What peer to peer actually means for your privacy

"We don't record your calls" is a policy. Policies change, and you have no way to check one. What follows is the architecture instead, because that is the part you can reason about.

What actually travels through Kahoo

When two people are paired, their browsers exchange a handful of small text messages through Kahoo's server:

• an SDP offer — a description of what codecs and streams one browser can handle;
• an SDP answer — the other browser's reply;
• a series of ICE candidates — network addresses each browser might be reachable on.

That is the complete list. Once the two browsers have found a path to each other, the video and audio flow directly between them. Kahoo's server is not in the media path at all — not as a proxy, not as a mirror, not as an optional recorder that happens to be switched off.

Why this is stronger than a promise

A platform that relays media through its own servers can start recording with a configuration change. Nothing about its architecture prevents it, and nothing about its privacy page proves it has not. Kahoo could not start recording your call without rebuilding how calls work.

The same architecture is what makes text chat honest too. Messages are relayed through the lobby — they have to be, they are not part of the media stream — but they are forwarded and forgotten. There is no chat table in the database. Not an empty one; none.

What peer to peer does not protect you from

Being precise about the limits matters more than the marketing:

• The other person can record their own screen. No web technology can prevent that. Assume anything on camera can be captured — this is the single most important thing on the safety page.
• A direct connection means the two devices exchange network addresses. That is inherent to WebRTC on every platform that uses it. It is one of the reasons a relay server is a genuine privacy feature as well as a connectivity one.
• Kahoo still keeps session metadata. That a call happened, between which two identities, when, for how long, and why it ended. Without it, a report could not be tied to a real interaction and moderation would be unenforceable.

The relay trade-off

A TURN relay forwards media when two networks cannot reach each other directly. It fixes connectivity on restrictive networks, and it hides each party's address from the other. It also costs real money per gigabyte, and it puts a server back in the media path.

Kahoo ships with TURN disabled. On a small number of networks that means a connection fails, and when it does we say so plainly and offer you the next person rather than showing a black rectangle and hoping. If a relay is ever enabled, credentials will be short-lived and issued per session — a long-term TURN credential handed to every browser is a public one.

How to verify any of this

Open chrome://webrtc-internals during a Kahoo call. You will see the peer connection, the candidate pair that won, and whether it is host, srflx or relay. With TURN off it will never be relay — which is the same thing as saying the media never reached us.