Security & privacy
What leaves your machine (almost nothing), how the channel is protected, and the risk you should know about.
All
Design principles
- No account, no sign-in, no analytics, no crash reporting SDK, no third-party tracking.
- No relay server and no public endpoint. Traffic stays on your own network.
- Your source code is never uploaded. Only the text of your commands travels between your devices.
- No code is downloaded onto or executed inside the phone. Execution happens on your own computer, which you installed and control.
Transport and authentication
- Discovery uses Bonjour / mDNS (_brewping._tcp).
- Commands travel over plain HTTP on the LAN — there is no TLS on the local channel.
- Access requires a bearer token obtained by exchanging a one-time 6-digit code.
- Write operations add a timestamp window of ±120 seconds and a single-use nonce, so captured requests cannot be replayed.
- The token is stored with file mode 0600 on the desktop; iOS stores it in the Keychain rather than UserDefaults.
Risk you should accept consciously
Anyone who obtains the token while on the same network can submit commands that run on your computer. Use BrewPing only on networks you trust, re-pair if a device is lost, and regenerate the pairing code if you suspect exposure.
iOS privacy manifest
| Item | Value |
|---|---|
| Privacy manifest | PrivacyInfo.xcprivacy is present |
| Tracking | NSPrivacyTracking = false |
| Collected data types | None declared |
| Required reason API | NSPrivacyAccessedAPICategoryUserDefaults, reason CA92.1 (app's own data only) |
| Watch app | NSPrivacyAccessedAPICategoryFileTimestamp, reason C617.1 |
| Export compliance | ITSAppUsesNonExemptEncryption = false (no custom encryption) |
Voice and audio
- On the watch, audio is recorded only while you are on the recording screen; recording stops when you leave it.
- The iPhone transcribes the audio file locally. The microphone is not used on iPhone — no microphone permission is requested there.
- Audio is played back on-device only and is not uploaded to any third party.
Logging
Command text is treated as user content. Logging goes through the system logger with command text, transcriptions, file names and host names marked as private.