A privacy setting in an app is a promise. A physical shutter is a fact. When you slide an Avanti robot’s camera shutter closed, the camera is blocked by a piece of hardware — there is nothing to override and nothing to take on faith.
We decided early that a robot carrying a camera into someone’s home needed a control you can see and touch. The reason is not that software controls are untrustworthy in principle. It is that a software control asks you to believe a claim about code you cannot inspect, and a shutter asks you to believe your own eyes. Only one of those survives a sceptical afternoon.
The shutter has no remote release. That is deliberate, and it is the whole point: a control that we could open from our side would be a setting wearing a shutter’s clothes. It also means the person who lives with the robot holds the control, whether or not they are the person who bought it or the person who set the app up.
The shutter is the one part of the machine we draw in full, because it is the one promise that will never change.