Run It On Your Own Computer

We The Citizens is a program you run, not a service you sign up for. The default install puts the whole product on your own computer: you open http://localhost:4444/ in a browser, and everything you record is written as ordinary files in a folder you own. No account, no database, and nothing crosses the network unless you decide to send it.

Everything the app records stays as readable files on the citizen's own machine and is appended to a local hash chain, and the only thing that ever crosses off the machine is what the citizen chooses to publish.

What it does

There are two modes, and they are the architecture rather than a feature list. Individual Mode is the default and is fully local. Everything the app knows is stored as readable files under one directory on your machine, outside any cloud-synced folder, and the person sitting at the keyboard is a built-in default user — so the app is completely usable with nobody signed in. Community Mode is optional aggregation layered on the same software: it pools many citizens' decisions and shows each person the difference between their own view and the group's.

The files are kept in formats a person can open. Structured YAML holds the settings and all four pillars: your positions, the law you drafted, your value system, your evidence chains. The reasoning layers are plain text and the logs are append-only text. Every write lands atomically and every file is validated when it is read, so a bad hand-edit is logged and falls back to a typed default instead of crashing a page. That exists for one reason: a citizen is allowed to open their own data in a text editor and change it.

Pull the machine off the internet and every pillar still works. The backend is a local process on the local filesystem; the browser reaches it over loopback.

The product is built to degrade rather than fail, and each degradation is stated out loud:

• No database means flat files — a complete, tested configuration, never a demo mode.
• No AI credentials means a deterministic offline reasoner rather than an error screen.
• No movement data on the machine means one screen naming exactly what is missing and handing you the command that fixes it — not a dozen pages each quietly reporting nothing.

Everything you cast is also appended to a local hash chain: small blocks under your own directory, each committing to the block before it, with no network, no wallet and no currency involved. Recomputing the chain reveals any block that has been altered. That is what lets you prove what you decided and when, and lets somebody who receives a file you published confirm it has not changed since you cast it.

The hosted install at app.WeTheCitizens.io runs the identical code with one storage driver pivoted underneath it. A local result and a hosted result are the same arithmetic.

The goal it serves

A tool you own outright cannot be switched off, cannot be quietly changed underneath you, and keeps no central record of what you read or concluded. That is not a privacy nicety. A movement that tells citizens they should not have to take institutions on faith cannot then require them to trust a server it controls. Local-first is that argument applied to ourselves.

The problem this site describes is that the people making decisions are not answerable to the people those decisions land on, and the evidence for it is sitting in the official record where anyone can go and look. If the software doing that looking runs only on somebody else's machine, your ability to check depends on their permission, their uptime, and their continuing interest in letting you. Running it yourself removes all three dependencies at once.

What is not collected matters as much as what is. A central system logging which laws you opened, which officials you looked up, and what you concluded would assemble exactly the kind of behavioural file this movement objects to elsewhere. Your positions and your reasoning sit on your own disk, so there is nothing to leak, subpoena or sell. That is the charter written into the file layout rather than promised on a policy page.

What keeps it honest

• The local path stays supported. It does not get dropped the day the hosted install becomes easier to maintain.
• It does not claim to protect you from your own machine. The state directory is created private to your user account, but the contents are plain files. Anyone who can log in as you can read them.
• The hash chain is not an external blockchain and never pretends to be. No consensus, no mining, no currency. It shows a record has not changed since it was written; it says nothing about whether the record was right. Publishing the latest chain hash so the timestamps are independently witnessed is opt-in and off by default.
• There is no background sync. Until you publish something, the files are inert local data.
• A shared install is treated differently on purpose. A hosted or shared machine has no default user and requires signing in, because a shared machine is not your machine.

Works with

• The Public Data Repository — the record your local install clones and reads, so the copy on your disk is as good as anyone else's.
• The Citizen Mining Network — the work that fills the record is done on citizens' own machines, which is only possible because the whole product runs on one.
• Nothing Fails Quietly — the same discipline applied to failures: a missing repository, a missing credential or a malformed file each produce a named cause instead of a blank page.

Where to go next

• Get Started — the two ways to run this, and what differs between them.
• Individual vs community mode — what joining a community actually changes.
• Open Data — the public record you clone, and how to follow a claim back to its source.
• Run your own instance — every repository the movement runs, and how to stand it up yourself.
• First run — install it and get to the first screen today.