Operation Guide

Perpetua Cryptograph runs on your Apple Watch. Your iPhone is the companion: it shows your portfolio and initiates transactions, but the watch is the authority. All signing and security settings changes happen on your wrist.

Requirements

• Apple Watch Series 6 or later (watchOS 10+)
• iPhone with iOS 17+
• Watch passcode enabled
• Wrist detection enabled

Phone & Watch Connectivity

The dot within the Perpetua logo indicates whether your phone has a live connection to your watch (and vice versa).

• A green dot means connected: transactions and settings changes will work normally.
• A red dot means disconnected: you won't be able to approve transactions until the connection is restored.

When troubleshooting, make sure both devices have Bluetooth enabled and are within range. The Apple Watch is quite clever about power saving; if you see a red dot, try raising your wrist as though you're checking the time. This is often enough to restore a live connection.

Creating a New Wallet

Creating a new wallet generates your keys on your Apple Watch and secures them with an encryption key stored in its Secure Enclave. Your wallet is assigned a serial number (like 0042 - 2026). This serial number proves your keys were generated on-device, not imported from elsewhere.

During setup, you'll be required to create a Recovery Sheet. This isn't optional; Cryptograph requires that you create and verify at least one physical backup before funding your wallet. There is no "skip" button.

Recovering or Importing a Wallet

There are three ways to restore access to an existing wallet:

Recover from Recovery Sheet: Tap Scan Recovery Sheet on your watch. A prompt will appear to scan the QR code with your iPhone, then enter the PIN or passphrase you chose when you printed the sheet. Your watch will ask you to confirm the fingerprint code printed on your Recovery Sheet to cryptographically verify that the QR code hasn't been tampered with. This restores your wallet with its original serial number and Time Lock settings.

Recover from Photo Backup: Tap Photo Backup on your watch. Select your saved ZIP file or photos on your iPhone, then enter the PIN or passphrase you chose when you created the backup. This restores your wallet with its original serial number and Time Lock settings.

Import from seed phrase: Enter your 12 or 24 words directly on your watch using the BIP-39 word picker. Rotate the Crown to select letters; matching words appear as you type. Repeat this process for each word in the seed phrase.

Imported wallets display NO SERIAL instead of a serial number, indicating their keys weren't generated on this device and their provenance can't be verified.

Why does provenance matter? With a Cryptograph-generated wallet, your keys are exported only as an encrypted Recovery Sheet or Photo Backup, unless you view your seed phrase on the watch and deliberately copy it to another medium. This means there's far less possibility of your private key existing somewhere else on the Internet, vulnerable to a leak or exploit, or loss of control of cleartext physical copies. An imported wallet doesn't have this guarantee.

Supported Chains

Cryptograph supports the following blockchains:

• Bitcoin (BTC)
• Ethereum (ETH)
• Base (Ethereum L2)
• BNB Smart Chain (BNB)
• Arbitrum (ETH)
• Optimism (ETH)
• Polygon (POL)
• Avalanche (AVAX)
• Solana (SOL)
• Tron (TRX)
• Zcash (ZEC) - including shielded transactions
• Dogecoin (DOGE)
• Litecoin (LTC)
• XRP Ledger (XRP)

Use the Digital Crown on your watch to switch between chains.

Cryptograph offers two ways to back up your wallet: a Recovery Sheet, a printed page with an encrypted QR code, and a Photo Backup, encrypted wallet data hidden inside ordinary-seeming photos. Both use the same encryption and restore the same data, but their storage mechanisms and (thus their risk profiles) are quite different. Consider each carefully, and use them to mitigate different risks to your funds.

In both cases, your phone never sees your unencrypted keys. Your watch encrypts the data with your PIN or passphrase before passing it to your phone — for printing (Recovery Sheet) or embedding into photos (Photo Backup). When recovering, your phone passes the encrypted data back to your watch, where it's decrypted.

Both methods ask you to create a 6-10 digit PIN (or alphanumeric passphrase of any length) on your watch. Your wallet is encrypted with this credential — it only applies to this specific backup, not the app, and not other backups you've created or will create in the future.

A passphrase (free-form text, minimum 8 characters) is available as an alternative to a numeric PIN. Passphrases are normalized to lowercase before encryption so that accidental capitalization differences during watchOS text entry don't prevent decryption.

