Your call travels device-to-device
Video and audio move over WebRTC, directly between the people in the room (a
“peer-to-peer mesh”). Every media packet is encrypted with SRTP, the standard
WebRTC transport encryption, before it leaves your device.
What the connection broker sees
To find each other, devices register a random room ID with a small public signaling
server (the PeerJS broker). It sees connection metadata — room IDs and IP addresses —
so it can introduce peers. It never receives camera or microphone content, and OG
sends it no names and no account data, because there are no accounts.
Hard networks may use a relay
Some firewalls block direct connections. When that happens, a public TURN relay
forwards your packets so the call still works. The relay only ever handles
already-encrypted SRTP packets — it cannot watch or listen to your call, but like any
internet hop it can see IP addresses and traffic volume.
What OG stores
For your calls: nothing on any server. No call history, no recordings, no logs of who
talked to whom. Your display name is kept in this device’s session storage so you don’t
retype it — it is deleted when the browser session ends.
If you turn on the optional group ring, one small server (a Cloudflare Worker we run)
stores a push address for each device that opted in and a hashed version of the group
passphrase, and it can see when someone rings the group — plus IPs, like any server.
It never touches your calls: media stays device-to-device.
Honest limits
- Anyone in the call can screenshot or record their own screen. No app can prevent that.
- The room code is the only key. Share it like a password — anyone holding it can join while the host is present.
- The broker and relay are public infrastructure: they can observe that a connection happened (IPs, timing), just not its content.