Your phone decides. Your zone decides when.

GeoSafe adds a Vault under the wallet you already have. Nothing in it moves without a tap on your phone, and where your phone is decides how fast.

Setting up

1. Connect your wallet. Through WalletConnect, in the GeoSafe app on your iPhone. Your wallet stays yours; nothing about it changes.
2. Create your Vault. A smart-contract account you own. Move in what you want protected. The rest of your wallet works as before.
3. Pick your Safe Zone. A place you choose, usually where you are when you move money. Inside it, your Approve goes through now. You can add more, and switch any off.
4. Set your away wait. How long a withdrawal waits when you approve it anywhere else: 1, 3, 7 or 14 days. 7 is the default.

Taking money out

1. A withdrawal is requested, from the GeoSafe app or from your linked wallet.
2. Your phone is notified.
3. You tap Approve with Face ID or your PIN, or you tap Deny. There is no third option.
4. In a Safe Zone: it goes through now.
5. Anywhere else, or location unknown: it waits for your away wait. You can still deny it at any time.
6. After the wait: it still needs your Approve. Time alone never signs.
7. Funds arrive in your linked wallet. Nowhere else.

If the worst happens

• Your seed phrase leaks. Someone has your wallet, not your Vault. They can ask the Vault for a withdrawal; your phone says Deny. Don't withdraw to that wallet: re-link the Vault to a fresh one from your phone. Like every protection change, that isn't instant.
• You lose your phone. Lose your phone? Your linked wallet plus your recovery places, places you chose at set-up and reproduce on a map, restore the Vault on a new phone. There is no seed phrase for the Vault to write down. How recovery works is on the Security page.
• Someone has your unlocked phone. Every approval needs Face ID or your GeoSafe PIN. Away from your Safe Zones, every withdrawal still waits, and you can deny it from your next phone.
• GeoSafe disappears. The Vault keeps working. The rules live in the contract. GeoSafe holds one emergency key. It can stop a withdrawal or a recovery to protect you, but it cannot move funds, start a withdrawal, shorten a wait or change where a recovery goes. A recovery you start completes without GeoSafe, and if GeoSafe disappears the Vault keeps working.

Under the hood

• Two signatures. A Vault needs your wallet and your phone to sign. Your phone holds its own key in the device's secure hardware, behind Face ID or your PIN. One registered phone per Vault.
• The check runs on your phone, and your phone signs it. When you tap Approve, your phone checks its own position and signs either an immediate execution or a delayed one. A faked location without your phone and your face or PIN is nothing. GeoSafe's servers see only the result, inside or outside a zone, never a stream of your movements, and your zones are never stored by GeoSafe in readable form.
• The contract enforces the wait. Once a withdrawal is delayed, the Vault contract on the blockchain holds it for the full away wait, and it only ever pays out to the wallet you linked. GeoSafe holds one emergency key. It can stop a withdrawal or a recovery to protect you, but it cannot move funds, start a withdrawal, shorten a wait or change where a recovery goes. A recovery you start completes without GeoSafe, and if GeoSafe disappears the Vault keeps working. We never hold your funds.
• Ethereum and EVM chains first. The Vault is a smart-contract account on Ethereum, connected to the wallet you already have through WalletConnect. The Vault contract has had internal security review; an independent audit is planned. The auditor's report, the verified contract address and the documented way to withdraw without the GeoSafe app will be published on the Security page.

GeoSafe is an invite-only iOS app. Leave your email and we send your invite as places open. Request my invite

Glossary

Read next: 2FA for self-custody, explained · What it survives · Support