Behind a lens sits a sensor at the focal plane. Light entering the lens is focused onto that surface, reflects off it, and the same optics collimate the reflection back along the path it arrived on. That is retroreflection, the same effect that makes a cat's eyes and a road stud light up in headlights.
A flat surface reflects specularly: bright at one exact angle, dark everywhere else. A lens returns brightly across a range of angles, which is why it survives while you move and why persistence is the signal worth ranking on.
The return is strongest when your eye is close to the light. That is the whole reason for holding the torch beside the camera rather than off to one side.
Each frame is downscaled to 160 pixels wide, converted to luminance, and thresholded. Strict is 250 of 255, normal 244, loose 232. Adjacent pixels above the threshold are grouped into clusters.
A cluster is kept when it covers between 2 and 80 pixels at that scale, spans no more than 14 pixels on either side, and fills at least 45% of its own bounding box. Those bounds throw out lamps, windows, screens and long specular streaks, which are large or elongated. They also throw out a lens that fills the frame because you are too close.
Analysis runs at roughly 12 frames a second. Full-rate per-pixel work in JavaScript heats a phone and drops the preview, and a sweep is a slow movement, so 12 is enough.
Tracking matches a spot to the previous frame when its centre is within 4.5% of the frame width. A spot is dropped after 15 frames without a match, so a glint that flickers off for a moment keeps its history.
The screen and the rear camera face opposite ways, so screen flash lights nothing the rear camera can see. Pair screen flash with the front camera, and the torch with the rear camera.
Torch control needs a video track that reports a torch capability. In practice
that is Chrome on Android. iOS Safari exposes no torch to a web page at all, and the button
stays disabled and says so. Nothing here can turn on the flash of an iPhone from a browser.
Screen flash also depends on the handset brightness slider, which a web page cannot raise. Set it to maximum by hand first.
Camera access needs a secure origin. Opened over plain HTTP from anything other than
localhost, getUserMedia is not exposed and the page says the test could not run.
A denied permission, a camera already held by another app, and a device with no rear camera each produce their own message. None of them produces a result.
No frame, no pixel and no candidate leaves your device. There is no upload path in this page.