Nobody can read what you post here — not us, not anyone holding this server. What we cannot perfectly hide is who you are connected to, and what your own browser is able to lose.
This page is about RebellionSocial, and it is still being built. RebellionChat is a different product with different rules — nothing here describes it, and it publishes its own page.
The drawbacks come first, each with its reason. None of it is meant to alarm you — each one comes from not keeping your life on somebody else's computer.
Everything you post is sealed inside your browser before it leaves, and we never write down a list of your friends — take this server apart and there is no such list in it. But posts still travel like letters through a post office: nobody along the way can open them, and nobody has your address book, yet someone watching that post office closely for a long time could notice that the same fifty boxes get a delivery every time you post. Hiding even that would mean holding your posts back for hours before sending them, and we would rather send them.
Precisely: this site reaches you through Cloudflare, which unlocks the connection at its own edge before passing it on to our machine. So Cloudflare, and anyone who controls our server, can see the pattern of requests — never the contents of a message, which is encrypted with a key that never leaves the browsers involved. We do not log which mailbox any address collected from; Cloudflare's own records are outside our control. The alternative is exposing this server's home address directly to the internet, which is worse for everybody involved.
When you post to a group, only the people in it get it, and nobody outside it can tell a post was left out for them. Your groups live only on your devices, and the people in them aren't told. What this server can notice is that some mailboxes received a group delivery — not whose they are, not which group, and not what it said.
Each of your lists travels between your own devices sealed, as a separate parcel. So this server can count your lists, and notice when one changes, how big it has grown, and when it is set to end. It cannot open them, and does not know what they are called, what kind they are, or what they hold.
Precisely: each list is stored under a random number your device picked, never its name, and is sealed with a key made from your twelve words. The server sees how many of these an identity keeps, when each was last saved, its size (up to 256 KB), the date it ends if you gave it one, and — sealed the same way — how many pictures you added to your items and how big each is — it needs that date to delete the copy even while your devices are off. Whether a list is films, books or something of your own is inside the seal.
To find what you typed, this server has to read it. It answers from its own copy of each catalogue, keeps no record of the search, and does not know who is asking. Opening an item's page is the same: this server sees which item, not who. A link on that page — IMDb, the official site — takes you to that site, which then sees you as any site you visit does. A film's trailer plays from YouTube, and only when you tap it — YouTube then sees you, and that you came from this site.
Precisely: a search goes to this server without your identity (no session is read), its words are filtered out of every log, and nothing about it is stored. The server fetches a picture from the catalogue's own site once and keeps it, so that site sees our server — never you. An item's page (the story, the cast, the seasons, the faces of the people in it) is read the same way — a face, like a poster, is fetched by this server from the catalogue's own site once and kept, so that site sees our server, never you — and your device keeps a copy of what it read so the page opens offline — /forget erases it with everything else. A link on that page opens on its own and tells the site nothing about where you came from. A trailer's picture is fetched by this server from YouTube's picture host once and kept, so before you tap, YouTube sees nothing. Tapping Play loads YouTube's privacy-enhanced player (youtube-nocookie.com) inside the page: from then on YouTube sees your connection and this site's name — not which page; it refuses to play with less — and, once the video plays, its player may keep data of its own on your device. No other site can be loaded inside our pages.
It is genuinely gone everywhere it had not arrived yet, and we ask the devices that do have it to drop it — and they do. If someone is away, that instruction waits here for them for up to three months. But a copy already open on someone's screen is theirs, and nobody has ever built software that can un-screenshot something.
A post waits a week in someone's mailbox before this server forgets it. The instruction to remove a post waits far longer, and the reason is that the two fail differently: a post nobody collected can be sent again from your device, and a deletion nobody collected cannot be sent again by anyone. The cost of that is worth saying plainly — these are the only items here that sit for months, so somebody who took this machine apart could tell that a withdrawal happened, and roughly when. Not what it was, not which post, and not whose: the mailbox it sits in is named by a number only you and that one friend can work out.
Nothing is lost while they are away — it waits for them. Neither of you has to be online at the same time: a friend coming back leaves a note asking for what they missed, that note waits here until you next open the app, and your answer waits there until they next open theirs. But there is no moment when you can be sure everyone has seen something.
