Every message, call, and screen share is encrypted and lives only on your members' own devices. It connects peer-to-peer, so no company sits in the middle to read your community, sell it, or pull the plug. No servers to rent. Your account holds only encrypted data — and vouches for your key, so abuse has a name behind it.
Every message, call, file, and whiteboard stroke is end-to-end encrypted with keys that live inside the invite. Even the always-on keeper nodes that store history for quiet holds hold only ciphertext, provably.
Holds replicate directly between members over an encrypted, hole-punched swarm. Your identity is a keypair on your device, and names, roles, and moderation are all signed with it. Your account — a username, a verified email, a password — stores only an encrypted copy of that key and signs a short-lived vouch for it. Communities can require the vouch, so a suspended account goes quiet everywhere; the server still never sees a message. No profile to mine, no telemetry to collect.
Export any hold's history to JSON. Back up your whole account — identity, profile, every community — to one passphrase-encrypted file and restore it on a new machine. If an invite leaks, rotate it and re-key the entire hold.
Channels, categories, threads, forums with tags, reactions and animated emoji, pins, polls that close themselves, search with filters, slowmode, spoilers, link previews, and a translated UI (EN·ES·DE·FR).
Named lounges and moderator-only stages, screen and camera share, push-to-talk, per-user volume, DM calls that ring, voice and video messages — opus over the same encrypted swarm.
A channel can be locked to the members you choose: its contents are encrypted to their keys, and nobody else's client can read a word. We'll say the honest part too — everyone still replicates the hold, so outsiders keep the unreadable traffic and can see the channel exists. It hides what is said, not that it happened.
Roles and permissions, timeouts, server mutes, bans with reasons and unbans, word filters, audit logs. Every action is a signed entry enforced by every member's own device — a modified client can't cheat it.
A shared whiteboard, a wiki, a kanban board, scheduled events with RSVPs, a files library, and hold stats — replicated, offline-capable, and attributable, because they're built from the same signed log as messages.
One encrypted backup file migrates your entire account to a new device — and because there's no password-reset desk, the app nudges you to make one. Friends, notes, and bookmarks stay yours alone.
Messages written offline deliver when a peer appears — append-only logs never lose words. Optional keeper nodes serve history while everyone sleeps, without the ability to read any of it.
Each member writes to their own cryptographic log (Hypercore). Everything — messages, votes, strokes, bans — is an entry, replicated and verified by everyone. History can't be silently rewritten.
A hold's invite encodes its encryption key. Share it privately and someone's in; rotate it and even old members with stale invites are locked out of the new epoch.
Peers find each other through a distributed hash table and connect directly through home routers, so no outage page ever goes up. Prefer to hide your address? Route through a relay: it sees your address and your encrypted bytes, never a word.
The app updates itself the same way your messages travel: peer-to-peer from the maintainer's signed release, verified before it applies. Install once, stay current.
Simplest — no installer, no dependencies
Windows will show a SmartScreen prompt the first time (the build isn't code-signed
yet) — choose More info → Run anyway. If peers never connect, allow
bare.exe
in Windows Firewall.
No download page at all — install over the swarm
Works while a seeder is online. Installed apps update over the air from the same link whenever a newer version is staged.
Free, forever
~$5 / month per hold · coming soon
$25 · coming soon