Your Settings, Your Data
Everything this app knows about you sits on your own computer as plain text files you can open in any editor. Settings is where that arrangement becomes switches you can see: what the AI may touch, what gets published, how to take a complete copy of your work, and how to shut the whole thing down. A promise about your data is worth very little. A layout on disk where the data never left your machine is worth something.
What it does
Your data is files, not rows in somebody's database. Run the app on your own computer and everything it records lands under one folder, outside the code and outside any cloud folder. Your positions, your value system, your evidence chains and your law drafts are YAML files — one record per file, human-readable, hand-editable. A bad hand-edit is logged and defaulted key by key, so a typo costs you one value and not your work.
Settings works without an account. A citizen who never signs in is a first-class user with their own folder, and their theme, language, AI preferences and publishing defaults are remembered. Only the pages that publish, identify, or take money need a signed-in identity.
The AI page states what leaves, in plain words, live. The provider default is local only: a model on your machine, and the permanent status box then reads "Nothing leaves this machine." Two switches sit under it and both default to off — send my private records, so unpublished work is never handed to a model unless you say so, and send my identity, which keeps your real name and email out of every prompt. Showing the reasoning chain is on by default; a conclusion on its own is not an acceptable output here.
Publishing defaults start at private. Nothing is shared unless you choose it. The confirmation dialog names the exact attribution and destination before anything leaves, and publishing your evidence gaps alongside your chain is on, because the missing links are part of the argument. Changing a default never alters what you already published.
The data page shows you the door. It names the folder your data lives in, breaks down what is using space, and offers a complete export: settings, profile, every pillar record and your account history, in the original YAML with a manifest. Import restores one after a dry-run diff. Backups copy to a local directory you pick, filesystem only.
Closing out is three separate choices, not one button. Deactivate hides you and is reversible. Going private is offered beside it, because most people who want out of public view do not want to destroy their reasoning. Delete requires typing your handle exactly, and at confirmation you decide what happens to work you already published: keep it under a citizen number, keep it under your handle, or retract it from this install.
Some of this is written down ahead of the code: the export and import flows, and the thirty-day deletion grace window, are specified and not yet built. Deletion today is immediate once the typed handle is confirmed.
The goal it serves
Every platform that ever collected citizens' political opinions eventually monetized them, lost them in a breach, or handed them over. That is not a character flaw in the companies. It is what happens when the opinions live in their building and you hold nothing but a terms-of-service page. A movement asking people to write down where they actually stand is asking for the most sensitive file they will ever produce, and has no business asking on those terms.
So the answer is architecture rather than a privacy pledge. The reasoning is yours because it is on your hardware: copy it, back it up, move it, or delete the folder without telling anyone. Leaving costs nothing, which is the only version of this a skeptic should agree to join, and it is a commitment in the movement's charter rather than an implementation detail. It cuts both ways: the record the movement publishes is open data anyone can audit, and the half you are still working out stays yours.
What keeps it honest
- Off means off. Private records are not sent to a model, identity is not sent, scope is private, nothing is pre-checked. A default that is "usually off" would be worthless.
- No dark patterns, as a written rule. Closing an account is as easy to find as opening one, and export is not gated behind deletion: take your data any time, for any reason, without saying why.
- It admits what it cannot undo. Anything already published or cloned out of the public record cannot be recalled by us, and the page says so instead of implying otherwise. After a deletion executes, no administrator can restore it.
- One thing survives deletion on purpose. The audit trail stays, redacted to a handle, and the handle is retired so nobody can re-use it to impersonate you. An accountability record its own subject could erase would not be one.
Works with
- Decisions, Areas And Communities — the positions you record are the files these settings govern, and the publishing scope decides whether one stays on your disk or joins a community.
- Value Systems And Policy Packets — your value system is a portable file; the export and the license default are what let you carry it out, or let another citizen import it.
- The First-Principles AI Check — the AI page is where you decide which model runs that check, what it may see, and whether it has to show its chain.
- Run It On Your Own Computer — the install these settings sit on, and the folder every file named here lives in.
- Your Profile, Your Anonymity — the identity switch in settings decides how much of you travels with anything you publish.
Where to go next
- The Movement — what you are joining, and why it is built as a tool rather than a service.
- Open Data — the public half of the same principle: clone the record, check any claim at its source.
- What the AI never decides — the hard limits on the model, beyond the switches you hold.
- Get Started — the two ways to run it: hosted, or on your own machine.
- Run it on your computer — the local-first version, where every file named here is one you own.