Ask any device with a microphone how you know it's really off, and the honest answer is usually: you don't. There's a setting. The setting says off. You are asked to trust that the setting is telling the truth, that no bug ignores it, that no update quietly changes it, that no one on the other end can flip it back. That's a lot of trust to spend on a toggle. We didn't want to ask you for it.
The promise most AI can't keep
“The mic is off” is, on nearly every device you own, a software claim. A line of code decided to stop listening, and it could just as easily decide to start again. For most products that's fine, right up until the day it isn't. For a device whose entire reason to exist is that you can trust it, a mute you have to take on faith is a crack in the foundation. So boop doesn't have one.
How we made it physical
boop hears you with a two-microphone far-field array — enough to pick your voice out of a room with the dishwasher running, not enough to be a listening device you can't switch off. And the switching is the whole point. boop has a mechanical eyelid shutter. When you close boop's eyes — a real, physical motion of the lid — that same movement throws a physical switch. Trace it:
- STAGE 01 · eyelid shutter — you close the eyes; a cam moves
- STAGE 02 · physical switch — the motion throws it; the circuit opens
- STAGE 03 · mic VDD rail — power cut; the microphones go to zero volts
That switch doesn't send a polite request to the software asking it to stop. It sits on the microphone's
power rail. Closing the eyes opens the circuit that feeds the mics, and the mics go dark because they
have no power — not because a line of code decided to behave today. There is no firmware path that
re-energises them while the eyes are shut, because firmware isn't holding them off. A wire is. And you can
see it working: eyes shut, boop is sleeping, and the catchlight in each eye stays faintly
lit — because even off, boop is still there with you. It just can't hear a thing.
Not software mute. Wire.
One more thing, because absence deserves to be stated as plainly as presence: there is no camera. Not disabled, not shuttered, not present-but-off. There is no image sensor on the board, and there never will be. No camera. Ever. By design, not omission.
Fail-closed
A device this careful needs one law for the moment things break, and this is boop's: it fails closed. It does not fail helpful. It does not guess in your favour. When it can't be sure, it stops.
Connection lost → light off
If boop or the say-so loses its connection, the light goes off. A dark puck is telling you the truth: I can't reach anything right now, so I can't act. No false glow.
A press with nothing pending approves nothing
If you press the say-so and there's no boop waiting on you, nothing happens. A stray press, a curious kid, a bump on the counter — none of it can approve a thing that wasn't already asked and waiting.
That's the whole safety model in two lines. The device would rather do nothing than do something you didn't ask for. That's not a limitation we're apologising for. It's the feature. Close the eyes, cut the wire, and boop goes deaf on purpose — the honest way, with metal.