Recovery Sheet

1. You create a PIN or passphrase on your watch
2. Your watch encrypts your seed and sends only the encrypted data to your phone
3. You print the encrypted QR code from your phone
4. (During setup only) You verify you have the sheet by answering a question about the printed code

Photo Backup

Photo Backup hides your encrypted recovery data inside ordinary JPEG photos using steganography — the data is invisible to anyone viewing the images.

1. You create a PIN or passphrase on your watch
2. On your phone, select 3–10 photos (natural photos from trips or events work best; screenshots and solid-color images are not compatible)
3. Your watch encrypts your seed and sends only the encrypted data to your phone, which hides it inside the photos
4. The resulting ZIP archive is saved to your Files app or shared to a cloud service of your choice

The photos can be stored anywhere you keep files: iCloud Drive, Google Drive, Dropbox, an external drive. Nothing about them indicates they contain wallet recovery data. The ZIP archive preserves the exact bytes; we recommend keeping the ZIP intact. If you extract individual photos, avoid services that recompress images (some photo library imports, social media, image editors) — recompression can break individual photos.

Encrypted recovery data is embedded into the image data in a way that produces no perceptible quality loss and is not detectable by standard steganalysis tools. Round-trip verification is performed after encoding: if a photo fails to verify, it is excluded and you are prompted to select a replacement.

What's Backed Up

Your backup includes more than a typical seed phrase:

• Your serial number
• Time Lock settings (delay and spend limit)
• Trusted Locations (for Location Lock)

When recovering, your Time Lock settings are restored automatically. You'll be asked whether to restore Trusted Locations, since they contain personal geographic data.

Cryptograph Does Not Use iCloud Backups

Your wallet keys are stored with settings that prevent them from being included in any automatic backup, iCloud, iTunes, or otherwise. This is intentional. Your keys exist only on your watch and recovery mechanisms you explicitly choose.

This means watchOS backup and restore will not transfer your wallet to a new watch. You must use your Recovery Sheet or Photo Backup.

Recovering

From a Recovery Sheet:

1. Install Cryptograph on a new Apple Watch
2. Choose "Recover" → "Scan Recovery Sheet"
3. Scan the QR code with your iPhone
4. Enter your PIN or passphrase on your watch
5. Verify the code matches your printed sheet
6. Choose whether to restore your Trusted Locations

From a Photo Backup:

1. Install Cryptograph on a new Apple Watch
2. Choose "Recover" → "Photo Backup"
3. Select your backup ZIP or photos on your iPhone
4. Enter your PIN or passphrase on your watch

Recovery Scenarios

Watch lost, stolen, or destroyed:

Your keys are gone with the watch. Use your Recovery Sheet or Photo Backup to restore your wallet on a new Apple Watch.

Phone lost, stolen, or destroyed:

Your keys are still on your watch, but pairing a new iPhone requires unpairing your watch, which erases your keys. Use your Recovery Sheet or Photo Backup to restore your wallet after pairing with the new phone.

Upgrading to a new watch:

Your keys do not transfer via watchOS backup; they're excluded by design. Use your Recovery Sheet or Photo Backup to restore your wallet on the new watch.

Upgrading to a new phone:

Pairing your watch with a new iPhone requires unpairing it first, which erases your watch. Use your Recovery Sheet or Photo Backup to restore your wallet after pairing with the new phone.

Seed Phrase

You can also view your raw 24-word seed phrase in Settings. This is less secure than an encrypted backup since anyone who finds your phrase immediately has your funds, but it's there if you need it for compatibility with other wallets. Cryptograph can also import raw seed phrases, but we recommend using a Recovery Sheet or Photo Backup.

There is no method to copy, send, or print a raw seed phrase in Cryptograph; you must hand-copy the seed phrase.

Time Lock is an anti-coercion feature. It forces a waiting period before large transactions or sensitive operations can complete.

Settings

• Delay: Off, 1 day, 3 days, or 7 days
• Spend Limit: The maximum you can spend within a rolling window equal to your delay period

The spend limit is a rolling cap, not a per-transaction filter. If your delay is 3 days and your limit is $1,000, you can spend up to $1,000 total over any rolling 72-hour window. Once you hit the limit, you'll need to wait for older transactions to age out before you can send more, or start the Time Lock countdown to unlock a larger send.

