MultiPerson — Container isolation for iPhone

// isolation primitives

Every Person is a sealed container.

Not a profile. Not a toggle. A genuine partition of the device's identity surface — swapped on disk at switch, re-filtered on the home screen.

◧

Per-Person Apple ID

Library/Accounts is swapped per Person, so each container signs in to its own iCloud / App-Store account. One Apple ID per Person, never shared.

/var/mobile/Library/Accounts

⊟

Isolated app data

Third-party home directories are redirected per Person. Apps see only their own container's data — no leakage across identities.

containers/<id>/apps/<bid>

⊠

Keychain namespace

SecItem reads & writes are transparently prefixed mpN., giving each Person its own keychain partition inside the device store.

SecItemCopyMatching · hooked

⌗

Isolated App Store & Safari

Safari and App Store sandboxes + global data are physically swapped at switch — separate history, logins, downloads and tabs per Person.

com.apple.itunesstored

⟳

Account lifecycle

Sign a Person in, sign out, or wipe its account to blank — orchestrated on-device, with the swapped store made live by a daemon bounce.

/signin · /wipe · /signout

⌬

Fleet HTTP API

Drive everything by name over :8899 — register, switch, sign-in, wipe, manage apps. Built for Umbrella-scale automation.

0.0.0.0:8899 · LAN

// the surface

Control it from the device, the web, or a script.

A native switch overlay, a browser control panel served by the daemon, and a license screen — every Person addressable by name.

multipersond · GET /containers

Personal

ACTIVE

Work

switch

New

switch

Primary

switch

Web control panelServed at / by the on-device daemon — switch, register and manage Persons from any browser on the LAN.

License · GET /license

ACTIVE

MP-WV2PF-SC41F-VHZYR-DCDHF

6-month license

117

days remaining

expires

2026-10-25

License activationKey entry by GUI or API. On expiry the device collapses to Primary-only until renewed — server-signed, device-bound leases.

// data flow

How a switch happens.

CALLER

App · Web · curl

Any client names a Person over the LAN.

→

DAEMON (root)

multipersond :8899

Kills Safari/Store, swaps the per-Person sandbox + global data, commits the active pointer.

→

TWEAK

SpringBoard inject

Reloads context on a Darwin notify and re-filters the home-screen icons.

// addressable by name

No auth ceremony.
Just verbs.

Persons are addressed by case-insensitive name in every call. Identity for fleet automation is one GET away — internal numeric ids never leave the device.

operator@umbrella — bash

# who's active right now?
$ curl -s http://$DEV:8899/identity
{ "name": "Personal", "primary": false }

# switch a Person by name (data swapped on disk)
$ curl -X POST http://$DEV:8899/switch?name=Work
{ "ok": true, "name": "Work" }

# sign that Person into the App Store
$ curl -X POST http://$DEV:8899/signin \
    -d '{"name":"Work","email":"…","password":"…"}'
{ "ok": true, "exit": 0, "result": "signed_in" }

// licensing

Per-device. Counts from activation.

One key, one device. The clock starts the day it's installed. Expire → only Primary works, until you renew.

1 month

$2.99USD

per device · 30 days

~$0.10/daystandard rate

3 months

$6.99USD

per device · 90 days

~$0.078/daysave 22%

POPULAR

6 months

$11.99USD

per device · 180 days

~$0.067/daysave 33%

12 months

$19.99USD

per device · 365 days

~$0.055/daysave 45%

Every plan includes the same full feature set — only the term differs

Dedicated Apple ID & App StoreEvery Person Space signs in to its own Apple ID — a separate App Store & iCloud account to download, update and purchase apps independently. Dedicated Safari browserEach Space keeps its own Safari history, cookies, tabs and logins. Browsing in one Person never touches another. Full container isolationEvery Person gets its own sandboxed third-party app data and a private keychain namespace. Per-Person account lifecycleApple ID sign-in and secure account wipe for each Space, orchestrated server-side. Server-signed licensingDevice-bound, KMS-signed leases with a 14-day offline grace window. Control everywhereManage every Space from the native app, the browser panel, or the fleet :8899 API.

One iPhone.
Many isolated
lives.

Every Person is a sealed container.

Per-Person Apple ID

Isolated app data

Keychain namespace

Isolated App Store & Safari

Account lifecycle

Fleet HTTP API

Control it from the device, the web, or a script.

How a switch happens.

No auth ceremony.
Just verbs.

Per-device. Counts from activation.

Turn one device
into many.

Every Person is a sealed container.

Per-Person Apple ID

Isolated app data

Keychain namespace

Isolated App Store & Safari

Account lifecycle

Fleet HTTP API

Control it from the device, the web, or a script.

How a switch happens.

No auth ceremony.Just verbs.

Per-device. Counts from activation.

Turn one deviceinto many.

No auth ceremony.
Just verbs.

Turn one device
into many.