Private-Space Scan Checklist

Threat-model the room, not just the app

A room image can expose identity, relationships, health, finances, routines, security, work, children, and location even when the intended subject is a sofa. A privacy threat model asks what data appears, who could receive it, what they could infer, how long it is needed, and how the user can correct or delete it. Start before recording because preventing capture is stronger than hoping every copy can be found later.

NIST's Privacy Framework organizes privacy risk around identifying, governing, controlling, communicating, and protecting data processing. For a household scan, translate that into a simple boundary: collect only frames necessary to identify sale candidates; do not capture people or documents; review before any listing draft; keep the person in control; and delete the scan when its work is complete.

The threat is not limited to a malicious service. A benign draft can be copied into a public marketplace, forwarded to a stranger, synchronized to photo storage, included in an export, or shown on a shared screen. Minimize the original capture and every downstream copy.

Sources for this section: National Institute of Standards and Technology

Remove direct identifiers

Direct identifiers include names on mail, shipping labels, schoolwork, certificates, prescriptions, calendars, device screens, badges, account notices, and framed documents. Put them outside the room or face them down. Do not rely on video motion blur; a single extracted frame may be sharp enough to read.

Cover or move family photographs and faces. Move vehicle documents, passports, tax records, wallets, checks, and payment cards entirely out of view rather than applying a small blur later. Hide QR codes and barcodes when they are not necessary for the sale. A buyer may need a product model label, but not a household shipping label beside it.

Create a staging surface for documents removed during the sweep so they are not lost in the move. The goal is controlled handling, not frantic concealment that creates a new problem.

Sources for this section: National Institute of Standards and Technology · Meta

Look for indirect location and access clues

A street view through a window, building number in a reflection, parking permit, school logo, local utility bill, transit map, or distinctive skyline can narrow location. A calendar and work schedule can reveal when the home is empty. Keys, garage remotes, access cards, alarm keypads, smart-lock screens, and camera placement can reveal entry systems.

Close blinds if doing so will not make the scene unsafe. Move keys and remotes. Avoid recording the path from the front door to valuable objects. Do not narrate a full address, schedule, gate code, or vacation plan. If a large item requires home pickup, share the precise address only at the appropriate stage with a verified plan, not in public media.

Reflections deserve a second pass. Mirrors, televisions, framed glass, appliance doors, windows, and polished metal can show the camera operator, family members, screens, or the opposite side of the room. Change angle or temporarily cover the surface.

Sources for this section: Meta · Meta

Protect health, family, and work information

Move medication, medical devices with labels, appointment cards, mobility paperwork, insurance documents, and visible diagnoses. The fact that an item is ordinary in the home does not make its context appropriate for public listing photographs.

Remove children's names, faces, school materials, sports schedules, artwork with identifying details, and bedroom location clues. Avoid recording sleeping areas when the item can be moved to a neutral place. If a child's item must be shown, capture the object against a plain background after checking recalls and platform restrictions.

Work-from-home areas can expose customer data, unreleased products, whiteboards, credentials, device names, source code, and employer property. Lock screens, remove badges and papers, and verify ownership before treating work equipment as a resale candidate.

Sources for this section: National Institute of Standards and Technology · Federal Trade Commission

Prepare electronics before they enter the catalog

A powered screen can expose messages, account names, Wi-Fi networks, contacts, location history, and cloud content. Photograph electronics powered off unless a functional demonstration is necessary, then use a clean test state. Never show a password, one-time code, account recovery screen, or device-unlock pattern.

Before sale, follow the manufacturer's current process to back up what you need, sign out, remove activation locks, erase storage, remove SIM and memory cards, unpair accessories, and reset the device. Verify the reset. The EPA recommends deleting personal information before donating or recycling electronics and handling batteries through appropriate routes.

A serial or model identifier can be useful for compatibility and recall research, but a unique identifier can also support fraud or unwanted account queries. Capture the minimum identifier needed and decide whether it belongs in a private research record, a buyer message, or the public listing.

Sources for this section: U.S. Environmental Protection Agency · National Institute of Standards and Technology

Plan the camera path

Choose a narrow path that covers sale candidates without sweeping private areas. Start with a wide orientation frame after the privacy sweep, then stop recording and take deliberate close-ups. Do not record closets, drawers, open cabinets, adjacent bedrooms, security systems, or personal collections simply because the camera is already moving.

Use enough light to show condition without capturing windows as mirrors. Move slowly, but do not linger over unrelated surfaces. Give each candidate an identifier so close-ups can be matched without recording a spoken family name. If another person enters the room, pause and review that segment.

For small or sensitive items, skip the room scan and photograph them on a neutral staging surface. Data minimization sometimes means choosing a different capture mode rather than improving redaction.

Sources for this section: National Institute of Standards and Technology · eBay

Review frames before analysis or export

Review at full resolution, not only as thumbnails. Zoom into documents and reflective surfaces. Check the first and last frame, where a camera may point toward the doorway or floor while recording starts and stops. Delete unnecessary frames rather than assuming a later crop protects every derivative.

Use a two-person review for estate, client, organizer, or occupied-home work when consent and responsibilities are more complex. The second reviewer should know what categories to find, not simply approve the overall look. Record that review occurred without making another copy of sensitive frames.

