A privacy app that drew 426 Hacker News points had to correct an awkward mistake on the same day: it could identify an iPhone as a pair of camera glasses. ZuckOff's iOS 1.3.0 release notes say an app advertising in the background could transmit the same Bluetooth service code as HeyCyan glasses. The update now requires that code to come directly from the device before it counts.
That bug explains the product better than a clean launch would. ZuckOff turns the radio chatter from nearby wearables into an alert on a phone, giving bystanders a signal they normally cannot see. The correction also sets a firm boundary around the result: a Bluetooth match is a clue about hardware in the room, and the quality of that clue depends on detection rules that need constant testing.
The community response is a demand signal rather than proof that the detector works in every setting. The 426-point Hacker News tally came from the brief's snapshot of the discussion. Independent reporting offers a second measure of interest: WIRED Middle East reported that more than 5,000 people downloaded the iOS app in its launch month, while its Google Play listing had 1,000 downloads at the time of publication.
The clue is already in the air
Camera glasses use Bluetooth Low Energy advertisements, short broadcasts that help nearby devices discover them. ZuckOff scans those advertisements and compares their contents with signatures captured from known hardware. Its published detection table lists manufacturer code 0x0D53 for Ray-Ban Meta and Oakley Meta products, 0x03C2 for Snap hardware, and an Oculus VR service identifier. Product names can also trigger a lower-confidence match.
The distinction between those signals matters. A manufacturer identifier is stronger evidence than a product-like name, while one service code may appear in an unrelated device. ZuckOff says it shows the evidence behind each flag and grades confidence as possible, likely, or strong. The iPhone fix demonstrates why users need that explanation. A warning without its matching rule would look more certain than the underlying radio data deserves.
According to the developer's privacy documentation, the scanner records the identifier assigned by iOS, any advertised name, manufacturer and service identifiers, signal strength, and the time a device appeared. Apple does not expose the Bluetooth MAC address to the app. The resulting identifier is local to the user's device, so it cannot be used to recognize the same hardware through another person's copy of ZuckOff.
Presence is the ceiling
ZuckOff cannot determine whether a camera is recording. It cannot identify the wearer, either. Signal strength supplies a rough estimate of distance with no direction, and walls or other radio conditions can make that estimate less useful. The app's own caveat says glasses tend to be loudest over Bluetooth when they power on, pair, or leave their case. Most supported pairs continue advertising while worn, though some standalone models may stay silent.
Those limits change how an alert should be read. A detection says that a matching broadcast was heard nearby. Silence leaves open the possibility of an unsupported or non-advertising device. An alert also leaves open ordinary explanations, including a pair owned by the person running the scan. The app lets owners mark their glasses so the same device stops producing warnings.
Meta uses a different signal for the moment of capture. The company says its glasses flash a white LED during photos and videos. On second-generation models, Meta says the camera is disabled when the system detects that the LED has been covered. A July 2026 update was also designed to stop capture after physical tampering with or destruction of the light is detected. That safeguard concerns recording state. ZuckOff listens for the presence of compatible hardware, so its alert cannot confirm or contradict what the LED is doing.
Why bystanders are looking for another signal
The appetite for a detector comes from a basic change in the camera's shape. Raising a phone creates a visible act. A lens embedded in familiar-looking frames can record during an ordinary conversation, leaving the indicator light as the main notice for the person facing it.
A BBC investigation published in January documented the consequence for Dilara, a 21-year-old who did not realize that a man was filming her through smart glasses. The video reached 1.3 million views on TikTok, and her phone number was visible in the footage. She told the BBC that calls and messages continued for weeks. The investigation found hundreds of similar short videos posted by dozens of male influencers, with many appearing to have been filmed secretly using Meta glasses.
Seven women in the UK, US, and Australia told the BBC that they felt exploited and distressed after discovering such videos online. None recalled seeing a recording light. That reporting does not establish that every light had been defeated, or that a Bluetooth scanner would have prevented the filming. It does explain why a rough proximity warning can feel useful even when it cannot answer the more urgent question of whether the lens is active.
The detector keeps its reasoning visible
Developer Pawel Szydlowski built the rules by recording advertisements from real glasses, according to WIRED. The app's site says each rule comes from a physical-device capture and asks owners of unsupported models to submit scan data or lend hardware for testing. This approach ties coverage to a small and changing sample. It also gives the maintainer a way to add a model based on observed packets instead of a guessed product name.
The app logs every Bluetooth device it hears, including devices it does not classify as glasses. Users can inspect a signal timeline and export the log as CSV. On iPhone, paid features include continuous background monitoring, widgets, alerts, and sighting history, while the basic scanner is free, according to WIRED. The current App Store page also lists iPhone, Mac, Apple Watch, and Apple Vision compatibility.
Local processing is an important part of the product's case. ZuckOff's privacy policy says it has no account system, analytics, advertising identifier, or third-party software kits. It does not request location, camera, or microphone access. Scan history stays in the app's storage and a container shared with its widget. Users can clear the log, and deleting the app deletes that local data.
There is a narrow network exception. A user can choose to send a hardware report containing an advertisement payload and related device fields for review. The app displays that payload before sending it and omits the iOS-issued device identifier. Its server temporarily retains a shortened, salted hash of the sender's network address for rate limiting. These are the developer's published disclosures. Apple's store page says the privacy information has not been independently verified by Apple.
False positives are part of the product
Version 1.3.0 gives ZuckOff a useful test of its own design. The release did more than change the rule for future scans. Its notes say devices already stored in a user's log are checked again under the corrected rule. Another correction reclassified Meta Quest as a visible headset rather than camera glasses after the app had reversed the relevant Bluetooth codes. The headset remains named in the log but no longer raises an alert.
That willingness to expose and correct mistakes is necessary for a tool that can influence how strangers interpret one another. A false alert may cause suspicion. A missed device may create confidence the scanner cannot support. Publishing the trigger, confidence level, and release correction helps users keep both errors in view. The app would be much harder to assess if it only displayed a red warning with no packet evidence.
Watch the release notes. A useful pattern would be quick corrections when a phone or headset triggers an alert, plus evidence that supported glasses remain visible after firmware changes. Meta's LED-tamper update needs the same field testing. ZuckOff's 426-point burst shows that bystanders want a readable signal. Its corrected iPhone alert shows the standard that signal now has to meet.