The ledger

Who learns what

Every party that touches Peers, what it can make out, and what it never sees. One line per party, an analogy each, and a row for every feature that changed the list. Updated with every release.

This page is written from the code, and the code is public. If the two ever disagree, the code is right and this page is wrong, and that is a bug you can report.

Two rules bound everything Peers adds: no feature may hand any party a piece of information it does not already receive, unless you turn it on knowingly and this page says exactly what changes; and no feature may ask you to understand keys, pairing codes or network modes to benefit from it.

Always, for everyone

The relay

A postman carrying sealed envelopes between numbered pigeonholes. He can feel how heavy each one is and note when it came, and he has no key.

Learns: A random chat number, when a device connected, the size of each sealed packet, and the internet address the packet came from.
Never: Your name, who you write to, or a word of what is inside.

Run by the ird network, not by OPUS. A setting you can change.

The mailbox

A pigeonhole that keeps an envelope until it is collected, and empties itself after a day.

Learns: The chat number, a sealed pouch of up to 64 KB, and the moment it was dropped in.
Never: Who dropped it in, who it is for, or what it says. It is emptied after 24 hours.

Part of the relay.

The doorbell

A doorbell with no camera. It knows a bell rang at a house at a certain time, and nothing about who rang or why.

Learns: The number Apple uses to reach a phone, the time, and whether it is a ring or a message.
Never: Who asked, which chat, or what was said. It keeps nothing. Requests to it are sealed, with the second lock once it has one.

The one program OPUS runs. Anyone can run their own; see the doorbell.

Apple’s push service

The postal service that delivers the doorbell’s ring to the right house.

Learns: That a push went to a phone at a time, from the doorbell’s certificate.
Never: What the push says: its body is sealed for your phone alone.

Apple’s Keychain, on your device

The drawer your keys live in. It stays in your house.

Learns: Nothing. Your keys are marked “this device only” and never sync.
Never: Anything, unless you turn on the vault below.

Strangers nearby

People in the same room can see that two people are talking across a table, and for how long, not what they say.

Learns: That a device on the local network announces a Peers service under a random name, and the sizes of the sealed frames it exchanges. With a Wi-Fi Aware pairing in place, that a Peers service is around over the air as well.
Never: Who you are, who you talk to, or what crosses. Every nearby frame is sealed under the chat’s key.

Your network provider

The road the postman drives on.

Learns: That your device talks to the relay’s address, and how much.
Never: Anything inside.

The call relay

A courier for the phone line, used only when a direct line is blocked.

Learns: That an encrypted stream is passing, its size and timing.
Never: A word or a frame of the call.

Provided by the ird network as TURN.

OPUS

The company that makes Peers.

Learns: Only what the doorbell above learns, and only while OPUS runs it.
Never: Who you are, who you talk to, what you said, or that you exist. There is no account, no analytics and no crash reporting to OPUS.

Only if you turn it on

Apple Passwords and iCloud Keychain

A safe deposit box. The bank knows you rent a box and how big it is; only your key opens it, and the bank never had a copy.

Learns: That an item and a passkey for peers.opus.ro exist in your iCloud Keychain, the item’s size, and when it changes. On install, Apple’s servers fetch this site’s association file, so Apple learns a Peers build was installed on some device.
Never: What is in the box: iCloud Keychain is end-to-end encrypted, and the box is sealed again with a key only your passkey can make. Not which identity is yours.

Settings › Account › Keep a copy in Apple Passwords. Off by default.

Apple Intelligence

A proofreader you can call over to your desk. Only when you call.

Learns: The draft you ask it to proofread or rewrite, handled on your phone or by Apple’s private compute according to your own Apple settings.
Never: Anything, if Apple Intelligence is off or you never use the writing tools. Peers itself sends the draft nowhere.

The writing tools in the message field, on devices with Apple Intelligence.

Wi-Fi Aware pairing

Agreeing on a private table you both come back to. The restaurant remembers which table, not the conversation.

Learns: iOS keeps the pairing; nothing leaves the phones. While a pairing exists, phones nearby can tell a Peers service is around over the air.
Never: Who you are. The same signed handshake as everywhere else decides who is on the other end.

A contact’s page, or Settings › Advanced › Nearby.

Local, and nothing more

These features run entirely on your devices and change nothing in the lists above.

The second lock. Every seal carries a quantum-safe lock next to the classical one. Envelopes get about a kilobyte heavier; the relay and the mailbox see sizes, as before.
Hold the phones together. Two iPhones range each other over ultra-wideband to verify a contact. The token that makes it possible crosses inside the sealed nearby link.
Siri, Shortcuts and Spotlight. Requests of these shapes are handled on the phone; the index of your contacts and chats is on the device. Nothing runs while the app is locked.
Live Activities, widgets and Control Center. Drawn from a small note the app leaves in its own app group: counts, titles, whether nearby is on. No push token is ever requested for an activity.
Voice-note transcripts. Your own notes, written on your own copy, on the device. The sender never knows.
The Mac menu bar, haptics, tips, and the progress shown while a large file finishes sending in the background.

Changes to this page

10 September 2026 Added Apple Passwords, Apple Intelligence and Wi-Fi Aware pairing as opt-in rows; added the second lock, hold-together, Siri, widgets and transcripts as local rows; noted the association file fetch on install.
9 September 2026 First version: the relay, the mailbox, the doorbell, Apple’s push service, the Keychain, strangers nearby, your network provider.

Bring one friend.
Peers come in pairs.

Coming soonApp Store and TestFlight