The case for face-recognition check-in
Why we shipped on-device face recognition instead of fingerprint scanners — and the privacy trade-offs we made.
Last quarter we shipped face-recognition check-in across the Kasratbook platform. It runs on any tablet or phone, requires no extra hardware, and processes the entire match locally on the device. Here's why we built it that way, and what we deliberately chose not to build.
Why not fingerprint?
Fingerprint scanners work, but they have three failure modes that compound at gym scale: sweaty hands, latex gloves, and cracked screens. In our pilot, we measured a 9% scan-failure rate at peak hours, mostly attributable to those three. That meant 9 out of every 100 members had to either retry or get manually checked in by the front desk — exactly the friction we were trying to remove.
Face recognition fails differently. It struggles in poor light, with face coverings, and at extreme angles. But in a typical gym lobby, it succeeds in under 700 milliseconds, with a false-rejection rate below 0.5%.
Why on-device?
We considered three architectures: send the image to a server for matching, store templates on the server and stream new captures up for matching, or do everything locally. We chose the third option for one reason: we don't want a database of biometric templates we don't need.
The on-device model embeds each face into a 512-dimensional vector. The vector is stored on the gym's tablet, in a SQLite database that never leaves the device. Matching happens in under 100 milliseconds against the entire member set. No images, no cloud round-trip, no central biometric repository.
"If we don't have your face, we can't lose your face."
Anti-tailgating
The most common gym fraud isn't members lending out cards — it's tailgating, where two people walk in on one scan. Because the camera is already capturing video, we added a second model that counts distinct faces in the frame at the moment of check-in. If it sees more than one, the front-desk gets a soft alert.
What we chose not to do
- We do not store member photos. The vector embedding is one-way — you can't reconstruct a face from it.
- We do not run liveness detection. Photos held up to the camera will match. We decided this was an acceptable trade-off for gym check-in (we're not authorizing payments) and we'll revisit if fraud becomes a problem.
- We do not share the model or vectors across gyms. Each gym is an independent population.
What's next
We're testing a low-light variant of the model trained for the lighting conditions in older Indian gym lobbies. And we're working with two CrossFit affiliates on outdoor check-in (good luck with the sun).