We do not keep a copy — that is the whole point — so clearing your browsing data, or your phone reclaiming space when it runs low, can take them with it. On your Dashboard, under Your pictures, there is an Export button, which writes every picture this browser is holding into one file you keep. The first time a picture is ever saved here, we say all of this out loud rather than letting you find it out afterwards.
Browsers give a site a limited, revocable amount of storage. We ask for the durable kind the first time you save a picture, but a browser is allowed to refuse — and a browser that has never seen this site usually does. Adding the app to your home screen is what changes that answer, and Settings shows you which one you have under Keep my data in this browser. "Clear browsing data" wipes it either way. The exported file is an ordinary zip of ordinary images: once it is on your disk, nothing here is protecting it, and its file names deliberately say when each picture arrived and never who it came from. This is the honest trade for not keeping your photographs on someone else's computer.
That is what lets you scroll back to anything, and it is also the drawback: a phone that is lost, stolen or taken gives up your friends' words and faces for the whole time you have known them, not the last few weeks. Two people get a say in that, and both only ever shorten it. Settings has one question about what THIS device keeps — you can tell it to forget what it receives after a month, or any period you choose. And next to POST there is a second, about your own posts: you can say how long any copy of one may live, on everyone's device including yours. Whoever asked for less wins. Your own posts otherwise stay, so friends who were away can still catch up.
This used to be decided for everybody: your device deleted a friend's post thirty days after it arrived. That made a lost device give up less, and it also meant your own history quietly disappeared, and a friend returning after a long time could not always be brought up to date. Keeping everything is now the default, and you can change it in Settings. That answer never leaves the device it was given on — not sent anywhere, not carried to your other devices, and nothing your friends receive can tell them which way you answered. An expiry you put on your own post is the opposite and has to be: it travels inside the post, because it is an instruction the other person's app cannot follow without reading it, and each copy is counted from when it reached that person rather than from a clock on your device. It is not a guarantee, and we will not call it one. A normal app deletes on time and takes your copy back with it; somebody running a modified one need not, and nobody can un-see what they already read. That is the same honest limit as deleting a post, and for the same reason.
Wiping your identity here takes seconds and reaches nothing else — your friends keep whatever they already collected, and nothing tells them you have gone. If you want to disappear from them too, disconnect from everyone first; that does reach them.
The wipe is instant and entirely local: it clears this browser's storage and reloads, with no network round-trip at all. That is deliberate — for someone acting under pressure, waiting for messages to send is exactly the delay that must not exist. So the two acts are kept separate rather than one pretending to do the other's job. Note also that afterwards you are a new person here, not the same person with an empty profile: the twelve words were the identity, and without them there is no way back to the old one.
You get everything, from everyone you connected to, in the order it was written. That is the promise and it is also the limit — if fifty friends post today, you have fifty posts to scroll.
Law III keeps Chat to words and lets Social carry pictures, because a profile with no face is a form rather than a person. Pictures are shrunk in your browser and sealed like everything else — the server holds them and cannot open them.
It is encrypted in your browser, and the server only ever holds the locked version. This is not a promise about our behaviour — we did not keep the key.
Nobody opens your Lists page but you. A list reaches your connections only when you share it yourself, to everyone or to a group — nothing about your taste is published for you.
Searches and pictures come from this server's own copy of each catalogue. The sites they come from see only our server keeping its copy current — the same for everyone.
Nobody can find you, suggest you, or add you. An invitation you accepted is the only way anyone gets in, and you can close that door again at any time.
There is no algorithm here to have an opinion about you, so there is nothing to game, nothing to trap you, and nothing quietly deciding which of your friends you hear from.
No ads, no tracking, no investors waiting for a return. There is nothing to sell, because what reaches us is unreadable, and nobody to sell it to.
Disconnect from one person or from everyone, and it takes effect on both sides — they stop seeing you and you stop seeing them. Nobody is notified; it simply stops.
Your own posts stay on your device — every one of them, not a recent few — and that copy is what answers a friend coming back after months away. Neither of you has to be online at the same moment for it to reach them.
Donations if you feel generous, and the running costs are published. There is no tier you are being nudged towards, because there are no tiers.
rebellionchat.com — free forever. The five laws are at /manifesto.