A private, peer-to-peer working log for two people. No accounts, no server, no tracking.
Everything you write is encrypted on your own device with a key derived from your three passphrases. There is no server that stores or can read your data.
When you and the other person are both online, your two devices connect directly to each other over an encrypted peer-to-peer channel and sync what has changed. Nothing passes through a company in the middle.
Connecting directly needs each device to find the other on the network. An optional small relay helps with that. It only ever holds short, scrambled reconnection codes for about a minute — never your messages, files, or anything readable. It cannot see your data even in principle, because it never has your key. You can turn it off in Settings and reconnect by swapping codes by hand instead.
Nobody will ever ask for your passphrases. Témpo has no accounts and no support desk that could need them, and it never sends email. Any message that says it is from Témpo and asks for a passphrase, a Trust Pact word or a saved copy is a fake — whoever it appears to come from. The only place to type them is the unlock screen at the address you always use.
Keep all three passphrases. There is no “forgot passphrase” — it can’t be, without a server. Every one of the three is needed, so losing any one of them is the same as losing all of them. If that happens and you have no other device and no Trust Pact, the data on this device can’t be opened again. A saved copy does not help on its own: it opens with the same three passphrases.
A space is one relationship — you and one other person. Each space is a separate encrypted database with its own key, so nothing leaks between the different people you work with.
From All spaces you can create a new space, join one you’ve been invited to, rename, or delete. Deleting a space removes it from this device only; the other person keeps their copy.
A space is for two people and keeps to them. Once it is paired, anyone else who tries to connect is turned away, even if they have the pairing passphrase. Your own linked devices are you, so they are always welcome.
Pairing is a one-time exchange of codes. It happens directly between you — you hand each other a code by whatever means you already trust (a message app, in person).
After you’ve paired once, the relay reconnects you automatically whenever you’re both online, with no code swapping. While a space is paired there is nothing more to invite; the Connection screen shows who you are paired with.
Sever this pairing, on the Connection screen, ends it. Everything written in the space stays, and the other person keeps their own copy, but they can no longer reconnect and any Trust Pact between you is voided. Afterwards you can invite someone else, or the same person again.
You can use the same account on, say, your phone and your computer, and both stay fully usable at once.
The new device becomes a twin: same identity, its own device key. Your two devices then sync directly with each other, even when the other person is offline, and even in a space you have not paired with anyone yet: open the same space on both and they find each other through the relay. There is nothing to swap on the Connection screen.
Where a project, idea or session lives, everything inside it lives too: its albums, milestones, posts and the comments on them. Inside a withheld project nothing can be shared, only withheld or private. Change the project and what is inside follows. Anything you made more private on purpose stays that way when the project is opened up again.
There is one kind of saved copy. Save my encrypted data (in Profile → Backup, and on the unlock screen if you’re ever locked out) writes everything this device holds to one file, still encrypted. It opens only with your three Témpo passphrases and never includes the key a “stay unlocked” device holds. Anyone who gets the file can try to guess its passphrases, quietly and for as long as they like, so how safe it is comes down to how hard those three are to guess together.
It can be put back only onto a fresh device, with Restore a saved copy on the setup screen. It never replaces a space that is already there.
To carry everything to a different address or a fresh browser — for example from a test copy to the one you use — save your encrypted data on the old one, then open the new one on a fresh setup screen and choose Restore a saved copy.
A Trust Pact lets you back into a space if you ever forget your passphrases. Neither of you can do it alone: it takes a phone call, three words the two of you agreed together, and one of you with the space open. It is optional, and each space has its own.
Allow about five minutes, with both of you connected in the space and on a call.
Both of you write the three words down. Capitals and extra spaces don’t matter.
The three words are never stored and never sent. Each device only proves to the other that it knows the same word. What sits on your disk is a sealed copy of the space’s key that opens only with a long random secret the other person’s device holds, and their device releases it only after all three words match, live. Someone with your device, their device, or a copy of either disk cannot sit and guess: every attempt needs the other person on the phone, and they get five tries.
What it cannot do. It needs this device, with its data still on it. If the device is gone as well as the passphrases, a pact alone brings nothing back. And anyone who has your device, knows the three words, and can convince the other person they are you, can get in. That is the trade a pact makes, so only set one up with someone who would know your voice.
Remove takes effect at once and needs no call. Neither of you can then help the other back in, nothing else changes, and the other person is told. Severing the pairing removes the pact too. To change the words, remove the pact and set it up again.
“Those passphrases do not open this Témpo” means they didn’t decrypt your data. It is not a lockout timer or a server problem — it’s a mismatch. All three must be right, and in the same order you set them.
Asked for one passphrase, then three? A Témpo set up before there were three opens once with the single passphrase it has, even if it used to stay unlocked, and then asks you to choose three. Nothing you stored changes.
On the unlock screen you can Save my encrypted data (keep it safe for later) or Reset this device (erase this copy and start over).
http://localhost address it should just work. Over a home-network address it must be https, and a self-signed certificate can block the relay’s background call even after you accept it for the page — use localhost, or install a trusted certificate.Shared photos download and show on their own while you’re connected; a large batch arrives one file at a time over the connection. A photo you don’t hold yet shows a soft placeholder until it arrives.
When a new version changes how data is stored, what you have is brought up to date when you unlock. Nothing is cleared. Only data from the earliest development builds cannot be carried over; for that alone you see “Témpo has been upgraded” and are asked to clear this device and start fresh.