The field phone

The field phone is the one that films, your own or a borrowed one. It does not need an account: it has scanned a connection QR code and can only send.

#An address that gives nothing away

The field phone never displays ripoux.fr. It opens oh.gy, a short name that says nothing about the tool. QR codes point to this address. The tab is titled "Send", with no name or logo. Someone who looks at the screen or the browser history sees a generic page.

Someone who knows ripoux.fr can make the connection. The neutral address only avoids revealing the nature of the tool at first glance.

#What it can and cannot do

It films, takes photos, records sound, and sends everything encrypted, as it goes. It shows how many seconds are safe on the server and how many are still waiting to be sent. If you have allowed it, it sends its location.

It cannot view what it has sent, list your sessions or your contacts, or delete anything, even its own uploads. It only holds a public key: it encrypts, it does not decrypt.

Each segment is encrypted on the phone before it leaves. Once the server's acknowledgment arrives, the segment is erased from the phone. If the phone is seized and unlocked, there is nothing to look at and nothing to delete.

#"Phone connected. Send only."

After the scan, this screen confirms the connection. It shows until what time the phone can send (the end of the recording window) and reminds you that nothing is kept on the phone once sent. Start opens the recording screen.

If this screen does not appear, the phone is not connected: scan again, or enter the backup short code. The QR stays valid for 10 minutes and can be scanned several times: a link opened twice does no harm.

A phone already connected to a session in progress keeps its session. If it scans the QR of another session, the code is kept aside and the screen offers Switch to the new session; without that press, nothing changes.

#Video, photo, audio

The recording screen offers three modes:

The large round button starts with a single press. To stop, hold it for 2 seconds: a ring fills up while you hold it. A short press does nothing, to avoid accidental stops.

While sending, the phone vibrates briefly every 30 seconds. When it stops, three short vibrations. The rear camera is used, in 1080p if the network allows. See Degraded network.

#The counters

• The large number: the duration of the current take, running continuously.
• "1 min 12 safe on the server": the duration the server has confirmed receiving. It moves in steps of 2 to 3 seconds, as acknowledgments arrive. Nothing is estimated.
• "4 s waiting to send": what is still on the phone, encrypted, in the queue.
• "Nothing waiting to send": the queue is empty.

If you have to let go of the phone, only the "safe on the server" counter matters: what it shows is safe.

#After stopping

Stopping brings you back to the recording screen, ready for the next take, with a note: "Recording stopped. Everything is on the server." or "Recording stopped. 4 s are still leaving: keep this page open." You can chain as many takes as you want, and switch between video, photo and audio in between. The session goes on until the end of the recording window; nothing ends when a take stops.

#Checking in from the phone

In the settings panel of the recording screen, Check-in opens the 6-digit code entry. Same screen, same delay and same message whatever the code. A check-in from the phone only concerns this session. See Check-in.

#Black screen

The Black screen while recording toggle makes the screen completely black while recording. The camera preview is off, recording continues, the battery lasts longer. When the browser allows it, the phone asks the system not to put the screen to sleep.

The phone stays unlocked and the page stays open: a locked screen would stop the recording (see below).

#Discreet mode

If the session allows it, discreet mode combines audio only, the black screen and automatic resume: if the page is closed and then reopened, recording resumes without a press, provided the browser has remembered the microphone permission.

#Its real limits

The field phone is a web page, not an installed app. Browsers severely limit what a page can do when it is not in the foreground:

• Recording stops if the screen locks or if you switch to another app. This always happens on iPhone, and often on Android.
• Restarting the phone does not restart anything. No page can reopen on its own.
• Automatic resume only acts when the page is reopened, by you. It saves you from looking for the button.
• What had already been sent stays on the server. What was waiting in the queue leaves when the page is reopened, if the phone's data has not been cleared in the meantime.

Discreet mode makes recording less visible, not invisible.

#Before you leave

• Turn off automatic screen lock (phone settings, "Brightness" or "Display"), or set it to the longest duration.
• Keep the page in the foreground. No calls, no other app while recording.
• Charge the phone, and bring a power bank if possible.
• Do a test run at home the day before: connecting the phone, a few seconds of filming, stop, then verify in your account. The browser will ask for camera, microphone and, if enabled, location permissions: accept them at that point, not in the middle of the protest.
• On iPhone, use Safari. On Android, a recent version of Chrome or Firefox.
• You can add the page to your home screen: it is called "Send".

#End of session

The end screen only appears when the session is really over: recording window over, phones cut off from the account, or session closed. It shows "Session over. Nothing can be viewed from this phone. Find your images in your account." Then either "Everything is on the server. Nothing is waiting on this phone." or the number of seconds still waiting for a network. In that case, keep the page open: sending resumes on its own.

From this screen, Tell what happened sends a testimony encrypted with the session; the phone will not be able to read it back.

If the recording window is over while the protest goes on, open the session from the account and choose Extend recording (+1 h, +3 h, +6 h or +12 h, never more than 7 days after the start). The phone asks the server every 30 seconds and resumes sending what was waiting on its own, locations included. Meanwhile, the screen says these items will leave if the account extends the recording window.

The Finish on this phone link, in the settings panel, opens the same screen while the phone is still connected. It is then titled "This phone stays connected." and offers Resume recording. Nothing is ended on the server side.

Erase local traces empties the queue, this phone's access and the page's data. The button stays inactive until everything has been sent, so that an image that is not yet safe is never erased, even after the recording window has ended (an extension can still send it). With a non-empty queue it only becomes active when nothing can leave any more: phone cut off from the account, or session closed. It asks for a second press, Confirm erasing. After erasing, the phone can no longer send without scanning a QR code again.

The browser history keeps a record of a visit to oh.gy. A web page cannot erase it: do it yourself in the browser settings if necessary.

#See also

• Field alert: warn your contacts from the phone.
• Location
• Known limitations