LaptopNeck (laptopneck.com) is a browser application that estimates sitting posture from the user-facing webcam. It is wellness software, not a medical device. It does not require an account to run.

What never leaves the device

  • Webcam frames, thumbnails, or recordings
  • Pose landmarks, world coordinates, or skeleton images
  • Calibration geometry (personal baseline)
  • Microphone (never requested)
  • Third-party analytics, ads, or fingerprinting scripts

Where compute happens

MediaPipe Pose Landmarker lite, compiled to WebAssembly, runs in this origin. The model file is served from the same origin and cached by the browser after first load. Inference is throttled (default 6 fps, 640×360) so the tab can idle beside an IDE.

Network

After the first load, monitoring works offline. Optional sign-in may send score summaries (minutes, alert counts) and text feedback. There is no video column. Local-only mode (default) disables those calls. Content-Security-Policy, Permissions-Policy (camera=self), and nosniff are set on responses. The in-app Proof page patches fetch/XHR/WebSocket/WebRTC and shows a live outbound log — video bytes should stay at 0.

How to verify

  1. Open Monitor, enable camera, sit for 30 seconds.
  2. Open /proof — video bytes should remain 0. Toggle airplane mode: detection continues.
  3. DevTools → Network: no image/jpeg or octet-stream uploads of frames.
  4. Application → Storage: calibration JSON only. Wipe from Settings anytime.

Camera permission

getUserMedia is requested on a user gesture. The preview is mirrored locally. A visible “camera on this device only” badge is shown while the stream is live. Stopping monitoring ends the MediaStream tracks.

Contact: hello@laptopneck.com. In-app Feedback page. Privacy at /privacy. Terms at /terms.