Security
Security and privacy design
The architecture is the promise: if the server cannot see your video, it cannot lose your video.
The video path
In Phone mode, video moves directly from your phone to your browser over WebRTC with DTLS-SRTP — the same encryption as every mainstream call. Our connection service handles only the introduction: it passes connection offers between the two devices and never appears in the media path. In Blank Screen mode, the feed is generated locally and never leaves the machine.
Consequence: there is no video database, no recordings, no transcripts, nothing to breach — because nothing exists to store.
The pairing service
- Identification only. QR codes carry 128-bit random tokens; 6-digit codes expire after five minutes. Sessions are reaped by heartbeat when either side goes quiet.
- Per-IP rate limits — 40 messages per 10 seconds and 12 joins per minute per client, with the real client IP captured at the WebSocket upgrade (correct behind proxies via the connecting-IP header).
- Minimal endpoints — pairing, signal relay, and an ICE helper (STUN list; optional TURN credentials from server config when the relay ships).
The extension
- Minimal permissions — camera and the narrow host access it needs; no broad “all sites” read permission.
- Per-request clones — each page gets its own stream clone; OFF stops them all instantly.
- Trusted Types clean — no unsafe DOM workarounds, audited to zero violations.
- Settings on device only — uninstall removes everything; there is no account.
Advertising
The extension contains no advertising and no tracking. This website is funded by ads (Google AdSense): the build-time Content-Security-Policy allow-lists Google’s ad origins only when ads are enabled, and the privacy policy discloses what ad partners may set. No payment or identity data travels through the extension.
Transport hardening
This site and the phone page ship with HSTS, nosniff, a strict referrer policy, frame denial and a locked-down permissions policy; the website adds a Content-Security-Policy generated from the exact scripts on each page (Google’s ad origins are allow-listed only when ads are enabled).
Reporting a vulnerability
Email our contact address with “security” in the subject. We treat reports as confidential, act on them first, and credit researchers who want credit. Please test only against your own installations — never against other people or third-party services.