1 · The handshake travels through the air. The broadcasting device plays a near-ultrasonic tone sequence (~17–19 kHz — most adults can't hear it) that encodes a random room key. Only devices physically present can hear it.
2 · The key becomes a secret meeting point. Both devices hash the key into an anonymous rendezvous channel and encrypt everything on it with AES-GCM derived from the same key. The internet only ever sees ciphertext at a random-looking address — the key itself never leaves the room.
3 · Direct when it can be, guaranteed always. The instant both devices meet, they link over the encrypted relay so you can send right away — then quietly upgrade to a direct, peer-to-peer WebRTC channel (usually straight across your local network, DTLS-encrypted). If a strict network blocks peer-to-peer, the transfer simply keeps flowing over the relay, which only ever carries end-to-end-encrypted bytes — never your files' contents.
Needs a brief internet connection for the rendezvous · one pair per key · everything is AES-GCM encrypted end-to-end the whole way, so no server ever sees your data or the room key · installable as an app · research lineage: Sound-Proof (ambient-audio 2FA) and 15 years of acoustic-sensing papers.