Riot is a home for public conversation, community decisions, shared tools, and collective memory—carried by the people who make it matter.
Jump to: For communities For partners For builders
More than a social feed
A Riot community holds shared state and the small apps its organizers approve: checklists, alerts, decisions, events, and whatever the group needs next. Use them for a festival rota, neighborhood publication, community meal, or cooperative decision; familiarity matters before conditions become difficult.
In the lineage of Indymedia, protest.net, and TXTMob. Read the lineage →
| Conventional platform | Riot's direction |
|---|---|
| The service holds the canonical community database | Participants carry community state |
| Offline means waiting for the service to return | Already-held data and installed tools remain locally useful on a functioning device |
| A server outage cuts off the product | A compatible nearby peer can exchange updates when the local path is available |
| Extensions belong to the platform | Communities approve and carry their own tools |
| A domain and hosted account anchor identity | Willow data carries community continuity |
For communities
A tenants union carrying alerts, meeting changes, rides, and checklists. Disaster responders carrying shelter maps and supply requests into disconnected areas. A mutual-aid network coordinating needs, offers, schedules, and knowledge. An independent publication keeping and re-sharing its material when a website is blocked or a gateway disappears.
These are examples of what Riot is designed to enable — not claims that Riot has completed field validation for each kind of organization.
Riot turns every participating device into part of the community's library, newsroom, toolbox, and distribution network.
See it running
Live screens from the Riot desktop build. Each one is a separate app a community carries — events, decisions, a newswire, a photo wall, shared checklists — all running on-device, exchanged device to device.
Real screens from the Riot desktop build. The app is in active development — get the current build.
For partners, funders, and journalists
A Riot community's Willow data carries its own continuity — it is not derived from a domain name or a hosted account. Participant devices provide shared custody of the community's information. Public gateways are replaceable views over exported public data, not the authority. Communities choose their tools and their editorial practices, and public Newswires can combine open publishing with transparent editorial actions instead of invisible ranking.
Publishing without one canonical publishing server — readers' devices can carry material they have received, so blocking one website need not erase every participant-held copy.
Ordinary community infrastructure — boards, schedules, checklists — that can remain locally useful from already-held data on a functioning device during outages, shutdowns, or censorship.
Organizers approve the tools their community carries. There is no central app store deciding for every community at once.
The same substrate serves mutual aid, tenant organizing, clinics, cooperatives, disaster response, protests, and independent media.
This section makes no claim of production readiness, completed security audits, an availability guarantee, completed remote-device sync, or confidentiality for the public Newswire. See what works today.
For builders
Riot publishes your update into the community's Willow space. Willow is designed so the update is not permanently tied to one transport. Riot's current prototype carries updates locally; internet seed synchronization is the next path under development.
Offline and online do not need separate community databases. They can be different ways of carrying the same shared state.
Willow itself does not define Riot profiles, communities, Newswires, moderation, mini-apps, gateways, or native sandbox behavior — that is Riot's layer.
Every post is a signed entry in a Willow-protocol namespace — content-addressed and capability-scoped, built for exactly this kind of partial, offline-first sync.
Device-to-device sync is one small, transport-independent exchange: Hello → each side sends a Summary of what it has → each side Requests only what it's missing → Entries cross the wire → both sides send an updated Summary → Complete. Malformed, oversized, or out-of-sequence messages get a hard Reject, not a best-effort parse. The same frame bytes travel over local IP, QR, or a plain file — the sync layer doesn't know or care which.
That exchange still can't skip the same admission boundary the UI uses: inspect → preview → plan → commit. Nothing is live in your store until you've explicitly planned and committed it — sync just gets bytes to your device, it doesn't get to decide what you publish.
Your signing key never leaves your device in the clear. It's sealed behind your device's hardware-backed keystore — Keychain on iOS, Android Keystore on Android — and only unwrapped in memory for the moment it's needed.
One update, different paths
Willow does not tie an update to one network path. In the current prototype, nearby Riot devices can exchange updates over a local network, and exported public content can be rendered on the web. Remote Riot-device synchronization through an internet seed is the next transport path being built.
Devices on the same local network find each other and exchange updates directly — with preview before anything is accepted.
A server-mediated path carrying Willow updates between remote Riot devices. Being built — not an integrated product capability today.
Separate public window: exported public content is rendered by a web gateway for ordinary browsers. The gateway is a replaceable view for web readers — it is not a live Willow sync server for Riot devices.
How it works
Five beats hold the whole mental model — what Riot actually verifies, and what a browser mirror could lie about. Read the web for reach; open the app when provenance matters. The screen-by-screen workflow follows below.
Your identity is a cryptographic key, not a service login. Volunteer seeds, anchors, and mirrors can run on servers, but none owns your identity or is the single place Riot must publish.
Signed posts move between phones and volunteer seeds. Peer-to-peer does not mean anonymous: devices and infrastructure may observe connections.
Websites are replaceable views, not the authority. A mirror can display altered text or false attribution, but it cannot produce an independently synced signed record Riot accepts as the claimed author.
Riot checks the signature and authorization of the independently synced record. That establishes who signed an unchanged admitted record—not whether its claims are true, current, complete, safe, or endorsed.
Use the web to reach readers. When provenance matters, read the independently synced record in Riot instead of trusting what a mirror displayed.
What actually happens, screen by screen
Install it before you need it. With data already held on a functioning device, local tools can remain useful when no internet path is available.
Create a public community with a name — "Berlin Mutual Aid" — or join one that already exists with a link or QR code. A community is a namespace; there's no admin approval gating who can publish into it.
Draft a headline and what people need to know. Flag it honestly if a model helped write it. Nothing goes anywhere until you tap "review complete — sign locally" — a model can draft, it can't sign, and it can't publish.
