Staying Connected

After you pair, the phone never asks you to type an address. It already knows several ways to reach your Mac — captured the moment you scanned the QR code — and it quietly tries them in order until one answers. This chapter explains that order, why away-from-home access sometimes needs a little help, and how to read the connection status at a glance.

The whole connection is anchored to your Mac's control server. If that server is switched off, or the Mac is asleep or off the network, there is nothing for the app to reach — so this chapter ends with the conditions that have to be true for any of it to work. For pairing itself, see Chapter 3; for the desktop side of the control server, see the desktop manual.

4.1The three paths home

When you paired, the QR code carried more than a token: it carried a small list of addresses at which your Mac can be found — its address on your home or office network, its Tailscale address, and the address of any Cloudflare tunnel the Mac has enabled. The app keeps that list and, every time it needs to talk to the Mac, walks it in a fixed order:

1. Your home or office network first. If the phone and the Mac are on the same Wi-Fi (or wired LAN), the app connects directly — the fastest, lowest-latency path, with nothing in between.
2. Tailscale next. If a direct connection doesn't answer, the app tries the Mac's Tailscale address. This works wherever you are, as long as your phone and Mac are members of the same tailnet.
3. A Cloudflare tunnel last. If neither of those works, the app falls back to a Cloudflare tunnel — but only if the Mac has one enabled. This reaches your Mac from anywhere without any network of your own.

The app remembers which path last worked and tries that one first next time, so reconnecting on a familiar network is near-instant. You never choose the path by hand; you simply open the app and it lands on whichever route is live.

4.2When you're on the same Wi-Fi

At home or in the office — phone and Mac on the same network — the app takes the direct path. This is the best case: everything is reachable and fast. Service status, start and stop, alerts, the AI, device web UIs and LAN shares all behave as if the phone were sitting next to the Mac, because in network terms it is.

If your Mac advertises an HTTPS address, the app verifies the Mac's identity using the certificate fingerprint it captured at pairing, so even a self-signed certificate can't be impersonated on your own network.

4.3When you're away from home

The moment you leave your network, the direct path stops answering and the app moves on to the other two. Away access comes down to a simple question: can your phone reach your Mac at all right now?

• Tailscale answers yes whenever your phone and Mac share a tailnet. It is the most reliable away path: it works on cellular, on hotel and café Wi-Fi, behind almost any router, with no ports to open.
• A Cloudflare tunnel answers yes whenever the Mac has one running. It needs nothing on the phone and reaches from anywhere, but it depends entirely on the Mac keeping that tunnel up.

If neither is available — no shared tailnet, no tunnel — the app simply can't see your Mac from outside, and the status dot goes to offline. That is expected behaviour, not a fault: a Mac on a private home network is, by design, not reachable from the open internet.

4.4Device web UIs and LAN shares

Reaching your Mac is only half the story. The Web UIs page (under More) opens the web interfaces of other things on your network — routers, NAS boxes, printers, dashboards — and Shared (under More) can open LAN shares your Mac has temporarily exposed. These live on the network itself, not on your Mac, so the app reaching your Mac does not guarantee it can reach them.

A device web UI or a LAN share is reachable only when your phone can actually get onto that network:

• On the same Wi-Fi — everything on the LAN is directly reachable.
• Over Tailscale — reachable if your tailnet routes to that network, for example through a subnet router advertising the LAN's range. Without that, Tailscale gets you to the Mac but not to the printer beside it.

This is the practical reason the TIP above recommends a subnet router or a Tailscale-connected router: it turns "I can reach my Mac" into "I can reach my whole network," which is what makes the Web UIs and Shared screens useful from the road.

4.5The connection status dot

The coloured dot in the Fleet tab header is the app's honest summary of whether it can talk to your Mac right now. It has three states:

To force a fresh attempt, pull down to refresh on the Fleet tab. The dot returns to connecting while the app re-walks the path list, then settles on connected or offline. Pull-to-refresh is also the first thing to try whenever something looks stuck or out of date.

4.6What has to be true

None of the three paths can conjure a connection that isn't there. For the app to reach your Mac, all of the following must hold:

• The Mac's control server is enabled. This is the service the phone talks to. If it's switched off on the Mac, every path fails and the dot stays offline.
• The Mac is online and reachable. It must be awake, on a network, and reachable from where your phone is — same Wi-Fi, shared tailnet, or via its Cloudflare tunnel. A sleeping Mac answers nothing; consider keeping it from sleeping if you rely on remote access.
• You have a working away path, if you're away. Off your home network, that means Tailscale on both ends, or a tunnel the Mac keeps running.

Push notifications follow the same logic from the other direction: the Mac (or its push relay) must be online to send an alert. If alerts go quiet, the cause is usually the same as a missing connection — the Mac is asleep, off, or unreachable. The summary below ties the three locations together.