You already text the people you'd take a walk with. This page explains how a Together invitation travels inside those same text messages (iMessage, SMS, whatever you two already use), sealed so the phone company can't read it, between two people who already know each other. You never have to talk your friend into installing a new app or opening a new account. There is no directory of strangers here. There's a technical page for people who build and break software.
Same two houses as before. The only thing that changed is the road. Before it was a shared private folder. Now the sealed envelope rides a text message. It's locked before it leaves, so nobody along the way can read it.
Making plans together was already designed and built so that only sentences travel. No copy of anyone's calendar goes with them. The envelope carrying those sentences was built to travel any road at all. A private folder, a USB stick, or a text message: the seal works the same on every one.
Here's the one rule everything else follows from: the phone company is not part of your circle. Neither is Apple, or Google. They're fine companies to carry a message. Your text still travels through their machines, and with plain SMS the carrier can read every word. Even the "blue bubble" messages, which are encrypted along the way, can end up readable in backups depending on settings nobody can check from the outside.
So we don't try to decide which messaging company deserves trust. We trust none of them, uniformly and on purpose. Every invitation is sealed inside its own locked envelope, with a key only your friend holds, before it ever touches the Messages app. Whatever encryption the channel adds on top is welcome. The safety of the message rests on the envelope's own lock.
The short readable line on top ("Walk Saturday?") is what we call the postcard line, and it's optional (more below). The scrambled part underneath is the sealed envelope itself. To you and Marta, once your archives unseal them, those three messages read: a proposal with two times · "how about 10 instead of 9?" · agreed. The phone company sees three scrambled strings it cannot read.
You compose the invitation in your archive (activity, a couple of times), exactly as on the making-plans page. Your archive seals it and hands it to Messages, addressed to your friend.
You press send. Yourself, on purpose. That is deliberate. Every message that leaves your house should be a thing you did. Software never sends one quietly in your name.
Her phone receives an ordinary text. She shares it to her archive with a tap. Her archive checks it really came from you, unseals it, and shows the invitation: her clock and yours.
She taps her answer: yes, no, or a different time. Her archive seals the reply, hands it to Messages, she presses send. Same road, opposite direction.
You confirm, and it lands on both calendars: same moment, two clocks, nobody doing time-zone math. Cancel and do-again work exactly as before; the road doesn't change the rules.
Texts get lost or arrive twice sometimes. Fine. A lost envelope you simply send again; a doubled one is recognized and ignored. The plan can't fork or double-book. That was built in from the start.
Before any of this works, you and your friend swap keys once. That hasn't changed, and there's still no directory and no search. The swap itself can now happen over text, with one safeguard that matters:
You each text the other your card: your name and your lock's public half. Public means public, so it's fine if the phone company reads it. Nothing secret ever travels by text.
Then you say six words to each other out loud, on a call or in person. Both your archives show the same six checking words if the swap was clean. If someone tampered with the messages in between, your six words and hers won't match, and both phones refuse to finish.
Match confirmed, you're paired. From then on your archives can seal envelopes only the other can open. A text from any number you haven't paired with is turned away quietly, unopened. Same as always.
What it is. One readable line you may choose to put beside the sealed envelope ("walk Saturday?"), so your friend sees something friendly in the thread beside the code.
The rule it follows. Write it like the back of a postcard: the mail carrier can read it. On plain SMS it's off unless you turn it on, because the carrier really does see it. And it's decoration. The sealed envelope is the only thing either archive believes.
Sealing hides the words. The friendship still shows. The carrier still learns who texts whom, when, and how often; it always has, about every text you send. A flurry of sealed messages every Saturday morning looks like something regular happening, even if nobody can read what.
That's why this road is for people who already text each other. It leaks nothing your friendship wasn't already leaking. If a circle needs even the fact of its correspondence kept private, a different road exists: the private shared folder that works today, and later a carrier of our own.
Your neighbor has none of this, and she never will. You can still invite her, the same as you always could. You compose the invitation, and it goes as a plain ordinary text. There is no envelope and no seal. Her "yes!" comes back the ordinary way, and you note the agreement yourself.
Your own record then states: this plan was made by word of mouth, on your say-so. No sealed signature backs it. It is the handwritten-binder rung of the ladder: valid, but without a cryptographic signature.
Designed and built, July 12, 2026. The connection to a phone has not been made. The making-plans system underneath it is built and tested (126 automated checks, an independent attempt to break it, real problems found and fixed). The road for carrying it over text is now built too (25 more checks), the same day. It does not yet reach into an actual Messages app. Today it's the sealing, the locking, and the six-words checking, tested against invented data, waiting for the last hop into your phone's share sheet.
One dependency remains unresolved. The lock this design relies on has not had its full live test yet. The design is correct, and the software refuses to put anything unlocked on the road. Nobody has yet locked a real message and read it back. The text road won't go live a day before that's proven.
This page will say so, dated, when it changes. Same as every page here.
See a problem, or something that worries you? On the main site: Write to us → "feedback," or Write to us → "security" for good-faith lock-testing, welcomed, credited, and protected by a safe harbor written into our Terms, §15.
Want to build it with us? Apply → "build." The design's full detail (envelope format, key ceremony, the break-it test list) lives in the project's open specifications.
Just following along? The "New in this place" board on the home page announces every change, dated.