ESP32 Stethoscope On A Kitchen Table, Privacy On Thin Ice

I taught two five dollar radios to eavesdrop on your heartbeat and, frankly, they are a little too good at it. Think WiFi as a stethoscope made of math, you stand between two ESP32 boards, packets zip past your ribs, and the radio whispers back, hey buddy, your ventricles are on a schedule. It is a party trick you can build on a kitchen table, also the kind of party trick that makes you check the curtains twice. Dad joke before the existential dread, the CSI is coming from inside the house, not the sunglasses show, the channel state information kind, be still my beating UART.

So what is actually going on, en bref, every WiFi packet bounces off everything, walls, chairs, that plant you keep forgetting to water, and yes, your rib cage. Your heart nudges your chest a few millimeters, fabric shifts, bones flex a touch, and those tiny motions tweak how each slice of the spectrum rolls in, stretched a hair here, delayed a hair there, multipath soup with a hint of cardio. It is like reading a novel by the dents it leaves in the couch, wrong at first blush, then obvious once you realize the dents are the point. One ESP32 talks at a steady clip, the other listens, the chips already report per subcarrier channel data because the radio needs it to work, we just grab it like nosy neighbors grabbing mail that was not theirs, purely for science, désolé. Then we clean the stream, keep the band where heartbeats live, pull out the slow drift, and count peaks like a metronome with opinions. Resting heart hums around 60 to 90 beats per minute, breathing plods along around 12 to 20, so a little filtering separates chest heave from heart thump, and out pops a pulse estimate while your coffee cools. No electrodes, no chest strap, just ambient WiFi turning into numbers you can plot, which is neat until you remember everything around you is now part of your health sensor, including the coat rack and that very judgmental lamp.

Why care, beyond the cool factor parked between kitchen wizardry and garage physics, because this takes a lab trick buried behind paywalls and turns it into something rebuildable with pocket money and patience. Commodity radios, reproducible pipeline, code you can read and argue with, not a glossy PDF that waves its arms. More eyes, fewer miracles, and fewer “just trust the authors” moments that age like milk. It does work, with caveats that will not surprise anyone who has met reality. Quiet room helps, breathing steps on the signal like a toddler on bubble wrap, laughter throws off the count, big movements ruin everything, metal in the room can be your best friend or your worst depending on where you put it, and your neighbor’s streaming habit throws RF confetti you must sweep up. ESP32s are not lab gear, so you squeeze the lemon, calibrate, average, maybe do a little PCA if you are feeling fancy, and accept that this is weekend build accurate, not emergency room accurate. Keep your pulse ox, this is a vibe check, not a diagnosis, and if you wave your arms and it fails, that is not a bug, that is physics doing its rude little dance, merci.

Now the part where the stomach drops. If a room can give up your pulse without a wire touching your skin, then anyone with a budget and a grudge can try it too, landlords, bosses, cops, pick your favorite acronym. Consent fades when the measurement rides the air itself, which is a polite way to say surveillance gets easy and you do not get a vote. The second it lands on HR dashboards as “wellness analytics,” someone will use it to manage people, not help them, because apparently boundaries are for networks, not humans. Chip vendors will stamp “CSI ready” on boxes and let someone else carry the medical baggage, startups will sell subscriptions to measure you at work, at school, at home, and call it empowerment, researchers will rack up citations while the data pipelines wander into procurement decks. The public pays first with privacy, later with accuracy, and when the chart is wrong, the people paying the price are the ones who never agreed to be measured in the first place. So the line, bright and loud, if it measures a body, it needs consent, period. If it feeds a decision, it needs transparency you can audit and a way to fight back, no exceptions. Actual solutions look different from stagecraft, open code beats black boxes, opt in beats hidden defaults, on device beats “we store it in the cloud for your convenience,” and a delete button that really deletes beats a privacy policy written by a lawyer who hates weekends.

Meanwhile, build responsibly. Publish loudly, with code, with knobs, with the weird edge cases documented, and ship defaults that stay off until a person says on. Treat passive biometrics like a search, surtout when the target is just living their life. If you must measure, explain what, why, where it goes, and how to shut it off without begging IT, and do it in plain language, pas compliqué. Choose people over metrics every time, especially when the metric looks useful and the person looks inconvenient. If we are going to make this, we should make it in the open, with the lights on and the jokes ready, because the only thing worse than a heartbeat you can hear across the room is one you can hear and no one told you why. And yes, it still works on a kitchen table, between two five dollar radios, like political Tetris played with reflections, only the pieces are your echoes and the score is your pulse. Build the demo, feel the thrill, then draw the boundary and hold it.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI