Privacy policy and on-device security architecture
Photon is engineered to be private by construction. Every discovery query, TLS pairing handshake, remote key injection, and voice search frame executes strictly between your Apple device and your television over your local area network.
Interactive on-device storage and network inspector
Inspect each local-only subsystem in Photon to verify how cryptographic keys, paired television records, TLS certificate pins, and microphone audio are handled on your device.
iOS Keychain Identity (IdentityStore.swift)
Unlike remote apps that ship a static, shared .p12 private key inside the app bundle, Photon generates a unique RSA-2048 keypair and self-signed X.509 certificate directly on your device at first launch. The private key is protected with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, ensuring it is never included in unencrypted backups or synced to external servers.
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
kSecAttrKeyTypeRSA (2048 bits)
com.auraone.photon.client-identity.rsa2048
var privateKeyAttrs: [String: Any] = [
kSecAttrIsPermanent as String: true,
kSecAttrApplicationTag as String: tagData,
kSecAttrAccessible as String:
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
]
var attributes: [String: Any] = [
kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
kSecAttrKeySizeInBits as String: 2048,
kSecPrivateKeyAttrs as String: privateKeyAttrs
]
Shared App Group Container (group.com.auraone.photon)
To allow Home Screen widgets, iOS 18 Control Center controls, Siri App Intents, and the watchOS companion relay to connect to your television without launching the main app, Photon stores paired TV metadata in devices.json and your StoreKit 2 unlock status in entitlements.json inside the local App Group container (group.com.auraone.photon).
group.com.auraone.photon
devices.json, entitlements.json
.atomic)
// group.com.auraone.photon/devices.json
{
"schemaVersion": 2,
"devices": [
{
"id": "AA:BB:CC:4F:91:0E",
"name": "Living Room Bravia XR",
"brand": "sony",
"lastKnownIP": "192.168.1.142",
"port": 6466,
"certificatePin": { "sha256Hex": "9f86d081..." }
}
]
}
// group.com.auraone.photon/entitlements.json
{
"isPro": true,
"productID": "photon.pro.lifetime",
"isFamilyShared": true
}
TLS 1.3 Certificate Pinning (CertificatePin.swift)
During initial 6-character hexadecimal pairing on TCP port 6467, Photon binds your client certificate and the television's X.509 certificate into the Polo SHA-256 pairing secret and pins the SHA-256 digest of the television's leaf certificate (Trust On First Use). Every subsequent remote control session on port 6466 verifies the television's leaf certificate against this stored SHA-256 pin inside sec_protocol_options_set_verify_block.
ATVError.pinMismatch abort; prompts re-pair
sec_protocol_options_set_verify_block(
tlsOptions.securityProtocolOptions,
{ _, secTrust, completionHandler in
let trust = sec_trust_copy_ref(secTrust).takeRetainedValue()
guard let leafCert = SecTrustGetCertificateAtIndex(trust, 0) else {
completionHandler(false)
return
}
let actualPin = CertificatePin(
derBytes: SecCertificateCopyData(leafCert) as Data
)
completionHandler(actualPin == expectedPin)
},
verifyQueue
)
Microphone & On-Device Speech (VoiceStreamer.swift)
Photon accesses the microphone exclusively while you actively press and hold (or tap) the Voice button. Audio is captured in memory as ephemeral 16-bit mono 8 kHz PCM chunks (20 KiB target, 8 KiB minimum) and streamed directly to your paired television over the encrypted local TLS 6466 connection. For televisions that do not support raw voice packets, Photon uses Apple's SFSpeechRecognizer with requiresOnDeviceRecognition = true so speech never leaves your device.
SFSpeechRecognizer (requiresOnDeviceRecognition = true)
public struct VoiceStreamer: Sendable {
public static let targetChunkSize: Int = 20 * 1024 // 20 KiB
public static let minimumChunkSize: Int = 8 * 1024 // 8 KiB
public static let sampleRateHz: Double = 8_000.0
public static let channels: Int = 1
public static let bitsPerSample: Int = 16
}
// On-device speech fallback (VoiceButton.swift):
recognitionRequest.requiresOnDeviceRecognition = true
Permission, entitlement, and privacy manifest audit table
Every system capability requested by Photon across iOS, iPadOS, watchOS, and macOS is listed below alongside its technical purpose, network boundary, and user revocation path.
| permission or entitlement | platform scope | why it exists in photon | leaves local lan | how to revoke or reset |
|---|---|---|---|---|
| NSLocalNetworkUsageDescription | iOS, iPadOS, macOS | Allows Photon to discover Google TV and Android TV devices on your Wi-Fi network and open direct TLS sockets on TCP ports 6467 and 6466. | Never | iOS Settings / Privacy & Security / Local Network / Photon |
| _androidtvremote2._tcp | Bonjour mDNS (NSBonjourServices) | Browses for televisions running Android TV Remote Service v2 (plus _androidtvremote._tcp to detect legacy v1 firmware). | Never | Revoking Local Network permission disables all mDNS browsing |
| com.apple.developer.networking.multicast | iOS, iPadOS, macOS | Used exclusively by WakeOnLAN.swift to transmit a 102-byte IEEE 802.3 magic packet to UDP broadcast ports 9 and 7 when waking a sleeping TV. | Never | Disable Wake-on-LAN per TV in Photon Device Settings or revoke Local Network |
| NSMicrophoneUsageDescription | iOS, iPadOS | Captures 16-bit 8 kHz PCM audio only while you hold or tap the Voice button to stream voice search queries directly to your paired TV over TLS. | Never | iOS Settings / Privacy & Security / Microphone / Photon |
| NSSpeechRecognitionUsageDescription | iOS, iPadOS | Provides an on-device speech-to-text fallback (requiresOnDeviceRecognition = true) for TVs that do not accept raw PCM voice streams. | Never | iOS Settings / Privacy & Security / Speech Recognition / Photon |
| NSPrivacyAccessedAPICategoryUserDefaults CA92.1 | iOS, iPadOS, watchOS, macOS | Declared in PrivacyInfo.xcprivacy to read and write user preferences, theme selection, and cached Pro status within the app and its App Group (group.com.auraone.photon). | Never | Uninstalling Photon removes all app and App Group defaults |
| kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly | Apple Keychain | Stores the on-device RSA-2048 client private key and self-signed X.509 certificate used for mutual TLS authentication with paired televisions. | Never | Tap Regenerate Client Identity in Photon Settings or delete the app |
Diagnostic reports, StoreKit 2 purchases, and privacy contact
Summary of user-initiated support exports, Apple StoreKit 2 transaction verification, and how to reach our privacy engineering team.
User-initiated redacted diagnostic reports
Photon never transmits crash logs or connection diagnostics automatically. If you open Connection Doctor and tap Copy report, Photon formats a plain-text report on your local clipboard with IPv4 host octets (192.168.1.***), MAC addresses (AA:BB:CC:**:**:**), and SHA-256 certificate pins (SHA256:9f86d081...[REDACTED]) automatically masked so you can inspect every line before choosing whether to email support@auraone.com.
StoreKit 2 purchases and privacy inquiries
Photon Pro (photon.pro.lifetime) is processed directly by Apple using StoreKit 2 on-device JWS signature verification. AuraOne never receives your Apple ID, name, billing address, or payment card details. For privacy or security questions, contact privacy@auraone.com or support@auraone.com.