What's Protected

When Time Lock is enabled, the following actions require waiting through your delay:

• Spending beyond your rolling limit
• Approving unverified smart contract interactions
• Viewing your seed phrase
• Generating a Recovery Sheet or Photo Backup
• Changing Time Lock settings to be less restrictive

How the Timer Works

There's a single countdown for all protected actions. Start the countdown, wait, then you can use one protected action listed above. After that, your Time Lock automatically re-locks, and the procedure must repeat.

If you don't use your unlock within the Time Lock duration, your Time Lock automatically locks again. For example: if your Time Lock duration is set to 3 days, after the lock unlocks, you have 3 days to use your protected action before Time Lock re-locks and you must request a new countdown.

If you started a countdown under duress and the attacker leaves, use "Lock Now" to cancel.

Location Lock

Location Lock adds geographic context to Time Lock. It enables a tighter spend limit when you're away from trusted locations, protecting against coercion scenarios where an attacker forces you away from home.

• Away Limit: A secondary, lower spend limit that applies when you're not at any trusted location
• Trusted Locations: Places (like Home or Office) where your normal spend limit applies

When you're at a trusted location, your normal Time Lock spend limit applies. When you're away from all trusted locations, or if GPS is unavailable, the lower Away Limit kicks in.

Managing Trusted Locations

From Settings → Location Lock:

• Add: Tap "Trust This Location" to save your current GPS location with a name (Home, Office, or custom)
• Remove: Swipe to delete a location from the list

Like Time Lock, lowering your Away Limit is instant (more restrictive), but raising it requires waiting through your delay.

Calibers

Cryptograph has three caliber designs. Availability depends on your watch size; larger screens can fit more information. Change your caliber in Settings → Caliber (when multiple calibers are available).

• Cartouche: Minimal, clean. Inspired by classic dress watches.
• Databank: LCD aesthetic with detailed readouts. Retro digital.
• Cryptograph: Sub-dials showing 52-week, 24-hour, and portfolio data.

Cryptograph Caliber — Element Reference

Databank Caliber — Element Reference

Cartouche Caliber — Element Reference

Basic Controls

• Digital Crown: Rotate to switch between chains (BTC → ETH → Base → SOL → ZEC)
• Tap fiat value: Toggle Privacy Mode, which redacts all monetary values (balances, transaction amounts)
• Tap address area: Show your receive QR code
• Tap serial number: Open Settings

Advanced Controls

Each caliber provides access to sparkline charts and exposure views. How you access them depends on your caliber.

• 52W Sparkline: Price of the chain's native asset over the last year
• 30D Sparkline: Price over the last month (on calibers that support it)
• 24H Sparkline: Price over the last day
• Exposure: Your asset exposure broken down by chain or asset class. Asset classes recognize derivatives, so liquid staking tokens like stETH count as ETH exposure. Stablecoins are a separate class. Swipe to switch between Chain and Asset views; tap again to dismiss.

Accessing by caliber:

• Cryptograph: Tap the sub-dials on the dial face to open each view
• Databank: Tap the labels (52W / 30D / 24H / Exp) around the display
• Cartouche: Hidden tap targets preserve the minimal aesthetic. Tap the top edge for Exposure, right edge for 24H, bottom edge for 30D, left edge for 52W

Approving Transactions

When a transaction is pending, your watch shows the details: amount, recipient, gas fee, total. Hold the green button to approve, or tap the red button to reject. The phone can reject transactions, but only the watch can approve. This is by design.

Transaction data is decoded directly on your watch, checked against a list of verified tokens and smart contracts embedded in Cryptograph itself. This trusted list can only change with a new app release; it can't be modified remotely. Verified contracts show a green banner; unverified ones show an orange warning. When Time Lock is enabled, unverified contract calls are blocked entirely until you wait through your delay.

Wherever possible, we decode the balance change each transaction will have on your wallet and display it clearly, so you know what you're actually agreeing to before you sign.

Complications

Cryptograph provides watch face complications so you can see your portfolio at a glance on your locked watch face without opening the app.

