Put your phones side by side.
They find each other over the air. No internet, no sign-up. Both screens show the same three words; if they match, nobody is in the middle. Each phone mints its half of the key.
otterlanternmaple
Coming soon to iPhone
A safe that only opens together.
Your halfTheir half
Apart, it’s ciphertext. Half a key opens nothing.Side by side, it opens. Walk away, it locks.
The two-person rule
Missile silos need two officers turning two keys. Your most private photos deserve the same rule.
Tu·p·i·ki
Two-Person Integrity Key. The things you made together, kept so that neither of you can ever open, share or leak them alone. Not after a fight, not after a breakup, not on a stolen phone.
How it works
Pair once. Open together. Apart, it’s noise.
Open it with both faces.
Each phone confirms with Face ID and sends its half. Shoot photos and video inside the safe. Everything is encrypted before it’s saved, and both phones keep the same ciphertext.
Walk away and it locks.
The phones keep a sealed heartbeat. Miss it for two seconds, or leave the app, and the key is wiped from memory. Try it:
Together
ping #0 · sealed
The math is the promise
Either of you can end it. Instantly. Forever.
The safe key is split in two with a one-time pad. Each phone keeps one half, sealed in its Secure Enclave behind Face ID. One half alone says nothing at all about the key. Destroy yours and the photos become noise for both of you, with no phone call, no permission, no undo.
···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ····
···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ····
···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ···· ····
Each half alone is indistinguishable from random noise. Try it: hold the button for two seconds.
Principles
Lowering risk: alone. Raising risk: together.
Opening takes two. Ending takes one.
Opening a safe, adding to it, making one: both phones, both people. Destroying your half or deleting a photo: you, alone, any time.
There is no server.
No account, no cloud copy, no analytics. Your phones talk directly to each other. There's nothing for us to leak, sell or hand over.
Never touches your camera roll.
Photos and videos are captured inside Tupiki and encrypted in memory before anything is written. Tupiki never asks for photo library access.
Deniable by default.
Home looks the same whether you have no safes or ten. Names appear only behind Face ID and your keys PIN. A duress PIN quietly destroys everything.
Screenshots come out blank.
Screen recording, mirroring and the app switcher are covered. If either phone leaves the app, or you drift apart, the safe locks.
Honest about the limits.
We can't stop someone pointing a second camera at the screen. No app can. Tupiki protects you from a partner acting alone, not from one you're with.
Coming soon to iPhone.
Tupiki is in final testing. Read exactly how it works before you trust it with anything.
Read the whitepaper