Over there. Right here.
Your files stay on your devices. Browse and open them from the screen in front of you.
Full capability details ↓Choose a view
Choose a device. Open something good.
Sample files · Nothing is downloaded
launch-cover.webpHow it works
Name a share
The owning device pins an export. Nothing else on that disk is reachable, by construction.
Grant the peer
A typed files-read action class is granted per peer. A quick-paired device reads nothing.
Browse and stat
Typed intents cross the fabric. The remote machine never speaks HTTP at all.
Mint a lease
Copy Link issues a URL scoped to one entry, for a bounded time.
Serve locally
Your own loopback gateway turns the player's Range header into one offset read.
Revoke or expire
Unlink kills the URL; a replaced file fails its version token rather than splicing.
Walk another machine's folders, download a file, or seek within a large video — with no port opened anywhere. A device exports named folders, an authorized peer lists and range-reads inside them, and Copy Link produces a short-lived URL that VLC, IINA or Infuse can open and seek. The machine holding the file never runs a web server; the HTTP gateway runs on your own loopback.
What this feature is not
- Not remote shell execution. It is a typed file service with fixed verbs; only list, stat, read and exports are routable at all.
- Not a port forward and not a public URL. The remote opens no listener, and the gateway is your own daemon on loopback.
- Not a Dropbox or Nextcloud reimplementation, and not a filesystem mount driver.
- Not a photo album product. No library, no cross-account sharing, no semantic search, no conflict-free two-way sync — yet.
15 capabilities, tracked in the project.
These are recorded implementation states, not public release availability. Platform and direction support vary; public releases remain unverified.
Reaching into a device
- Working today Browse a peer's folders
List nested directories of a named export, with paging.
- Working today Share discovery
Ask a device which shares it exports. No local path ever leaks.
- Working today Stat without reading
Metadata answers a HEAD and opens no read at all.
- Working today Download
The same read call without a Range header, from the console or the CLI.
- Working today WebDAV mount, read-only
Mount a peer's share in Finder with stock tooling. PUT and LOCK are refused.
Playing media that lives elsewhere
- Working today Seekable lease URLs
A player jumps to 01:32:10 and streams only that slice of the file.
- Working today Copy Link, revocable
One entry, a bounded lifetime, shown once, listable, and killable.
- Working today Revision preconditions
A file replaced mid-playback fails the read instead of splicing two versions.
- Being built Read-ahead over a WAN
Smooth playback across the internet, not only across a LAN.
Writing back
- Planned Staged write and delete
Put files back on the remote device under the same grant.
- Planned Rename, mkdir, watch
Full folder management, and notification when something changes.
- Planned Folder Sync
Persistent one-way, two-way or multi-device convergence.
The wider personal cloud
- Working today safe-fs export pinning
Pinned roots. No path traversal, no dotfiles, and never the whole disk.
- Planned Cloud source aggregation
S3, Drive or Dropbox adapted as an optional backend, never a dependency.
- Planned Phone photo backup
New photos land on your own computer or NAS in the background.
Start with the devices
you already own.
Make a little more room for what you do.
Find your way in.
Public downloads are being confirmed. Explore the workflows and development status to see what's taking shape.
Explore features