Privacy
Privacy policy
Peers collects no personal data. This page sets out what OPUS holds, which is very little, and where anything at all is handled on your behalf.
What OPUS collects
Nothing. There are no accounts, no phone numbers, no email addresses, no analytics, no crash reports, and no advertising identifiers. OPUS holds no profile of you and nothing that identifies you.
This website has no cookies, no tracking scripts and no third-party requests of any kind. Visiting it tells OPUS nothing about you.
Your messages
Messages, files and call media are end-to-end encrypted on your device before they leave it. The relay and the mailbox handle sealed data only and cannot open it. OPUS holds no key that could.
- The relay passes sealed packets between devices. It sees a sealed packet, a random-looking chat number and the time.
- The mailbox holds a sealed copy of every message, including ones already delivered directly, so a device that was offline, or another of your devices, can catch up. It retains the copies for up to three days and then deletes them. It cannot read them.
- Sealed copies of files. A photo, video or file of up to 25 MB that you send also leaves a sealed copy in a separate mailbox for up to three days, so a friend’s phone can fetch it while yours is off. It sits at an address only the people in the chat can work out, and it cannot be opened without the key inside your message. Disappearing messages leave none, and you can turn copies off in Settings › Privacy.
- TURN servers forward encrypted call media when a direct connection between devices is blocked. They cannot listen to what they forward.
These are provided by the ird p2p network as sealed-box transport.
Waking a sleeping phone
A locked iPhone can only be woken by Apple. A separate program run by OPUS, which ordinary users never install, asks Apple to wake a phone on your behalf. It sees a device token, the time of the request, and whether it is a call or a message. It does not see who asked, which chat is involved, or what was said, and it keeps nothing about anyone.
What the notification then says on your lock screen is written by Peers on your phone, from a small note the app keeps of which chat each wake belongs to: the chat’s name, or just “Peers” while the app lock is on. No word of your messages travels in the push.
Apple’s push service sees what it sees for any app’s notifications: the device token and an encrypted payload. Apple’s handling of that is covered by Apple’s own privacy policy.
You can run your own relay and your own doorbell instead of the ones OPUS runs. See Technicalities.
Stickers and GIFs
The animated stickers ship inside the app and anything else in the picker is a file you added yourself. There is no sticker or GIF service behind it: browsing, searching and sending one touches no network beyond the chat it goes to.
Nearby devices
Devices near each other connect directly, over the local network and, on iPhone, over Wi-Fi Aware between phones you paired once through Apple’s pairing sheet. Peers stores nothing about a pairing; iOS holds it. While a pairing exists, Peers announces its Wi-Fi Aware service over the air, which tells phones nearby that a Peers is around, in the same way its local-network name does today; with no pairing, nothing is announced that way. Every frame between nearby devices is encrypted under the chat’s key, so a stranger nearby sees only sizes. “Hold the phones together” uses ultra-wideband ranging between two iPhones; nothing leaves the two phones.
Quantum-safe keys
Every seal Peers makes carries a second, post-quantum lock next to the classical one, and every identity a second signing key. This changes nothing about what any party can see; sealed messages are about a kilobyte larger.
Siri, Shortcuts, Spotlight, widgets and Live Activities
These run on your device. Siri requests for Peers’ actions are handled on the phone, the Spotlight index of your contacts and chats is on the device, and widgets, Control Center controls and Live Activities are drawn from a small snapshot the app writes into its own app group: unread counts, chat titles, whether nearby links are on, and the name of the person you talked to last. The extension that draws them never opens your messages, and no push token is requested for a Live Activity. Nothing runs while the app is locked.
Voice-note transcripts
Tapping the text mark on a voice note transcribes it on your device with the speech model that ships with iOS and macOS. The transcript is stored encrypted next to the audio, is never sent, and the sender is not told.
Apple’s writing tools
On devices with Apple Intelligence turned on, Apple’s proofread and rewrite tools appear in the message field. When you use them, your draft is processed on the device or by Apple’s Private Cloud Compute according to your own Apple Intelligence settings, under Apple’s privacy policy. Peers does not send the draft anywhere itself. With Apple Intelligence off, the tools are not present.
The optional copy in Apple Passwords
Off by default. If you turn on Keep a copy in Apple Passwords, Peers creates a passkey for peers.opus.ro in Apple Passwords and stores a sealed copy of your account (identity, profile, contacts, chats and their keys, settings; never messages or files) as an item in your iCloud Keychain, which Apple end-to-end encrypts; the copy is sealed again with a key only that passkey can produce. Apple can see that an item and a passkey for peers.opus.ro exist, the item’s size and when it changes, not their contents. Because the app declares peers.opus.ro as an associated domain, Apple’s servers fetch this site’s association file when the app is installed, so Apple learns that a Peers build was installed on some device, not which identity. Turning the switch off deletes the item; the passkey stays in Apple Passwords until you delete it there. If the gateway that serves this site logs requests, that log would show the fetch; OPUS does not read gateway logs and has turned logging off where it controls it.
Permissions the app asks for
- Local network, to find and connect to nearby devices directly.
- Nearby Interaction, to verify a contact by holding two iPhones together.
- Camera and microphone, for calls, photos and voice notes.
- Face ID, Touch ID or your passcode, to unlock the app if you switch that on.
- Notifications, to tell you about messages and calls.
None of this data leaves your device except as part of a message or a call you chose to send, when you link a second device of your own and copy your account to it, or when you turn on the copy in Apple Passwords described above.
Where your data lives
On your devices. Your profile, contacts, conversations, messages and attachments are stored encrypted on your iPhone and Mac, under a key held in the system Keychain. There is no copy anywhere else, so there is nothing for OPUS to export, hand over or lose. If you delete the app, that data goes with it.
Children
Peers is not directed at children under 13, and since no data is collected, none is collected from them either.
Changes
If this policy changes, the new version will be posted here with a new date at the top.
Contact
Questions about privacy go in the issue tracker on GitHub.