An app is a folder of HTML and a manifest, run under a hashed hostname in its own process and locked down from outside requests, its calls passing through a service worker to the Peergos tab; permissions are declared in the manifest and folder access is granted in a dialog; one browser gap (WebRTC) remains, so install only trusted apps for now.

It is how third-party code runs on private data without becoming a leak.

A Peergos app is a folder of plain HTML and JavaScript, with a manifest.

It runs under its own hostname, the hash of its path. Isolated from Peergos and from every other app.

Its requests go through one door: a service worker to the main Peergos tab, which checks them. A doorman. It is locked down so it cannot make outside requests.

By default an app has no permissions. It can read its own assets. Other permissions are declared in its manifest. Access to one of your folders you grant in a dialog, and can revoke.

Even the app's files never reach the server in the clear. One browser gap, WebRTC, is still open. So for now, install only apps you trust.

Check yourself. What does an app have access to before you grant anything?