OnceOver · seen once.

ONCEOVER · DEBUT EP · 6 TRACKS · PLAYS ONCE

seen once.

OnceOver is a messaging app where everything opens once. this page too.

IPHONE · PRIVATE BETA · UNDER 90 SEC

OnceOver

OnceOver · debut EP · 2026 · 6 tracks

the fine print, in plain words.

Photos you take in OnceOver's Camera tab are sent as view-once photos. The camera inside a chat sends them view-once by default, and you can switch that off. Photos from your camera roll can never be view-once.
The sender picks how long you get: no limit, or 1 to 10 seconds. The five seconds on this page were Dani's pick.
Before it opens, the front camera checks that you're looking and that no other phone is pointed at the screen.
While it's open there's no save, no share and no long-press. Closing it is the only way out.
Leave the app while it's open and it's gone. Leave before it opens and nothing happens.
After you've seen it, your copy is deleted and the chat says OPENED. The sender sees ONCE OPENED, and they can't open it again either.
An unopened photo waits on your phone until you open it. One nobody picks up is deleted from our relay after 30 days.

Chats, the photo viewer and the view-once viewer are shielded. Screenshots and screen recordings of them get a "can't be captured" card instead. AirPlay mirroring gets the card too.
Some screens aren't shielded, like the Messages list (with its previews) and the Camera tab. A screenshot there is captured, and the app tells you so.
In DMs, nobody else is told about a screenshot. You get a private note in your own alerts. In group chats, the whole group sees CAPTURE · and the name.
The shield relies on parts of iOS that aren't officially documented. If a future iOS breaks it, the app stops claiming a shield.
It can't stop a second camera. That's what the next track is for. Voice notes aren't shielded.
The screenshot on this page was simulated: the buttons, the flash and the thumbnail. The card in it is the app's real one. This website can't stop a real screenshot of itself.

While a view-once photo is open, the front camera looks for phones pointed at the screen. The moment it spots one, the photo closes for good: CAMERA SPOTTED, and it's gone.
Before it opens, a phone in view keeps it shut.
The detector runs on your iPhone. Only view-once photos are watched. Your normal chats have no camera on them.
It's a deterrent, not a guarantee. It can miss phones, and it has fired on dark, phone-shaped things.
The phone you dragged on this page is a demo of the idea.

Every view-once photo checks that you're looking at the screen. Look away for half a second and it blurs. Four seconds and it's gone. Look back in time and it clears. No face in view counts as looking away.
Senders can switch on extra security. Then you also have to hold the phone up, raise an open hand next to your face and keep a finger on the screen. The finger check is the sender's extra security: the standard checks are looking, and no cameras.
If your phone can't run the checks (the camera's off, or the phone is too hot), the photo won't open.
The guard is in beta. The raised-hand check has only been tested on a small scale so far.
On this page the plush (or, on a computer, your mouse) stands in for your eyes. In the app, the front camera does the checking.

Every message is end-to-end encrypted: text, photos, view-once photos, voice notes, stickers, reactions, even names and send times.
Your keys are made in your iPhone's Secure Enclave and never leave it. Every message is signed, and the signature is checked before it's opened.
Messages go through our relay sealed. We can't open them, and they're deleted once delivered. Group photos are cleared from the relay after 7 days.
What our relay can see: who sent to whom, when, what kind of message, how big it is, and when someone's typing. We also know the Apple or Google account you signed in with. We can't see what you said, or the names you use.
Notifications carry no content. Each one says "New activity" until your phone fills in the rest.
One phone per account. A new phone means new keys, and your chat history doesn't move with you.
Your chats are stored on your phone, not on our servers. They are included in your iPhone backups.
The encryption you tried on this page ran in your browser, with the same building blocks (P-256, HKDF-SHA256, AES-GCM, ECDSA). Nothing was sent.

OnceOver is in a private beta on iPhone (iOS 17.6 or later). The beta is free.
No Android, no web app, no Mac.
Joining the waitlist stores your email, when you joined and where you came from (like "ig-story"). To stop spam, a scrambled version of your IP address is kept too. Once it's an hour old, the next sign-up deletes it. That's it.

Does the sender know if I screenshot?: Not in DMs. In group chats, yes: the group sees it.
Does the sender know if I looked away?: No. They see when it was opened.
Is it on Android?: No. iPhone only.
Do I need a phone number?: No. You sign in with Apple or Google.
Is it on the App Store?: Not yet. It's a private beta. Join the waitlist.

performed by the plush from the app icon
turntable and stills made in Blender
music: someguy, from Twenty One (Original Game Soundtrack). Play ♠ Twenty One by Worst. experience on Roblox.
type: Bricolage Grotesque and Martian Mono (SIL Open Font License)
no rewinds were harmed