Using the Mobile App

The Tidal mobile app is the place you keep control of your agents from your phone. It is first and foremost a control panel: you connect an agent, decide what it may spend, watch what it does, and pause or stop it whenever you want. An optional wallet for holding your own XRP and RLUSD lives inside the same app, but you can use the control panel without ever turning the wallet on.

Draft — to be finalized. The flows below are grounded in Tidal's product requirements and user stories. Where an exact screen, button label, or step order has not yet been fixed in the product, the description reflects the intended experience and is marked as draft. Treat the shape as settled and the pixels as provisional.

Setting up

When you first open the app, you set up the app itself before any agent is involved. The core of setup is your master key — the credential that owns your errand wallets and is your emergency exit. The app generates it on your device and protects it with a passphrase you choose; the key is stored only as encrypted data, never in the clear.

Because the master key is genuinely yours and no one at Tidal holds a copy, setup includes a recovery step you cannot skip: the app shows you your recovery secret once, has you record it safely offline, and then asks you to prove you saved it correctly before it will let any real money in. This is the trade that comes with true self-custody — Tidal cannot reset a lost key for you, so the app makes very sure you have your own backup before funds are ever at stake.

Draft — to be finalized. The exact recovery-backup ceremony (how the secret is displayed, how you confirm it, whether an optional hardware backup is offered in the first release) is specified at the architecture level and still being finalized in the app.

Connecting an agent

Connecting an agent is how you grant a specific AI application permission to spend a bounded budget. It usually begins outside the app: the agent's developer presents you with a connection request — typically an app link or a QR code you open or scan. That request carries only public routing information; it can never contain a secret, and it can never by itself authorize a payment.

When you open the request, the app shows you exactly what you are being asked to approve — the application's name and verified web domain, which assets it wants to use (XRP, RLUSD, or both), the spending limits it is requesting, and when the authorization would expire. Tidal checks the application's domain for you and shows the result clearly: a verified identity looks verified, an unverified one shows a prominent warning, and anything that looks like impersonation is flagged as suspicious — and when it is suspicious, the approval button is disabled. You cannot be nudged or tricked into approving a payment to a site pretending to be someone it is not.

To finish connecting, you complete a short out-of-band step to confirm the specific authorization (this deliberately does not travel inside the link), review the limits one last time, and approve. At that point the app uses your master key to set up the errand wallet on-ledger: it funds the new account, sets up the RLUSD trust line if RLUSD is in scope, and installs the two-signature rule that binds the account to this agent and Tidal's co-signer. From then on the agent can operate inside your budget without coming back to you for each payment.

Setting the spending line

The spending line is the heart of the arrangement, and you draw it. Before an agent is active you set:

• A per-payment cap — the most it may spend in any single payment.
• A daily cap — the most it may spend across a day.
• A lifetime cap — the total it may spend over the life of the authorization.
• The assets it may use, and the merchants or destinations it is allowed to pay, where the agent's use case calls for that.
• An expiry — when the whole authorization ends on its own.

The amount you actually put into the errand wallet is a separate control from these limits, and it is the outer wall: no matter what the limits say, the agent can never spend money that is not in the errand wallet. Funding and spending policy are two different dials, and topping up the balance never silently raises what the agent is allowed to do.

You can change limits later without tearing anything down. Adjusting a cap or extending an expiry updates the policy; it does not require creating a new wallet or moving funds.

Monitoring

The app's home surfaces your agents. For each connected app you can see its authorization, the budget you gave it, the limits in force, and a running history of what it has actually paid for — each payment recorded with its outcome. If a payment was denied, you can see why: over a limit, an unrecognized destination, an expired authorization, insufficient balance, and so on.

Some payments will pause for you on purpose. When the agent tries something that trips a rule you set — an unusually large amount, an unfamiliar destination — Tidal withholds its co-signature and raises a challenge. You answer the challenge in the app. Answering is a control-plane action: you are making a policy decision, not signing with a key, and the payment only proceeds if you allow it.

Pausing and stopping

You are never more than a couple of taps from stopping an agent.

Pause halts new payments while keeping the arrangement intact, so you can resume later. Revoke ends it: Tidal stops co-signing immediately, and the agent is left holding a key that can no longer meet the two-signature requirement — it simply cannot pay from that wallet anymore. Revocation takes effect right away for anything new.

Two honest notes. Revoking does not, and cannot, reverse payments that have already settled on the ledger — a completed XRP or RLUSD payment is final, the same way cash handed over is gone. And whenever you like, you can sweep the remaining balance out of the errand wallet back to your main wallet, which you sign with your master key. Even if Tidal's servers were completely unreachable, that sweep still works, because the master key is yours and the ledger will honor it directly.

About the optional wallet

The same app can hold your own XRP and RLUSD if you want it to — generate a wallet on-device, back it up, send and receive. This is entirely optional and separate from the agent control panel; you can manage agents without ever enabling it.

Draft — to be finalized. The mobile app is React Native and currently Android-primary; some monitoring figures may still come from placeholder data on certain screens during development. Screen-by-screen labels and layouts will be refined as the app is finished.