What a lens does to light
Point a light at a wall and it scatters. Point it at a camera lens and a surprising amount comes straight back at you, because the lens focuses your light onto the sensor behind it and the sensor reflects part of it back out the way it came. That is retroreflection, and it is why a hidden lens answers a torch with a small, hard point of light that a painted screw head never produces. The scan looks for exactly that: a point far brighter than the surface holding it, and small — a few pixels, not a patch.
What a night-vision camera gives away
A camera that sees in the dark has to light the room somehow, and it does it with infrared. Your eyes have no receptors for that wavelength, so the room still looks black to you. A phone sensor does respond to it, and because the sensor colour filters were never designed for it, the light lands unevenly across the red, green and blue channels. The result reads as a pale violet glow ringing the emitter. The scan measures how far a point leans violet, which is what separates an infrared emitter from an ordinary standby LED.
Telling a lens from a reflection
This is the part that decides whether a flagged point deserves your attention. A lens is fixed to its object, so as you move it travels with the room. A reflection obeys the law of reflection instead: the bright spot slides across the surface as your viewpoint changes. The scan measures the room's own motion between frames, works out where each point should have landed if it were fixed to something, and compares that with where it actually landed. Points that drift are marked as ruled out. Points that stay put start holding.
Why it asks you to move
The motion test needs parallax. Hold the phone perfectly still and a lens and a reflection look identical, so any answer would be a guess. The scan waits until the view has shifted enough to be conclusive, and until then it says so rather than pretending. If a point is stuck on checking, take a step sideways and keep it in frame.
Naming what a point sits on
A glint on a clock is far more useful than a glint. The scan runs an object model over the same frames and boxes the things that either carry a camera or are routinely used to hide one — phones, laptops, televisions, clocks, soft toys, bags, shelf decor. Those boxes are places to check, not findings, which is why they are drawn quietly. The model has no class for a camera itself, so it will never name a bare lens or a standalone webcam.
What this cannot do
It cannot see a camera that is switched off: a dead lens still reflects, but a dead emitter gives nothing away and the glint alone is weak evidence. It cannot see through a wall, a vent grille, or a one-way mirror angled to hide the lens. It cannot detect microphones, and it cannot detect radio traffic — a browser has no access to it, so any page claiming to scan Wi-Fi for cameras is not doing what it says. And it is not a guarantee. It is a way to check the obvious places properly, in the few minutes when that matters.
How to run a good scan
Work one wall at a time, at chest height first, because that is where a camera gets the shot it wants. Turn the torch on for the reflective pass and sweep slowly — a fast sweep passes straight over glints. Then kill the room lights, draw the curtains, and go round again with the torch off for the infrared pass. Start with the wall you would undress in front of, then the one facing the bed, and leave the ceiling for last.