Early access · open source · iPhone
A Bitcoin wallet, from first setup to shared savings
Create a wallet on your phone, pay people, and choose when a payment needs more than one approval.
Get early access on TestFlight
Wallet reads use Bitcoin peers and compact block filters. Keys are stored in this device’s Keychain; secret exports are explicit. No address-query service supplies the wallet’s balance.
Create a wallet and finish its backup
Create keys on the phone, write down the recovery phrase, and resume an unfinished backup after reopening the app.
Know before using it: A recovery phrase alone does not reconstruct this wallet’s historical scan. Keep the history-carrying backup too.
How this journey is checked
- Create the wallet before network sync finishes.
- Complete the backup; reopen and reveal it only through the protected flow.
App scenarios: test01OnboardingCreateWallet, test09BackupResumeAndReveal . Inspect test runs and their results.
Receive and recognize a payment
Show a fresh address and QR code. While Receive is open, peer-relayed payments appear as unconfirmed; confirmed payments enter the wallet’s history.
How this journey is checked
- Mine a payment and find it through compact filters.
- Receive a normal transaction before mining it, then observe its confirmation in the app.
App scenarios: test02ReceiveAndFunding, test14IncomingPaymentBeforeConfirmation . Inspect test runs and their results.
Review, send, and follow confirmation
Enter a destination and amount, review the fee and change, then authorize the payment. Follow it from relay to confirmation.
How this journey is checked
- Fill the actual send form and review the transaction.
- Check that the node received the payment and the app later shows it confirmed.
App scenarios: test03Send . Inspect test runs and their results.
Pay a person
Add a person’s public card and pay them using a fresh address derived from their account key.
How this journey is checked
- Import a card and choose the person from the app.
- Review and send the payment; verify the destination and next-address behavior.
App scenarios: test10PeopleAddAndPay . Inspect test runs and their results.
Hold savings together
Choose co-owners and an approval threshold. Share the savings policy and ask the other owners to approve a proposed payment.
Know before using it: Co-owners must preserve their own keys and the shared policy. The approval threshold determines who must participate.
How this journey is checked
- Create shared savings from people’s signer keys.
- Fund it, prepare a spend, and export an approval request.
App scenarios: test12SharedSavingsCreateAndAsk . Inspect test runs and their results.
Export and restore a wallet
Export a history-carrying bundle and verify it when importing. Secret-bearing exports require an explicit protected action.
Know before using it: Recovery is forward verification from the bundle’s saved history, not a historical rescan from twelve words.
How this journey is checked
- Export watch-only and secret-bearing bundles through their distinct controls.
- Import a funded bundle and check its verification report and wallet state.
App scenarios: test06ImportBundleVerification, test08ExportBundle . Inspect test runs and their results.
Keep everyday controls simple
Use Wallet, Send, People, and Settings without protocol controls crowding the normal flow. Turn on Advanced mode when those controls are useful.
How this journey is checked
- Check the beginner navigation and hidden advanced controls.
- Turn Advanced mode on and verify the controls become available.
App scenarios: test11BeginnerShellHidesAdvancedControls . Inspect test runs and their results.
What the evidence means
Each journey above links to tests that drive the actual app against a disposable signet node. Images show test wallets. A screenshot or a test’s presence in the source is not a passing result: inspect the linked run for its revision, failures, and result bundle.
Cryptographic vectors, hostile-peer checks, storage failures, and Bitcoin Core comparisons support these journeys. They establish properties that a successful screen flow alone cannot show. Explore the testing suites and their artifacts, or read the testing and feature policy.
Simulator results do not establish hardware security, battery life, or independent security review. Those release requirements and future features live on the separate roadmap.