THE DEVICE

Witnuss.

A small device you carry. It holds the last half hour of sound, always, and saves it only when you press - sealed, provable, yours.

FIRST RUN · KICKSTARTER

The premium enclosure. First to ship.

GET NOTIFIED FIRST

STANDARD · DIRECT

The same device inside, in a simpler shell. Follows the campaign, ordered right here.

AFTER THE CAMPAIGN

What it does

The window: The last 10, 20 or 30 minutes of sound, always held, always letting the older go.
The press: One press, after. The save is sealed the second you press.
Scheduled memories: Set a time; it keeps the minutes leading up to it by itself - asleep or awake.
Microphone: A 24-bit MEMS microphone (TDK ICS-43434, 60 Hz to 20 kHz) feeds the processor over I2S; gain is applied at full 24-bit precision before anything narrows to 16.
Sample rate: 16 kHz by default, selectable to 24 or 32. The buffer holds a fixed number of samples, so a higher rate trades reach for fidelity: about 30, 20 or 15 minutes.
Encoding: Packed in real time into IMA ADPCM, 505 samples to each 256-byte block, saved as standard WAV files any player can open.
Where the past lives: In a dedicated 14.7 MB region of flash inside the device itself, not on the removable card. Nothing reaches the card until you choose to keep it.
A tap seals the past: A tap saves only what already happened; there is no keep-listening-after-the-press window, by design. Holding the button is how you record live.
Live recording: Begins at the instant of the press, not when the machinery finishes waking. The seconds in between are in the file.
Two kinds of proof: A saved past proves it existed before the press; a live recording proves it was sealed as it happened. The device never lets one claim to be the other.
Scheduled, deeper: A dedicated real-time clock (DS3231) keeps the wall time; long sleeps wake briefly to stay honest against drift, fill the window, save, and sleep again.
Markers: A tap of the second button pins the moment as it happens, placed inside the recording to a tenth of a second.
Proof heartbeat: Once a minute the device seals a small anchor into its record, about 190 bytes each - so even a short clip usually holds proof sealed before you pressed anything.
The chain: Every entry carries a SHA-256 seal over everything before it, keyed to the device, written through to the card before the device moves on.
The second record: Beside the machine record runs a plain-English copy with its own SHA-256 chain, and the verifier checks the two against each other.
The event record: Over sixty kinds of entry cover what the device does and what is done to it. Every change of state lands in the chain as one.
Nothing changes quietly: A setting changed, firmware replaced, the card opened on a computer - each lands as its own entry, and a deletion carries your stated reason beside the device's own finding.
Gaps, accounted: Power lost, a write that failed, a card that would not mount: each is kept and sealed at the next start, with the time it was observed stated separately from the time it was sealed.
Self-check: The device checks its record at every power-on, and a failure is written into the record itself, permanently.
Proof of Anteriority: Every press-after save carries proof it existed before you pressed. Patent pending.
Anyone can check: Hand a save to anyone: it checks out, or it shows. No account, no internet, no us.
A save's seal: The instant a save completes, its name, exact size and the SHA-256 of the whole file go into the chain, bound to the identity of the device that made it.
Hardware signing: ECDSA P-256 from a dedicated secure element - the class of chip used in payment cards and passports. Keys are generated inside it and never leave it; each signature endorses the entire history beneath it.
Witnuss ID: Each device mints an identity from its own hardware random number generator at first start and seals it into the record's first entry and into every save: WTN-XXXX-XXXX-XXXX-XXXX.
Tamper, named: A recording deleted, renamed, edited, altered in place or planted is reported as exactly that - five distinct findings, never one vague alarm.
The verifier: One HTML file of about 1.4 MB, riding the card itself. It opens in any browser and re-walks the whole chain, re-hashes every recording and re-checks every hardware signature, entirely on your computer.
Zero network, enforced: The verifier never makes a network request; its own Content-Security-Policy forbids it, and anyone can read that in its source.
Content and authorship: Anyone can prove offline what the files contain; only the device, holding a key that never leaves it, can prove who wrote the record. That split is the design, not a gap.
Signed updates: The verifier updates from the card only when a copy is signed with our key and newer than the one sealed in the firmware; anything else is replaced by the sealed copy, and the replacement itself is recorded.
Check your copy: Every shipped file's SHA-256 is published, so one line - certutil on Windows, shasum on Mac - confirms the copy you hold is the one we shipped.
Tested against forgery: The verifier is exercised against synthetic cards built byte-for-byte in the firmware's own formats, including cards with files edited, renamed, deleted or planted. Proof features do not ship without their tamper cases.
What it cannot say: Anteriority defeats after-the-fact fabrication. It does not claim to defeat a staged live scene, and we will not pretend otherwise.
Long Memory: Optional: up to 90 days of sound resting on the card, reachable any time.
Yours to move: Take the card out and any computer reads it like a plain drive. Copy, back up, hand over - your call.
