Settings & trust

Settings is where the app shows its security state plainly and lets you manage relationships — with your hub and with each bridge.

Reading the trust surface

• Hub connection — whether the foreground connection to your hub is up, and where it points.
• Certificate pin — confirmation that the connection is validated against your hub's pinned CA. There is no unpinned mode; this tile is a status, not a switch.
• Encrypted channels — how many of your paired bridges currently have an active end-to-end channel ("3/4 paired bridge channels active"). A paired-but-offline bridge shows here as inactive, which is normal for a machine that's asleep.
• Notifications — the push opt-in.

Managing bridges

Each paired machine is listed. From here you can:

• Scan another bridge — pair an additional machine (how).
• Unpair — remove this phone↔bridge relationship. The bridge forgets this phone's pair keys and push token; other phones and other bridges are untouched. Pair again any time with a fresh QR.

Unpairing is the right-sized tool for "I don't want this phone controlling that machine anymore." For a lost phone, revoke at the hub instead — that kills the phone's hub credential itself, works while the phone is offline, and every bridge picks it up automatically: see hub commands & ceremonies.

Danger zone: remove hub

Remove hub from this phone erases the app's enrollment — hub address, pinned CA, credentials, and all pair state. The phone returns to its factory "scan a hub QR" state.

Use it when retiring a phone, handing it over, or re-enrolling after a hub-side ceremony (a restore or CA rotation invalidates old enrollments anyway). Removing the hub on the phone does not clean up hub-side records — pair with c3sync hub control revoke / c3bridge revoke on the infrastructure side when it matters.