A signed entry is just bytes — hand it off any way a bytestring can move: a file or QR code, or the prototype's tested local-network exchange between nearby devices. Physical two-iPhone Bluetooth remains unverified.
Incoming entries land in an import queue first. You see the signer and the content before anything touches your board — nothing is accepted automatically, ever.
When a compatible exchange path is available, devices can merge records they have received. Riot cannot recover records that no reachable participant holds.
Privacy
Riot is privacy-respecting, not secret by default. Public community updates are meant to circulate. Privacy comes from reducing centralized collection, keeping community data on participants' devices, supporting separate community identities, limiting what tools can access, and letting people exchange information without always exposing their activity to internet infrastructure.
Riot cannot promise anonymity, conceal public posts, or erase every copy after information has spread. Encrypted private groups are planned separately and are not shipped today.
You control your participation and your local data — not every copy of public information once it has been shared.
| Willow can express or support | Current Riot public communities |
|---|---|
| End-to-end encryptable data | Plaintext by design |
| Meadowcap scoped read/write capabilities | Write authority is checked; no confidential public read boundary |
| Confidential interest-overlap sync | Not the current public sync path |
| Logical destructive editing | No recall or secure erasure of copies already received |
Open publishing for alerts, mutual aid, reporting, and community publications — meant to circulate, plaintext, with transparent editorial actions as a lens rather than a gate.
Private, encrypted spaces for affinity groups, coops, and crews are a separate planned system with its own threat model. They are not part of today's prototype.
Not guesswork
Every major design call is checked against two bodies of evidence: how mutual aid, protest comms, and movement media have actually worked under pressure — Occupy Sandy, TXTMob, Verificado 19S, Indymedia's RNC desk, the 2019 Hong Kong protests, and disaster response after the 2023 Türkiye earthquakes and Hurricane Maria — and what makes prosocial local spaces healthy when the pressure is off — the Front Porch Forum study, the 2025 "Local Connection Crisis" survey, and the 14 Civic Signals framework.
What people actually reach for when the network is down or the state is watching. Consumer chat apps are the incumbent even for trained responders; trust is established in person, not by software; and many parallel, functionally distinct channels beat one general-purpose feed. Riot's intake → verify → dispatch pipeline, its channel matrix, and its moderation-as-lens model all come from this evidence.
Sources: Occupy Sandy archive; Verificado 19S; Insecurity Insight / CDAC Network Türkiye study; ARRL Hurricane Maria archive; Urman et al., PLOS ONE 2021 (Hong Kong). Full citations in the research docs ↗.
What makes a local digital space healthy when the network is up. Three independent studies — Front Porch Forum (235,000 members, 13,473 surveyed), the 2025 "Local Connection Crisis" survey (2,028 people), and New_ Public's Roundabout — converge on the same structural answer: bounded content, named human stewards, and non-extractive incentives. The finding that matters most here: forums that were more active were rated less favorably. The platform people value is the one they don't live inside.
Sources: New_ Public / Center for Media Engagement, "Front Porch Forum" (2024); "The Local Connection Crisis" (Nov 2025); "Introducing Roundabout"; the 14 Civic Signals framework. Synthesis in docs/research ↗.
The prosocial-spaces literature warns against engagement addiction — its Nourish and Take a Breath signals are about not driving compulsive use. Riot satisfies both by transport design, not by policy: a peer-to-peer, sync-bounded model has no server pushing a feed and no algorithm optimizing for time-on-device. Riot carries community tools, not a feed to scroll. That is its distinctive contribution relative to platforms that fight engagement extraction with moderation labor alone.
This is a design argument grounded in the cited research, not a security or anonymity claim. Riot does not promise protection from surveillance, and pseudonymity is not anonymity.
Lineage
Built by @rabble
@rabble is building Riot using the Willow libraries — a new system from a long practice of helping communities publish and keep control of their own infrastructure. Read the full lineage and why it exists →
In 2017, Germany's interior ministry banned Linksunten Indymedia and police raided spaces associated with its alleged operators. In June 2026, interior ministers from all 16 German states asked the federal government to examine a complete ban of de.indymedia.org, alongside seizures, hosting takedowns, and network blocks. Riot is being built in the shadow of that history.
The full builder history — protest.net, Indymedia, TXTMob, Odeo, Twitter, Planetary, Nos, and Divine — and why Riot exists are on the About page, with primary sources.
Status
Riot is a prototype being built right now, in public — every increment lands on the releases page as it ships. Every claim above carries its own label; this is the summary, not a correction.
Learn and use Riot
Two guides carry the whole story: Why Riot is the complete argument — product, politics, privacy, and Willow — and Using Riot is the practical manual for the current app. Both are written to be readable offline.
One story at three depths — for communities, for partners, for builders — with every claim labeled current or planned.
The manualTask-by-task instructions for the current prototype: create, join, post, exchange nearby, share, recover.
Why it existsKeep publishing through the blackout — in the lineage of Indymedia, protest.net, and TXTMob.
Protocol comparisonWhere Riot fits next to AT Protocol, ActivityPub, Nostr, Matrix, Briar, and others.
MIT + AGPLThe repo, the license, how it's organized, and how to build and verify it yourself.
Get involvedFile issues, follow the build, contribute. Honest about what exists today.
No overclaimingWhat this site runs (nothing behind your back) and what the app is and is not yet.
Get the appmacOS and Android builds from GitHub Releases, and TestFlight for iOS when it opens.
Follow the work directly: source repository ↗ · build status ↗
Riot is part of the protest.net family of tools. Updates on the evidence sprint, the research behind it, and an eventual release will post as each phase clears its gate.