Available complication data includes:

• Portfolio total: Your total balance across all chains
• Portfolio change: Percentage change (24h)
• Native token prices: BTC, ETH, SOL, or ZEC price

Add them like any other complication: edit your watch face and select Cryptograph.

Complications are available in circular, rectangular, corner, and inline styles to fit different watch faces.

The Cryptograph iPhone app is your companion for viewing your portfolio and initiating transactions. While the watch remains the authority (all signing happens there), the phone provides a larger screen for details.

Portfolio Overview

The home screen shows your total balance across all chains, with individual chain cards below. Each card displays the chain's balance, native token price, and a sparkline. Tap the sparkline to cycle between 24-hour, 30-day, and 52-week views. Tap a chain card to see its full details.

Chain Details

Drill into any chain to see your token holdings, balances, and transaction history. Tap a token to send or receive. Tokens are sorted by value, with spam and unpriced tokens collapsed at the bottom. Swipe left on any token to mark it as spam.

Transaction History

Your transaction history shows sends, receives, swaps, approvals, and contract interactions. Transactions are decoded to show what actually happened, not just raw blockchain data. Tap any transaction to see full details and a link to the block explorer.

Privacy Mode

Tap the portfolio total at the top of the screen to toggle Privacy Mode. All monetary values (balances, transaction amounts) are replaced with ****. Token names, transaction types, and addresses remain visible. Tap again to reveal values.

Privacy Mode on the phone is independent from the watch; each device has its own toggle.

Sending

Sending is initiated from the iPhone app. You cannot start a send from the watch, but you must approve it there.

1. Open a chain and tap a token in the iPhone app
2. Tap Send
3. Enter the recipient address (or scan a QR code)
4. Enter the amount
5. Review the transaction summary (amount, recipient, gas fee, total)
6. Tap Approve & Send
7. Approve on your watch by holding the green button

The watch shows the full transaction details before you approve: amount in fiat and crypto, recipient address, gas fee, and total. If something looks wrong, tap the red button to reject.

Receiving

There are two ways to get your receive address.

From the iPhone app:

1. Tap a chain card
2. Tap a token
3. Tap Receive

The app contacts your watch to verify the receive address against your private keys. This guards against address poisoning attacks — if malware replaced your clipboard address, verification would fail. Look for the green "Verified by Watch" badge before sharing your address.

From your Apple Watch:

Tap the address ring (or address field) to display a QR code. Some wallets can scan this directly to fill in a recipient address. Swipe left to display your address in plain text, should you need to verify it manually.

WalletConnect lets you use Cryptograph with decentralized apps (dApps): swap tokens on Uniswap, provide liquidity, use DeFi protocols, mint NFTs, and more. Cryptograph supports WalletConnect on Ethereum, Base, BNB Smart Chain, Arbitrum, Optimism, Polygon, Avalanche, and Solana.

Connecting

1. Open the dApp you want to use (in your browser or its native app)
2. Select "WalletConnect" as your wallet
3. In the Cryptograph iPhone app, tap the WalletConnect icon (in the bottom button bar) and scan the QR code

Signing

When a dApp requests a transaction:

1. Your phone shows a notification
2. Review the summary on your phone
3. Full details appear on your watch
4. Approve on your watch (or reject from either device)

Verified contracts show a green banner with the contract name. Unverified contracts show an orange warning.

Once your Time Lock countdown completes, the lock stays open until the unlock duration expires or you manually re-lock using Lock Now. Signing a transaction does not automatically re-engage Time Lock. This is intentional — multi-step DeFi flows (such as multi-signature approvals) often require signing several transactions in sequence.

Cryptograph automatically discovers NFTs owned by your wallet across Ethereum, Base, Polygon, Arbitrum, Optimism, Avalanche, and Solana. Your collection is viewable on both the iPhone and Apple Watch.

Phone Gallery

Rotate your phone to landscape to enter the gallery. NFTs are displayed full-bleed with horizontal paging — swipe left and right to browse.

• Tap to show a title and artist overlay (auto-dismisses after a few seconds)
• Tap the overlay to expand details: chain, token ID, contract address, acquisition date, and traits

Tap the grid button (top right) to switch to a grid overview of your full collection. From the grid, tap Select (top right) to enter selection mode, then use bulk actions to hide, unhide, or mark NFTs for watch sync.

