Guardians

• You choose three guardians from the people you have done a tempel with, or two if you have done a tempel with exactly two people. Nobody is chosen for you.
• If your phone is lost, two of your guardians do a tempel with your new phone, and your account moves there at the earliest 48 hours later. Two guardians are enough.
• If your backup is on, each guardian holds one piece of your backup’s key. One piece opens nothing; two pieces open it on your new phone.
• Recovery only works through guardians. Without two guardians who have accepted, an account whose phones are all lost cannot be recovered.

The steps for recovering an account on a new phone are in Backup and recovery.

1. In the menu, open Settings, then Guardians in the Account recovery section.
2. Press Choose guardians. The list holds the people you have done a tempel with, those you meet most often at the top.
3. Choose three people, or two if you have done a tempel with exactly two people, then press Make guardians.
4. They see your request when they open Patepang, and need to accept first. Under Your guardians, each guardian is marked Waiting for an answer, Accepted, or Declined.

Recovery needs at least two guardians who have accepted. Choose people you truly trust and can meet in person, because they have to do a tempel with your new phone. An account that is not born yet cannot choose guardians.

A request to be a guardian appears in the Notifications tab, in Settings, and in Guardians, under You guard. Open it, then press Accept or Decline.

• If their phone is lost, you do a tempel with their new phone. Two guardians are enough.
• If you decline, they are not told your reason.
• Answering needs the internet. Once you accept, your answer cannot be changed from the app; the person you guard can replace you with another guardian.

If someone you guard loses their phone, you meet, and they bring their new phone:

1. In Guardians, under You guard, tap their name. The Help recover sheet shows a recovery code for them.
2. They scan that code from Recover account on their new phone.
3. You shake both phones together, as in an ordinary tempel.
4. Done: your statement is sent to their new phone through the server. The piece of their backup key is locked for the phone that just shook with yours.

Show that code only when the person is in front of you with their new phone. Someone who claims to be your friend over a call or a message may be trying to take their account.

• One guardian alone cannot recover your account and cannot open your backup.
• A recovery always waits at least 48 hours. During that time your old phone can cancel it, and the people who have done a tempel with you are told that your account is being recovered.
• While Dead lock is on, your guardians cannot recover your account at all.
• Two of your guardians who collude can open your backup without a recovery. A guardian’s app only uses its piece during a recovery tempel, but that is a rule of the app, not a cryptographic limit: with a modified app, two guardians can open your backup secretly, without the waiting period and without notifying you.

1. In Guardians, tap the guardian you want to replace.
2. Choose their replacement from the people you have done a tempel with.
3. Press Make guardians. The new guardian needs to accept first.

A guardian is replaced, not simply removed: you choose the replacement at the same time. A guardian who declined is marked Choose a replacement. If your backup is on, it is made again for the new guardians, and the server discards the old guardian’s piece. Guardians cannot be replaced while the emergency lock or the dead lock is on. If a recovery of your account is waiting, replacing a guardian makes that recovery fail.

• The server records who guards whom and their answers.
• Your account’s key chain is public, so that other people’s phones can check your keys before trusting them. Anyone who knows your account id can read the account ids of your guardians, without their names.
• While a recovery is in progress, the server stores the new phone’s public key, the signed statements of two guardians, and the time. Recovery data is deleted 8 days after the recovery is complete.

Dead lock, in Settings under Account recovery, turns off recovery through guardians, and a recovery that is waiting is cancelled. From then on there is no way to take over your account without a device that is still linked: if all your devices are lost, your account is lost too. Turning it off again takes at least 7 days: press Ask to turn off, then Turn off dead lock once its waiting period is over.