Ephemeral by design: Long Memory stays a buffer: old segments are deleted as the 90-day horizon passes, and nothing becomes a record until you keep it.
The math: Ninety days is 2,160 hours. A 128 GB card clears it at 16 and 24 kHz, about 86 days at 32 kHz, with 4 GB held in reserve for saves and the device's records.
Sound per gigabyte: About 29 MB an hour at rest - roughly 4,000 hours on a 128 GB card. The 90-day dial, not the card, is the limit.
Filesystem: Plain FAT32, readable on anything. The device never formats a card: one it cannot read is reported, not erased.
File names: Numbered WAV files with plain 8.3 names - WIT00079.WAV - readable on anything made since DOS.
Room to record: Space is stated as hours of sound and saves remaining - live on your phone, and stamped onto the card at every power-on so an offline reader can say it too.
Card out: Take the card out and listening pauses - and the device says so. Put it back and it restarts itself so the card mounts cleanly.
At rest: With protection on, each save becomes an AES-256-GCM container keyed from a 256-bit master key minted on the device - it leaves only wrapped to your key via ECDH P-256 and HKDF-SHA256. A lost card holds saves only in that locked form; opening them takes your password.
Key changes: Remove protection and new recordings are plainly readable again. Nothing is ever sealed to a key that no longer exists, and each change of state is written into the record.
Deep sleep: A long hold puts it into a deep sleep in which its identity and its sealed record persist. One press of the power button wakes it.
Low battery: The warning is a clock, not a threshold: the device projects minutes remaining from the cell's own discharge slope, with a hard voltage floor underneath so a quiet decline is never missed.
Last act: If the battery reaches critical, the device saves the buffer first and sleeps after. The cutoff is set to leave that save the power it needs.
Fuel gauge: The percentage is read off the cell's chemistry curve and only moves the way the battery is really going; it holds at 99 while charging - the charger alone gets to say full.
Microphone switch: Off is off: nothing is taken in, and the light says so, in violet.
One press: The press is the whole interface. Hold patterns reach the rest.
The hold ladder: One control, holds that commit on release: 0.6 s saves the past, 1.5 s records live, 3.3 s sleeps. Holding through them all does nothing.
Mic off, honestly: Off removes the microphone's clock signal. A part that cannot run without its clock takes in nothing - the hardware's truth, not a software mute.
The light: The lamp speaks exactly one pattern - two hard 45-millisecond pops - and only the colour carries the meaning. Violet is reserved for the microphone alone.
Idle pulse: The resting beat is yours: four rhythms, your own colour, a 3, 10 or 30 second pace - while every warning keeps the fixed double pop, so one can never be mistaken for the other.
Haptics: Three weights instead of one flat buzz - a feather tick, a tap, a thump - shaped so rising means opening and falling means closing. The longest thing it ever says is 380 milliseconds.
Ships visible: The quiet modes sit behind a plain disclosure, and every move into or out of one is written into the permanent record.
Works alone: No phone needed. The iPhone app is where saves become Memories, when you want it.
No cloud: Your Witnuss needs no account, uploads nothing and sends no telemetry. It works with the internet off.
Bluetooth: Bonded phones only, over LE Secure Connections; legacy pairing is not refused, it is compiled out. Settings, schedules, notices and short stretches of sound travel over it; whole recordings move over Wi-Fi.
Pairing: Only phones you approve can connect. On iOS 18 and later, pairing runs through Apple's own accessory picker.
The protocol: The device-to-phone contract is versioned and only ever grows: fields are added, never changed, so an older app and a newer device always understand each other.
Wi-Fi handoff: One-time credentials pass to your phone over the already-encrypted Bluetooth link before the Wi-Fi network even exists, and the network admits a single client.
The session: The device hosts it and ends it itself: a 30-minute ceiling, a stop when idle, and every session noted in the record - even one ended by switching off. Bluetooth stands down while Wi-Fi serves, and the device restarts once at the end and reconnects on its own.
Sync power rules: Transfers run on the charger by default. Given your leave to sync unplugged, the device still holds a 30 percent floor, checked at the start and re-checked throughout.
Link tuning: For a transfer the link steps up to Bluetooth 5's 2M PHY with larger frames, then steps back down on its own when a connection struggles.
Transcription: Runs on your iPhone, for your eyes. The words do not leave it unless you share them.
Language packs: Extra languages arrive as Apple's own on-device packs. The audio never leaves the phone.
Second opinion: The phone does not take the device's word for anything: after a sync it re-checks each recording against the sealed record itself, and shows only what it verified.
Exports: A provable export runs only over bytes that still match the sealed SHA-256 identity. An edited copy is refused, not attested.
Location: The optional location history lives on the iPhone alone, is left out of backups, keeps 7, 30 or 90 days, and deletes separately from the audio.
Analytics: None. The app carries zero third-party packages, so there is no analytics or crash-reporting code to even switch off.
Processor: Two Xtensa LX7 cores locked at 160 MHz, 16 MB of flash, 8 MB of PSRAM.