With the rise of sensors such as Microsoft Kinect, gesture-based interfaces have become practical. However, to recognize such gestures, applications need access to users' depth and video, exposing sensitive data about individuals and their environment. Prepose, a domain-specific language for building gesture recognizers, combined with a system architecture that protects privacy, security, and reliability with untrusted applications, addresses these threats.