Privacy and security

Coming in 1.2.0. This feature is not in the current release (1.1.0). It ships in flockr 1.2.0.

The phone and web app connect to the flockr server on your own computer. There is no account, no flockr cloud, and no tracking.

What goes where

Data	Path
Agent list, pane contents, typing, images, and message approvals	Straight from the phone to your computer, end-to-end encrypted.
Push alerts	Your flockr server, then Expo's push service (`exp.host`), then Apple's push service, then your iPhone.
Web app files (if you turn on `[web]`)	Plain HTTP from your computer to your browser. These are only the app's static files.

A push alert carries the agent's name and status, the workspace, tab, and server name, and the IDs the app needs to open the pane. It carries no terminal output. See Push alerts.

Encryption

Every message between the app and your computer travels inside a Noise channel (Noise_NK_25519_ChaChaPoly_SHA256). There is no plain-text mode and no setting to turn encryption off.
The pairing QR code carries your server's public key. The app pins it, so only the computer that holds the matching private key can complete the handshake. An impostor at the same address fails.
The connection uses forward secrecy from fresh keys on each connection.
The WebSocket itself is plain ws://, without TLS. The pinned key replaces a certificate, and everything inside the socket is encrypted.

Network exposure

The gateway is off by default.
It binds only to the IP addresses you list. 0.0.0.0 and :: are rejected.
A private network (NetBird, WireGuard, or your LAN) is the expected setup. A public address works, but anyone on the internet can then reach the pairing endpoint.
Failed sign-ins and pairing attempts are rate limited per IP address.

Pairing codes and device tokens

A pairing code is single use, expires after 10 minutes by default, and stops working after 5 failed attempts.
Anyone who sees the QR code before it is used can pair within its lifetime. flockr mobile pair prints the device that paired.
Each paired device gets a token. The server stores only a hash of it.
The iPhone app keeps its token in the iOS Keychain. The web app keeps it in the browser's local storage.
flockr mobile devices revoke <device_id> removes a device. Its connections close within 2 seconds.

What a paired device can do

A paired device can do what you can do at the command line on that server, plus type into any pane. That is your shell. Treat a lost phone like a lost SSH key and revoke it.

With a flock

If your computer is in a flock, the app can reach the other machines through the computer you paired with. That computer keeps the encrypted channel with the phone and relays the session to the other machine through the hub. Members connect to the hub over Noise, with keys the hub checks against its member list. Revoking the phone on the paired computer closes these relayed sessions too.

Full protocol

The wire protocol, key handling, and limits are documented in docs/mobile/protocol.md on GitHub.