Riot is an offline‑first app for protests, disasters, and mutual aid — built to create, verify, and carry information when the network can't be trusted. Preload it before the crisis. Publish, sync, and merge from inside it during the crisis.
A project in the lineage of Indymedia, protest.net, and TXTMob.
Every dot is a phone. Solid lines sync directly. Dashed lines catch up later — through whoever gets a signal first.
Who it's for
Riot is a runtime, not a single app for a single crowd. Four groups shaped the design so far.
Know‑your‑rights pages, jail support contacts, legal observer check‑ins, medic locations, route changes — signed, not rumored.
Shelter locations, water and food distribution, road closures, reunification boards — working from the moment the towers go down.
A needs‑and‑offers board with a real claim‑and‑fulfillment lifecycle — one that doesn't depend on Slack staying up.
Publish under a collective name a government has banned. Subscribers' phones become the distribution network — no server to raid.
How it works
No accounts, no server round-trip, nothing accepted without you looking at it first. This is the real flow, not a diagram of an idealized one.
Install it before you need it. It works from zero signal, day one — no account, no server to reach first.
Spin up a public incident space with a name — "Berlin Mutual Aid" — or join one that already exists. A space is just a namespace; there's no admin approval gating who can publish into it.
Draft a headline and what people need to know. Flag it honestly if a model helped write it. Nothing goes anywhere until you tap "review complete — sign locally" — a model can draft, it can't sign, and it can't publish.
A signed entry is just bytes — hand it off any way a bytestring can move: file or QR today; nearby device pairing is the next transport layer, not yet shipped.
Incoming entries land in an import queue first. You see the signer and the content before anything touches your board — nothing is accepted automatically, ever.
Every device that's seen more of the story catches the rest up. Nothing gets silently lost, nothing gets silently deleted.
Every post is a signed entry in a Willow-protocol namespace — content-addressed and capability-scoped, built for exactly this kind of partial, offline-first sync.
Device-to-device sync is one small, transport-independent exchange: Hello → each side sends a Summary of what it has → each side Requests only what it's missing → Entries cross the wire → both sides send an updated Summary → Complete. Malformed, oversized, or out-of-sequence messages get a hard Reject, not a best-effort parse. The same frame bytes travel over BLE, local IP, QR, or a plain file — the sync layer doesn't know or care which.
That exchange still can't skip the same admission boundary the UI uses: inspect → preview → plan → commit. Nothing is live in your store until you've explicitly planned and committed it — sync just gets bytes to your device, it doesn't get to decide what you publish.
Your signing key never leaves your device in the clear. It's sealed behind your device's hardware-backed keystore — Keychain on iOS, Android Keystore on Android — and only unwrapped in memory for the moment it's needed.
Two modes
Two parallel systems, joined only by a deliberate, signed act — never automatic.
Anyone can post to an incident space. A pseudonymous collective can run a publication where subscribers' devices are the printing press. Curation is a lens you choose at read time — publishing itself stays frictionless.
Affinity groups, coops, and crews get an encrypted, unlinkable space — joined face to face with a QR code, or by a portable invite file. Panic wipe, per group, keys destroyed first.
Not guesswork
Every major design call is checked against how mutual aid networks, protest comms, and movement media have actually worked — Occupy Sandy, TXTMob, Verificado 19S, Indymedia's RNC desk, the 2019 Hong Kong protests, and disaster response after the 2023 Türkiye earthquakes and Hurricane Maria — not assumption.
Each research pass runs multiple independent search angles, then puts every extracted claim in front of three adversarial reviewers whose default is to try to refute it. Only what survives makes it into the design.
Lineage
Status
Riot is in active development. This page describes the direction, not a finished product — there is nothing to download yet.
Proving the core Willow protocol, signing, and preview‑first import work end to end across a real Rust core with native iOS and Android shells.
Encrypted group membership and sync, reviewed under its own threat model before anything ships.
The three tracks build in parallel once their evidence gates clear.
Riot is part of the protest.net family of tools. Updates on the evidence sprint, the research behind it, and an eventual release will post as each phase clears its gate.