We don't hold a key to your screen
There is no account to leak and no data store to raid. Session keys are made on your two machines and stay there.
A session key the server cannot guess
A 6-digit code is only a million possibilities. If the session key came from that alone, whoever runs the server could record one handshake and try them all in under a second on an ordinary machine. So every session also exchanges an X25519 ECDH secret the server holds no part of. Exhausting all million codes still leaves 128 bits nobody can guess.
The meeting point has nothing to read
Its job is to let the two machines find each other and then splice the pipes together. It never sees the 6-digit code. Knowing it would not be enough either, because the session key also mixes in a per-session ECDH secret the server holds no part of. Only random bytes pass through. Logs keep the session id, machine id, IP, byte count and duration, not one fragment of content.
The machine's key is pinned, the way SSH remembers a host
The computer's ECDH secret is signed with its permanent Ed25519 key, the same one it uses to claim its ID. On the first connection the controlling app pins that key, exactly as SSH remembers a host. If the meeting point ever tries to swap the key and sit in the middle, the app catches it from the second connection onwards. The old handshake was removed outright, with no fallback. Leave one in place and an attacker simply forces both ends to speak the old version.
Nobody can steal or scan out your computer's ID
If claiming an ID were enough, anyone could steal someone else's. So each machine keeps an Ed25519 private key in a local store that only your account on that machine can open. That store is never synced to a cloud and never backed up off the device. On every registration the server issues a random challenge that the machine must sign. No signature, no ID. A 9-digit ID is scannable in theory, so the server rate-limits failed calls to ten per minute per IP. It also never tells the caller whether an ID is unknown or simply offline. Session tickets are single-use and expire after 20 seconds.
A key per direction, a seal per frame
Session keys are derived with HKDF-SHA256, one for each direction. Reusing a single key both ways is the classic mistake that breaks a stream cipher's guarantees. After the handshake, both video and input travel in authenticated ChaChaPoly with a counter as the nonce, so nothing from one session can be replayed into another.
System permissions kept to the minimum
Screen Recording to send the picture, Accessibility to receive mouse and keyboard. macOS grants both. You can revoke them whenever you like, and the app stops at that moment.
Install and first connection
Install the app on the host at home and give it a role. At the other end, type the two numbers, from the app or from a browser. Nothing to disclose about yourself.