Encryption
What is locked, and where the keys live.
There are two separate layers. Breaking the outer one does not open the inner one.
The session layer
Your two computers agree a shared secret directly. Every frame is then locked with AES-256-GCM, using a fresh number for each frame.
Two things follow:
- The service never has the key. It introduced the two ends, nothing more.
- A relay passes data it cannot open.
This covers the picture, your mouse and keys, and copied text.
The transport layer
Underneath, every connection uses TLS 1.3, including the small ones your computers keep open to the coordinator.
That protects the outside of the envelope. It is not what protects the session, which is already locked.
Each computer's identity
Every install has its own long-term key. The public half is the fingerprint in Devices. The private half never leaves the machine.
That is how a computer recognises an app it has met before. Reinstalling makes a new identity, so it is remembered again from scratch. See how devices trust each other.
Not locked end to end
Account facts: computer names, session times, and the speed numbers. The service needs those to show you your own dashboard. See what is collected.
Self-hosting
Running it yourself keeps that metadata on your own servers. The end-to-end locking works the same either way.