Privacy and storage¶

BlueFerry runs entirely on your computer. It talks directly to your iPhone over Bluetooth and sends nothing to a server.

Notifications¶

Choose one of three notification modes in the client's iPhone page:

Notifications from other apps are shown and then discarded. They're never added to message history and never broadcast to other programs. Messages that arrive through both MAP and ANCS appear only once. The ANCS copy of an Apple Messages notification (title, subtitle and up to the first 1024 bytes of the text) is kept in local history under the storage mode below, because it carries the group details that MAP lacks.

By default, dismissing a message popup also marks the message read on the iPhone. Some do-not-disturb or "block" actions in notification centers dismiss popups instead of hiding them, which would mark messages read without you seeing them. Set BLUEFERRY_MARK_READ_ON_DISMISS=false to turn that off.

Filter apps¶

With All iPhone notifications, you can limit which apps create popups by their exact, case-sensitive bundle ID:

# Allow every app except these:
BLUEFERRY_ANCS_APP_BLOCKLIST=com.example.Chat,com.example.Mail

# Or allow only these:
# BLUEFERRY_ANCS_APP_ALLOWLIST=com.example.Calendar,com.example.Reminders

The blocklist wins if both are set. An empty allowlist blocks every app except Messages. To find bundle IDs, watch the log while the app sends a notification. BlueFerry logs each app once, without content:

journalctl --user -u blueferry -f | grep "ANCS app observed"

Click rules¶

Click rules open a fixed address or app when an app's popup is clicked. Nothing from the notification is passed along. Rules are stored unencrypted in settings.json, and the notification server never sees them, only a fixed "Open" action and a random per-popup ID.

Local data¶

BlueFerry keeps message history and a contact cache so conversations survive restarts. You choose how:

• If the wallet is locked, live messages still arrive. Stored history and contact names wait until you unlock it (in the client, or with blueferry storage-unlock).
• Changing the storage mode clears the existing cache, so encrypted and unencrypted records are never mixed.
• Starred conversations, saved group members, and group confirmations follow the same storage mode.
• blueferry history-clear deletes local message history.

With the optional contact photos, the contact cache also holds your contacts' pictures under the same storage mode, and the backend keeps short-lived owner-only copies in $XDG_RUNTIME_DIR/blueferry for popup icons. The setting itself is saved as contact_photos in settings.json. Turning the option off stops photo display immediately and starts deleting the avatar files and stored photos. Cleanup waits for active contact syncs and retries failures; blueferry contact-photos status reports when it is complete.

Encryption protects data at rest. Other programs running as your user can still use the BlueFerry D-Bus API and, while the wallet is unlocked, may be able to read its secrets.

Files and folders¶

Uninstalling the packages doesn't remove either folder.

One-time codes¶

One-time code auto-copy is off by default. When you turn it on, the backend puts verification codes from new messages on the desktop clipboard, where every application that reads the clipboard can see them. The code is never logged, stored, or published on BlueFerry's D-Bus API. With BLUEFERRY_OTP_CLEAR_SECONDS, the backend releases its own clipboard source when the timer fires; shutdown does the same even without a timer. It never reads the clipboard back or globally clears another program's selection. Copies retained by persistence tools or clipboard managers remain under those tools' control. The first Wayland copy waits for the sensitive-hint capability probe; managers must honor that hint to exclude codes from their history.

Settings in local.env¶

Edit ~/.config/blueferry/local.env, then restart the service with systemctl --user restart blueferry.

Pairing writes the phone and adapter settings to the same file; change those by pairing again rather than by hand.

Media control¶

The optional media control is off by default. When you turn it on, track, artist, album and player name stay inside BlueFerry and are fetched by clients through its authenticated D-Bus interface; nothing about your music is written to disk or the log. Only the on/off choice is saved, in settings.json. The separate MPRIS option deliberately makes the current track readable by every application in your login session, like any desktop music player.

Calls and music stay on the iPhone¶

With WirePlumber 0.5 or newer, BlueFerry writes ~/.config/wireplumber/wireplumber.conf.d/99-blueferry-keep-phone-audio.conf before pairing. It stops the computer from acting as a Bluetooth speaker or headset for the iPhone, so calls and music stay on the phone. Set BLUEFERRY_KEEP_PHONE_AUDIO_ON_PHONE=false to remove that file.