Exports deserve their own review. A ZIP, CSV, shared link, or draft may contain filenames, metadata, descriptions, or images not visible on the primary screen. Open the actual export before sending it and remove stale versions.

Sources for this section: National Institute of Standards and Technology · Meta

Create marketplace photographs from a clean set

Select only images that prove identity, scale, condition, and defects. Crop out the room when a closer view is sufficient. Blur direct identifiers only when removal or recapture is impractical, and inspect the final exported pixels. A blur that looks adequate on a phone can leave readable shapes or surrounding context on a larger screen.

Do not remove sale-relevant damage or alter color and condition. Privacy editing and deceptive editing are different. Keep an unedited private evidence copy only as long as needed, and clearly distinguish it from the public set.

Search the text draft for accidental address, phone, email, schedule, access instructions, and account identifiers. Early buyer communication should remain on the platform when the platform recommends that practice.

Sources for this section: Meta · Meta · eBay

Decide retention and deletion before capture

Choose how long raw room frames, crops, catalog data, drafts, and exports are needed. A practical rule can tie deletion to the project: delete rejected frames immediately, delete raw scans after catalog review, delete listing media after the transaction and dispute period, and retain only minimal financial or tax records separately. The correct period depends on the user's needs and applicable obligations.

Deletion should include known copies: device camera roll, downloads, shared folders, exports, listing drafts, and the app scan. Removing the visible app record while leaving a ZIP in Downloads is not complete. Likewise, deleting the raw scan should not erase a receipt that the household must keep; separate privacy-sensitive media from necessary records.

RoomWorth states that users can delete scans. Verify the current product control before relying on it, and contact support if deletion does not behave as described. Beta status is not a reason to weaken user control.

Sources for this section: National Institute of Standards and Technology

Handle consent in shared, client, and estate spaces

The person holding the phone may not own every object or have authority to record every room. In a shared household, tell occupants what will be captured, which images may become public, who can review them, and when they will be deleted. Give people a real chance to remove belongings or choose a no-recording zone. Silence or absence is not a useful substitute for a shared plan.

Professional organizers, estate helpers, movers, and real-estate teams need clearer boundaries. Record the client who authorized capture, the rooms and purposes covered, the people who may access drafts, and the deletion milestone. Do not reuse a client's room images in marketing, model training, a portfolio, or a case study without separate, specific permission. If an heir, landlord, employer, or roommate owns a candidate item, resolve authority before listing it.

Consent can change. If someone identifies a sensitive frame after capture, remove it from the active set and known exports promptly. If the frame is essential evidence for another obligation, restrict it rather than circulating it. A privacy-respecting workflow makes correction and deletion ordinary operations, not exceptional favors.

Sources for this section: National Institute of Standards and Technology

Respond to a privacy mistake

If a sensitive image is published, stop distribution before debating severity. Remove or pause the listing, revoke share links when possible, delete unnecessary exports, and replace the image with a clean recapture. Check whether the exposed fact also requires another action: change an access code, secure an account, notify an affected person, or contact the platform.

Document the affected image, where it was shared, when it was removed, and what correction was made without creating more copies of the sensitive content. Search the remaining catalog and drafts for the same clue. A shipping label visible in one photo may appear in several frames from the same pan.

Use the mistake to improve the sweep. Add the missed category to the checklist, change the camera path, or make full-resolution review mandatory. Do not merely apply a stronger blur to future images if the root problem was unnecessary capture. If a marketplace contact uses exposed information to pressure or threaten someone, stop communication, preserve appropriate evidence, report the account, and seek local help when safety is at risk.

Review every place the image may have traveled: marketplace listing, cross-post, saved draft, messaging thread, shared family album, cloud drive, downloaded export, and device photo library. Removal from one page may not remove previews or copies elsewhere. Notify another affected household member in plain language, including what was visible, where it appeared, what was removed, and any action they should take. Avoid vague reassurance when a concrete credential, address, schedule, or child identifier was exposed.

If the issue involves a RoomWorth scan, use the product's deletion control and contact the published support address if the result is unclear. Preserve only the minimal evidence needed to explain the problem. A correction process should reduce exposure, not create a larger incident archive.

Sources for this section: National Institute of Standards and Technology · Meta · Meta

The 60-second sweep

Stand at the intended camera start. Look clockwise for people and faces; mail and documents; medication; screens and whiteboards; keys and access devices; windows and location clues; mirrors and reflections; children's information; work material; and unique identifiers. Move or cover each item. Then walk the exact path without recording and inspect what comes into view.

Lock or power down screens. Close irrelevant doors and drawers. Place candidates away from documents. Set a neutral close-up area. Confirm everyone in the home knows recording will begin. Record only the planned path, stop, and review at full resolution before proceeding.

If the sweep cannot make the scene safe, do not scan the room. Use manual item entry or neutral-background photographs. The safest image is often the one never captured.

• People and family photographs
• Mail, labels, calendars, and financial papers
• Medication and health clues
• Screens, whiteboards, and credentials
• Keys, access systems, windows, and reflections
• Children's and work information
• Model data separated from unique identifiers
• Full-resolution review and deletion plan
• Consent confirmed for shared spaces and belongings
• Temporary captures assigned a specific deletion milestone
• Recapture

Sources for this section: National Institute of Standards and Technology · Meta · U.S. Environmental Protection Agency