Kalon Link lets an iPhone or iPad use the models installed on your Mac. The phone keeps its chats. For each reply it sends the conversation to the Mac, the Mac generates the answer, and the result streams back. Nothing goes through the internet: the two devices talk directly over your local network.
Requirements
- Kalon for Mac and Kalon for iPhone or iPad.
- Both devices on the same private network. The Mac only listens on private addresses and refuses to start Kalon Link if it has none.
- A model installed on the Mac.
Pair a device
On the Mac
- Open Settings › Kalon Link.
- Turn on Use this Mac from your phone or iPad. The row Where your devices will find it shows the Mac's addresses and the port, 11435.
- Under Pair a device, click Show code. Kalon shows a QR code and a six-digit code.
On the phone
- In Settings, under Privacy, tap Kalon Link.
- Scan the QR code shown on the Mac. It carries the Mac's addresses, port, key fingerprint and the code.
- The Mac shows the device as paired. Its models now appear in the phone's model list under the Mac's name.
A pairing code works once, for one device, and expires after five minutes. Five wrong attempts close the code, and the Mac asks you to show a new one.
How it is secured
- Encryption. All traffic uses TLS. The Mac creates its own certificate once and keeps its key in the Mac's Keychain.
- Pinning. The QR code carries a SHA-256 fingerprint of the Mac's public key. The phone connects only to a server that presents that exact key, so no other device on the network can stand in for the Mac.
- Tokens. Pairing gives the phone a random token with 100 bits of entropy. Every request after pairing must carry it. The phone stores its token in its Keychain, and the Mac stores its copy of each device's token in the Mac's Keychain.
- Private addresses only. The Mac binds to each of its private network addresses individually, never to all interfaces, and drops connections that come from a public address.
- Separate from the local API. Kalon Link runs its own listener. Turning it on does not open the local API server, which has no authentication.
Before pairing, only two requests are answered without a token: a health check that returns nothing about the Mac, and the pairing request itself.
What crosses the network
For each reply, the phone sends the chat's messages, the text of attached documents, any images for a vision model, and its instructions to the Mac. The Mac sends back the generated reply. The Mac does not save the phone's conversation; it records only a usage entry with the model, token counts and timing.
On the Mac, the notch's Kalon Link ring shows when a paired device is asking. See Settings reference.
Remove a device
- On the Mac, find the device under Paired devices and click Remove. It must be paired again before it can use the Mac.
- On the phone, open Kalon Link in Settings and choose Forget this computer. This destroys the phone's credential.
The phone pairs with one computer at a time.
Network switches and profiles
- Kalon Link is not an online model, so it works with Use online models off.
- Block all network access on the phone stops the phone from reaching the Mac, including pairing.
- A child profile on the phone cannot use Kalon Link.
- Kalon Link is off by default on the Mac.