🜂 Embers — photo posts
Up to four photos at a time, with a caption and a look.
- Warmth. A post starts warm and cools over about a week. Reactions stoke it back up; one nobody returns to quietly banks itself.
- Six glyphs instead of a like: warm, bloom, still, wander, echo and gold.
- Echoes — comments, on posts you can see.
- Filters applied in your browser before upload, never on the server.
- Pin one to the top of your hearth, or bank it out of sight without deleting it.
▶ Flickers — short video
Thirty seconds at most, in a vertical feed.
- The ranking explains itself. Every flicker carries a plain-English reason it was chosen — because someone paying for privacy should be able to see the machinery.
- Built from warmth, freshness, who you actually interact with, and completion — and it will not show you the same author twice in three slots.
- Nobody sees who watched. Watch progress feeds the ranking as one anonymous number; not even the author gets a viewer list.
- The length is read out of the file itself, so a client cannot lie about it.
✦ Sparks — gone in a day
A photo that expires after 24 hours, and then is deleted from disk.
- Polls. Attach a question with two or more options and watch it fill in.
- Seen list — you see who looked at yours.
- A story editor with draggable text, on the phone app.
🔒 Whispers — sealed messages
End-to-end encrypted direct messages. The server holds bytes it cannot open.
- Keys are made on your device from your password and never leave it. ECDH P-256, HKDF, AES-256-GCM.
- Group whispers — each member gets their own sealed copy, so there is no shared key sitting on a server.
- Disappearing messages, seen receipts, and encrypted attachments.
- The flip side, stated plainly: lose your password and those messages are gone. Nobody can recover them.
🔥 Bonfires — group spaces
A room for a few people, joined by a code rather than a search.
- Its own feed — posts made to a bonfire stay in it and never reach your hearth.
- Its own group whisper thread, encrypted the same way.
- Owner controls: rename, re-roll the join code, remove members, or close the whole thing.
✻ Gossip — public threads
A titled thread hanging under a photo or a flicker, with nested replies.
- Never anonymous. Your name is on every thread and every reply, and there is no way to turn that off.
- The post's owner runs the room. They can lock any thread on their post, remove any reply, or close the post to gossip entirely — even threads they did not start.
- A thread is only as visible as the post it hangs on. Gossip under a kindred-only post is not public.
- One take each, and a board of what is warm right now.
◈ Two feeds, both honest
Nothing is chosen for you by engagement.
- The Hearth — people you have accepted, warmest first rather than strictly newest.
- The Drift — public posts from open accounts, ranked by warmth and nothing else. No affinity, no watch time, no personalisation.
- Signals — requests, glyphs, echoes and mentions, with real unread counts that clear when you have actually seen them.
◯ Who sees you
Three circles, and you decide per post.
- Private by default. New accounts start closed; new kindred need your approval.
- Kindred — everyone you have accepted.
- Inner ring — a list you keep, not one people can join. Only you can put someone in it.
- Blocking, both ways, and reporting.
◐ Make it yours
More like a profile you decorate than a form you fill in.
- Seven accent palettes, a night and a day theme, or two custom colours of your own.
- Banner, avatar, pronouns and a mood.
- A status that can expire by itself, with an emoji.
- Badges are earned, never bought — each one is a fact about the account, like having two-factor on.
⛨ Keeping the account safe
The boring parts, which are usually the ones that matter.
- Two-factor with an authenticator app, plus one-time recovery codes.
- Every session listed, with the ability to end any of them from here.
- Your own audit log — sign-ins, changes, failures, visible to you.
- Photos are cleaned on upload: decoded and re-saved, which strips location, device and timestamp data.
- Take it all with you, or delete the account and have everything actually removed — from the database and from disk.
◧ While it is being tested
Deliberate limits, published by the server so the app can never disagree with them.
- Four posts per account, photos and videos sharing the shelf. Deleting one frees the slot.
- Thirty seconds for a video, up to 80 MB. Photos up to 25 MB.
- Invite only. The public sign-up form is closed; a link from someone inside is the only way in.
- One link makes exactly one account, and withdrawing it removes that person and everything they made.