Built so the people running it cannot abuse it.

The idea

You already own the computer. You paid for it, it is sitting on your desk, and the only thing standing between you and it is distance. Reaching it from your phone should not require a subscription that counts your minutes, an account you cannot delete, or a company in the middle that can watch.

So the design constraint we set was uncomfortable on purpose: build it so that we could not spy on a session even if we decided to. Everything else in the architecture follows from that. The relay forwards ciphertext it holds no key for. Pairing happens in person so nobody can attach themselves to your account from a distance. Identity is a key generated on your device rather than a password on a server.

Why latency is the whole product

A remote desktop that lags is a remote desktop you stop using. It is the difference between a machine you happen to be operating from elsewhere and a video call with a computer. That is why relay selection is measured on your device on every connection rather than fixed to wherever you signed up, and why the app shows you the real round-trip number instead of a comfortable rating.

Honesty as a feature

The weekly record only counts minutes in which you actually typed, tapped, scrolled or clicked. It would be trivial to count connected time instead and report a much more flattering number. We do not, because the first person to check that number against their own memory would stop believing anything else the app said, including the paragraph about encryption.

The same rule governs this website. If a claim here is not true of the software as it ships today, it does not appear, which is why the downloads page says the builds are not public yet, and why the security page says out loud that there has been no third-party audit.