Cursors on iPhone and iPad
No WebRTC? Keep using your local tools. Start, notes, the address book, guides, and the cockpit do not require a peer connection. The connection panel offers an independently verified HTTPS path for published parts.
Safari supports WebRTC, but an API can be missing, blocked, or unable to connect in a particular browser or network. Cursors checks the capability rather than rejecting every iPhone by name. You do not need to disable a privacy setting to use the local tools.
1. Open the link and try a note
Open curso.rs and choose START. Type in #this-browser, choose SAVE LOCAL NOTE, then reload and check that it is there. This saves a note in this browser profile, not in a cloud account. The address book below works the same way.
A link opened inside another app may use a different browser or storage context. Use that app's Open in Safari action when available, or copy the address into Safari. Do not assume notes or passkeys from the in-app browser have moved with the link.
2. Use the connection panel
On Start or Chat, open ON YOUR PHONE / Connection options. It opens automatically when peer connections are missing, explicitly disabled, or fail the local capability probe.
Choose CHECK HTTPS FALLBACK. Cursors fetches a tiny public test part from this site's published assets. It accepts it only when its size and SHA-256 hash match the pin shipped in the application. No identity, message, credential, or private key is sent.
The result says hash verified only after the bytes pass that check. It proves that one part could be fetched, not that every file, a peer, cloud chat, or your backup is available. An offline, HTML, partial, oversized, or incorrect response is not promoted to a successful transfer.
The picture above is an actual application capture with WebRTC disabled, not a photograph of a physical iPhone or evidence of a live cloud account.
3. When a peer connection stalls
Choose Use HTTPS-only mode after saving your current note. The page reloads with peers=off, skips the WebTorrent peer observer, and does not automatically join the public reference swarm. Remove peers=off from the address to try peer connections again.
| What you are doing | Without WebRTC |
|---|---|
| Notes, saved contacts, loaded guides, cockpit inspection | Keep using the local tools. Browser storage still has to permit the save. |
A part published at this site's /parts/ path |
Fetch with the caller-pinned hash and expected length; no peer library required. |
| A peer-only magnet or file with no published HTTP copy | Unavailable through this path. A publisher or explicit native bridge must provide the material. |
| Existing optional cloud mailbox or GitHub recovery | Uses its existing HTTPS service, but only when that service is enabled and your authorization succeeds. |
| Generic WebSocket relay, automatic cross-carrier chat, full offline synchronization | Not implemented by this change. Do not mistake a supported WebSocket API for an available relay. |
TURN is a WebRTC relay, not a replacement for a missing WebRTC API. The public HTTPS part reader does not silently proxy arbitrary peers, run downloaded code, or switch a private message onto a new service.
4. Returning after locking the phone
Keep the page open during a transfer. When you leave the page, its HTTP-check observation is invalidated and a pending diagnostic is cancelled. Returning to a visible page or restoring it from the page cache rechecks cloud health. It does not automatically resend notes, publish identity, or save to GitHub.
An already loaded page with retained local state is not the same thing as a guaranteed cold offline boot. A suspended or terminated browser is not an always-on server.
5. Keep a recovery copy
Read Resume Your Cursors. Browser storage can be cleared or evicted. A Home Screen icon does not turn it into a complete backup.
EXPORT ENCRYPTED SELF saves identity ciphertext, not the notebook, contacts, or all cursor work. Keep the original unlocking credential and test recovery before clearing the original browser. A passkey that cannot reproduce the required PRF output cannot unlock that vault merely because GitHub sign-in worked. This change does not claim real-device passkey interoperability.
Chat with a Friend explains the separate cloud path. It remains experimental and is not end-to-end encrypted. Do not send secrets through it.
Evidence and references
The regression suite disables both WebRTC and BroadcastChannel, tests a throwing peer constructor, saves and reloads a local note, verifies the real published part, rejects substituted bytes, and keeps cloud controls disabled under paused health. Chromium and mobile-emulated Playwright WebKit runs are automated; physical iPhone recovery and suspension verification remain tracked in #167.
Primary references: WebKit WebRTC support, WebKit storage and eviction policy, and what Playwright WebKit does and does not test.