New session

From Sessions, choose New session. Five settings, then a QR code to scan with the phone that will film. Do this at home, calmly, before you leave. A small "?" button next to each non-obvious setting explains what it means.

#Record now, with this phone

If your account is on the phone that will film, no QR code is needed: on the Sessions page, Record now creates a session with your default settings (dated name, recording window from now for the chosen length, lock, sharing rule, position, discreet mode, contacts warned) and opens the camera at once. It is the same field module as through a QR code: this phone can only send. The camera opens in the same tab: to get back to your account, use the browser's Back button, or sign in again with your passphrase. The QR page of a session prepared in advance offers the same shortcut, Record with this phone.

Default settings are changed in My account.

#1. Session name

The name is encrypted in your browser, like the footage: the server does not read it. Still, avoid a name that identifies you. It will appear for your contacts when the session is shared with them, and in the legal export.

#2. Recording window

These are the hours during which the field phone can send: a Day, a Start time and an End time. Outside this window, the phone cannot send anything.

Allow a wide margin: the start of the protest, and the real end, which is often later than planned. The end of the recording window is also the starting point of automatic sharing, and the session is closed 15 minutes after it.

If the protest runs late, open the session and choose Extend recording: +1 h, +3 h, +6 h or +12 h, never more than 7 days after the start. This works as long as the session is not closed. A phone whose window had ended resumes sending on its own.

#3. Lock

The lock is the period during which nobody can delete a segment, counted from when the server receives it. A slider goes from 1 h to 30 days (the maximum) in stops: 1 h, 2 h, 3 h, 6 h, 12 h, 24 h, 36 h, 48 h, then 3 to 7 days (7 days is recommended), 10, 14, 21 and 30 days. A segment received on a Saturday at 16:00 with a 7-day lock is locked until the following Saturday at 16:00.

The server enforces three rules: 30 days at most, extendable at any time by you or a read-and-modify contact up to that maximum, never shortened once the session is active, whoever asks, including you. The duress code also raises the lock to 30 days, not beyond.

The lock protects against accidental deletion. Above all, it makes a simple position tenable when someone demands that you delete: "it's locked, I can't". That is true, and it can be verified.

#4. Contacts to notify

Tick the trusted contacts concerned by this session. They are notified when the first segment arrives, and see the session according to their role and the sharing rule chosen below. For each ticked contact, your browser prepares a standby access right away: the server will be able to open it later (alert, duress, no check-in) without ever being able to read it.

These standby accesses are the only ones the field phone can have opened: a check-in under duress from the phone shares the session only with the contacts ticked here.

Manage trusted contacts opens the contacts page.

#5. Automatic sharing if you do not check in

Nothing is ever published, at any step. The delays are set in Security and codes.

#Two session options

• Location: on by default. The phone will ask for location permission and send its location, encrypted. See Location.
• Discreet mode allowed: on by default. Lets the phone switch to audio only, black screen, with automatic resume. See The field phone.

Both options are chosen when the session is created: they cannot be changed afterwards.

#6. Connect the phone

Generate the QR code creates the session and displays the connection QR code.

#The QR code

On the field phone, open the camera and scan the QR code. Check that the screen shows "Phone connected. Send only."

The QR code points to oh.gy, the field phone's neutral address. The secret code is placed after the # sign in the address: that part is never sent to the server and does not appear in any log.

This QR expires in 10 minutes. Until then, it can be used several times: if the camera app opens the link twice, or if several phones scan it, each one is connected. A phone already connected to a session in progress does not switch on its own: if it scans another QR, it keeps the code aside and offers Switch to the new session. After the delay, generate a new QR. The phone itself can send throughout the recording window chosen in step 2.

#The backup short code

If the QR will not scan (damaged screen, lighting), open oh.gy on the phone and enter the backup short code, 8 characters shown in two groups (K7QF 29XM). It expires at the same time as the QR and can be reused just like it.

The connected phone can only send. What it can and cannot do is detailed in The field phone.

#Connected phones

The list shows the phones connected to this session, with the connection time and the last activity. Several phones can send to the same session: each one produces its own takes. A link opened twice by the same phone shows up as two phones, one of which stays idle; this has no consequence.

To connect a phone later, open the session and choose Connect a phone.

#Cut off the phones

Cut off the phones disables the QR code, the short code and all phones already connected to this session. They can no longer send anything. What has already been received stays on the server, locked: cutting off deletes nothing. Create a new QR code then lets you connect a phone, without touching what has been received.

Cut off the phones if a connected phone is lost before the protest, or if someone may have photographed the QR code.

#Before you leave

• The field phone is charged, and automatic screen lock is turned off (see The field phone).
• You know your check-in codes by heart.
• Your contacts know that a protest is planned and what they might receive.