Watch Gallery

The watch gallery shows your NFTs full-screen with a museum-style placard (title and artist) at the bottom. Rotate the Digital Crown to browse — NFTs crossfade smoothly as you scroll. Swipe right to exit back to the portfolio.

Up to 12 NFTs can sync to the watch. Choose which NFTs appear on your watch from the phone's grid overview.

Curation

You control what appears in your gallery:

• Hide — Remove an NFT from the gallery everywhere (phone, watch, and widget). Hidden NFTs can be unhidden from the grid overview's Hidden tab.
• Watch sync — Mark up to 12 NFTs to sync to the watch. The phone compresses thumbnails before sending, so the watch never fetches images directly.

NFTs refresh automatically in the background, with new acquisitions appearing within a few minutes.

Requirements

Cryptograph enforces strict security requirements. You cannot create or import a wallet unless both of these are enabled:

• Watch passcode
• Wrist detection

If wrist detection is disabled after setup, Cryptograph will block access until you re-enable it. You can still receive funds to your addresses, but you won't be able to send, sign, or access the app.

Threat Model

Cryptograph is designed to protect against specific threats. Understanding what it does and doesn't defend against helps you make informed decisions about your security.

Your private keys are generated on your Apple Watch and secured with an encryption key stored in its Secure Enclave, a hardware-isolated security chip. Your private keys never leave your watch, other than as encrypted data in your Recovery Sheet or Photo Backup.

Cryptograph helps protect you against:

• Compromised phone: Malware on your iPhone cannot sign transactions, because your private keys are not on the device.
• Phishing & Malicious dApps: Every transaction is decoded and displayed on your watch before signing. Contracts are checked against a hardcoded registry in in the app. You see exactly what you're approving, not what the dApp claims.
• Remote attackers: Keys exist only in your Apple Watch Keychain and Secure Enclave. There's no server to breach, no cloud backup to steal, no remote access to exploit.
• Coercion and panic signing: Time Lock forces a waiting period before large transactions. An attacker can't drain your wallet in a single encounter.
• Doxxing of your personal info: Cryptograph-generated wallets are never tied to your e-mail, phone, shipping address, or any other personally identifying information. Even your decision to purchase Cryptograph is hidden from everyone except Apple.
• Device theft: Even if both your iPhone and Apple Watch are lost or stolen, your funds remain secure, unless the the thief also coerces you to reveal both your Apple Watch passcode and your iPhone passcode.

Cryptograh cannot protect you against:

• Physical possession + sustained coercion: If an attacker has your watch and can compel you to approve transactions for a sustained period longer than your Time Lock delay, they can eventually coerce you to access funds. Time Lock buys time; it doesn't make you invincible.
• Weak backup storage: A Recovery Sheet is vulnerable to anyone with physical access to where you store it. A Photo Backup is vulnerable to cloud account compromise — though an attacker would still need to identify the photos and crack the encryption. In both cases, a strong PIN or passphrase is your last line of defense.
• watchOS platform compromise: Cryptograph trusts watchOS and the Secure Enclave. A fundamental compromise of Apple's security architecture would affect us. There has been no public Apple Watch jailbreak since 2018 / Apple Watch 3 / watchOS 3.1.3; however, this doesn't mean that no such exploit exists.

App Distribution

Cryptograph is distributed exclusively through the Apple App Store. We do not distribute IPA files, and there is no legitimate reason for anyone to offer you one.

If someone sends you an IPA, a direct download link, or asks you to install Cryptograph outside the App Store, it is not our software. Do not install it.

• App Store only: The App Store is the sole distribution channel. App Store builds are signed by Apple and verified on install.
• TestFlight betas: Pre-release builds are available only through Apple TestFlight. We never distribute beta builds by any other means.

Cryptograph periodically verifies that your app was installed from the App Store and will warn you if it detects a modified or unofficial copy.

Resetting Your Cryptograph

To completely remove your wallet from Cryptograph, open the watch app and go to Settings → Reset Wallet. This permanently deletes:

• Your private keys from the watch
• All wallet settings from both the watch and iPhone apps
• Any stored addresses and transaction history

After reset, the apps return to their initial state, ready for a fresh wallet setup or import.