Viewing a session

From Sessions, open a session. Everything displayed is decrypted in your browser: the server only sends encrypted data.

#The header

A line summarizes the session, for example: "Sat 7 Nov 2026 · 14:02 – 18:51 · 1 phone · 4 takes · 563 segments received". Then badges:

• Locked until 14 Nov, 18:51: the end of the lock on the last segment received.
• 23 min 40 s on the server: the duration received.
• 12 s not received: the duration of the declared gaps.
• Checked in at 21:10, if applicable.
• Hidden from your contacts, visible to you only, if applicable.

A take is one recording, from start to stop on the field phone.

#The segment timeline

The timeline shows each take along the time axis. Each segment of 2 to 3 seconds has its place on it:

Below the timeline, the take's events are listed in plain language: "16:40:52 Switched to 480p, weak network."; "16:42:40 Back to 1080p."

#Gaps

A gap is never filled in. It is dated and explained:

16:41:08 → 16:41:20 · 12 s not received, network saturated. The server has nothing from this period. Segments #0289 to #0293 are missing from the chain.

The server does not reconstruct or interpolate anything. A gap shown as it is protects the rest: nobody can claim that images were quietly removed.

#The player

• It plays the original, non-re-encoded files, as the phone produced them, decrypted in your browser.
• The times displayed are the phone's, cross-checked against the time the server received them.
• Segments play one after another; a gap is flagged during playback.
• Each decrypted segment is compared with the hash declared by the phone (plainHash). If they differ, the segment carries the Hash mismatch badge: the file being played is not the one the phone described when sending it. The segment is neither hidden nor corrected.
• Depending on the browser, video is in MP4 (iPhone) or WebM (Android). A recent browser plays both.

#The map

If location was enabled and allowed, a map can be displayed on request. See Location.

#Chained hashes

Each segment has two SHA-256 hashes:

• the file hash (plainHash), the hash of the decrypted file, computed by the phone before encryption and declared when sending. This is the one a third party recomputes on the files of the legal export;
• the encrypted hash (hash), computed by the server on what it received. Each segment also contains the encrypted hash of the previous one in the same take: the segments form a chain.

A segment removed or modified afterwards visibly breaks the chain. The file hash is declared by the phone: the server cannot check it, but it signs it in the manifest together with the time of receipt. If the decrypted file does not match it, the Hash mismatch badge is displayed.

The summary shows, for example, "563 verified, 1 declared gap". View hashes displays the full list.

#Third-party timestamp

When the session closes, the server produces a manifest: the ordered list of segments, their hashes, the phone and server times, the gaps, the log. It signs it with its key, then asks an independent timestamping authority to timestamp the hash of this manifest.

This timestamp proves that this manifest existed at that time, independently of us. Verify the proof explains how to check it yourself; the full procedure is in the legal export. If the authority is unavailable at closing, the request is made again later and the actual date of the timestamp is displayed.

Closing is automatic 15 minutes after the recording window ends.

#Chain of custody log

Every event in the session is recorded: connection QR code created, phone connected or cut off, first segment received and lock applied, gaps caused by the network, closing and timestamping, check-in, views, shares, session hidden from your contacts, extensions.

The log is append-only: each entry contains the hash of the previous one and a server signature. It is part of the legal export.

#Actions

#Share with a contact

Gives one of your trusted contacts read access. Your browser encrypts the session key for that contact; the server passes it on without reading it.

#Extend recording

As long as the session is not closed, Extend recording pushes back the end of the recording window: +1 h, +3 h, +6 h or +12 h, counted from the planned end, or from now if it has already passed, and never more than 7 days after the start. A phone whose window had ended resumes sending on its own. The button is reserved for the person who created the session (or, for a collective's session, its members and admins).

#Extend the lock

Pushes back the end of the lock for all segments. You or a read-and-modify contact can do this at any time. A lock can never be shortened, even right after extending it by mistake.

#Hide from my contacts

Hide from my contacts hides the session from all your contacts, without erasing anything. Useful if you filmed something private. It is recorded in the log and can be reversed: Show to my contacts again.

A session hidden from your contacts keeps its lock, and you can still export it.

#Schedule deletion

While the lock is active, the button is grayed out, with the explanation:

Deletion impossible before 14 Nov at 18:51: the lock is active, nobody can delete, not even us.

After the lock ends, Schedule deletion sets the deletion for 24 hours later. It can be canceled during that time. Nothing is deleted automatically when the lock ends: an expired session stays in place until you ask for it to be deleted.

#Legal export

See Legal export.

#Sessions received from a contact

A session a contact has shared with you is displayed the same way, read-only. You can neither delete it nor hide it from contacts. A read-and-modify contact can extend its lock and export it.