Authentication is Apple's, not ours
Signing in to a session runs Apple's ARD (Apple Remote Desktop) authentication — the same exchange the built-in Screen Sharing app uses. Your browser and your Mac perform a Diffie-Hellman key agreement, then your credentials travel AES-128-encrypted from the browser all the way to macOS, which does the actual verification. The relay in the middle cannot read them, and we never store them — not in the relay, not in the viewer, not in cookies.
The relay is a pipe, not a peer
A relay session is a Durable Object holding exactly two WebSockets: the connector (your Mac, dialed out) and one viewer. Binary frames are piped through untouched. The relay knows a pairing code and two connections — it holds no account of yours, no password, no screen history. Both legs are TLS (HTTPS/WSS) in transit.
Zero open ports on the Mac
The connector only makes outbound connections. Your Mac stays invisible to port scanners; there is nothing to forward, no hole in the firewall, no service listening on the internet. In direct mode (--listen) the connector does listen — but only where you told it to, typically a Tailscale interface that is itself end-to-end encrypted and invisible to the public internet.
A pairing code is an address, not a key
Codes route; passwords open. A leaked pairing code leads an attacker to a login prompt where macOS demands your username and password — the code alone opens nothing. Codes are 9 characters from a 31-letter alphabet (no 0/O/1/I/L), expire within 24 hours, and die the moment you stop the connector.
Auditable by design
The connector is a single dependency-free Node script — you can read every line before running it: connector.mjs. No installer, no daemon, no auto-update. When it's not running, nothing of ours exists on your Mac.
What we're honest about
- Screen pixels are TLS-protected on both legs but are not yet end-to-end encrypted through the relay; full E2E pixel encryption is on the roadmap.
- Optional accounts (for the saved-Macs dashboard) store your email and a salted PBKDF2 password hash — never your macOS credentials, and never required to connect.
Questions we didn't answer? Check the FAQ or read how the three connection modes work.