---
title: "Constellation Connections & Privacy"
description: "Understand Local Network, Private Link, Direct, Noema Bridge, and Cloud Relay, including how Noema chooses a route and what each route means for privacy."
version: "Noema 3.6+"
platforms: ["iPhone", "iPad", "Mac", "Vision Pro"]
reviewed: "July 26, 2026"
canonical: "https://noemaai.com/docs/constellation-connections"
---

# Constellation Connections & Privacy

Noema tests the available paths when you press Use and selects the best working route before the first message.

## Route order

| Route | When Noema uses it | What it means |
| --- | --- | --- |
| Local Network | Both devices can reach each other on the same LAN. | The request goes directly to the Mac on the local network and usually has the lowest latency. |
| Private Link | You configured a reachable Tailscale, ZeroTier, or WireGuard address. | Traffic travels over your private mesh without router port forwarding. |
| Direct | The devices can establish an encrypted peer-to-peer path across networks. | CloudKit introduces the devices, but no relay carries the conversation. |
| Noema Bridge | A restrictive NAT or firewall prevents Direct. | End-to-end encrypted bytes pass through Noema’s relay; the relay cannot read the request or reply. |
| Cloud Relay | Faster routes are unavailable. | Requests and replies use your private CloudKit database. It is the broadest-compatibility and slowest fallback. |

Direct is not guaranteed. Carrier-grade NAT, hotel Wi-Fi, enterprise firewalls, and some mobile networks intentionally prevent peer-to-peer connectivity. Seeing Noema Bridge on 5G can therefore be normal rather than a configuration problem.

## See the current route

- **Stored → Constellation**, under Remote Session.
- The Chat connection button.
- The menu containing the active model’s eject action.

Constellation settings also explain every route. Private Link appears in the route list after one has been configured.

## Set up Private Link

1. Connect the Mac and requesting device to the same Tailscale, ZeroTier, or WireGuard network.
2. Open **Stored → Constellation** on the requesting device.
3. Open the Mac under the lower **Private Link** section.
4. Enter the private address assigned to the Mac.
5. Save, then press **Use** on a Mac model to test the route.

No router port forwarding is required. Noema checks the private address directly and avoids routing that check through a system proxy.

## What Noema Bridge can see

Noema Bridge receives an opaque routing token and encrypted traffic. The two devices authenticate the session and encrypt the request and response end-to-end. The bridge forwards sealed bytes and does not run the model or store its weights.

Cloud Relay is a separate fallback. It stores the exchange in the user’s private CloudKit database rather than sending it through the Bridge socket.

## Remote Access and Off-Grid Mode

Remote Access is off by default. Enabling it is a deliberate action on both the Mac and requesting device.

Off-Grid Mode takes priority over Constellation. It pauses iCloud sync, discovery, Remote Access, and network-backed tools until the mode is turned off.

## Related documentation
- [Noema Constellation](https://noemaai.com/docs/constellation)
- [Constellation Models, Tools & Photos](https://noemaai.com/docs/constellation-models-and-tools)
- [Privacy & Network Activity](https://noemaai.com/docs/privacy-and-network-activity)
- [Privacy FAQ](https://noemaai.com/docs/privacy-faq)