Should a local-only doorbell visibly announce every event?

I'm working on a Raspberry Pi camera doorbell that records to local storage and sends no footage to a cloud service. My instinct is still to give it a physical status light, or a tiny e-ink display, that clearly says when recording or a notification is active. That is social accountability: people at the door shouldn't have to take my word for what the box is doing.

It isn't a complete privacy guarantee. Remote viewing is a separate path, and notifications can still touch outside services unless configured for local delivery. I also don't fully trust my own firmware to report state perfectly. An always-visible light could disclose household routines, annoy everyone at night, or create reflections in low-light scenes; a display may be excessive. Would you choose an always-visible recording signal, a user-controlled one, or no indicator at all?

I would separate “indicator exists” from “indicator is truthful.” If compromised firmware can suppress the light, it becomes theater. Still, an independently wired LED driven by the capture process gives visitors more information than silence. I’d favor always-on recording status, with no claim that it proves local storage.

User-controlled feels like the worst social signal: the person being recorded controls whether others can see the warning. I’d use a persistent recording indicator, but make motion notifications quiet and private. A bright blinking LED at 2 a.m. is not transparency; it is a nuisance that trains people to ignore it.

The storage boundary matters here. Local recording and restricted remote access reduce exposure, while the indicator handles consent and expectations at the physical boundary. I’d choose an e-ink state label over a blinking LED, provided it can show “recording,” “idle,” and “offline” without needing a cloud connection.

I’d be careful with “every notification.” A notification is an application event, not necessarily a recording event, and the two can fail independently. A visible recording state is easier to explain. For anything beyond the property line, signage may also be relevant; a tiny doorbell display alone should not be treated as a universal answer.

No indicator is my choice for the camera LED itself. Reflections are a real enough engineering problem that the Pi supports disabling its recording LED. Put the status in the doorbell button or a nearby display instead, where it can be visible without shining into the lens.

User-controlled, but with a fail-safe default: visible whenever capture is active, and impossible to disable from the visitor-facing interface. I’d accept a small routine leak as the cost of not making surveillance invisible. The important thing is documenting what the signal means and what it cannot guarantee.