The Deaf Server

Most “private” tools still betray you through metadata—not what you said, but who talked to whom, when, and from where. That pattern is the map a union-buster or a prosecutor actually wants. The deaf server is the design that takes that map away.

Deaf by construction

The RORBT relay is a dumb pipe with a good memory and zero loyalty. It does not know your name, your face, or your location beyond a salted hash. It has no analytics, no telemetry, no “sharing with third parties to improve your experience.” It knows just enough to move an encrypted envelope from one hash to another—and nothing about what’s inside.

You are not a user. You’re a routing address. The boss isn’t on the guest list because the guest list doesn’t exist in any readable form.

The design target

In the fully realized protocol—federated, self-hosted relays passing end-to-end-encrypted envelopes between salted hashes—the server’s view collapses to almost nothing:

• Can see: that hash #8f3a2b has an envelope for hash #1c90d1, and the size of it.
• Can’t see: real names, phone numbers, message contents, group membership, your social graph, or your location.

That’s the relay we’re building toward—and the one you can run yourself.

Where this stands today

Be skeptical of any tool—this one included—that narrates its destination as if it had already arrived. The hosted MVP is more modest, and we’d rather say so than oversell it:

• Contents are encrypted at rest, under a key unique to each Orbit. They are not end-to-end encrypted yet: the server holds the master key, so it can decrypt in order to deliver. It does not index your words, build a plaintext archive, or sell anything—but on the hosted relay that’s a promise (“won’t”), not yet a property (“can’t”).
• Routing metadata is cleartext. Which account is in which Orbit, who sent to whom—the server stores that in the clear to deliver and filter. The salted-hash, membership-blind picture above is the target, not the current state.
• Keyword search runs in your browser, never on the server.

So today this is “trusted but restrained,” not “deaf.” The road from here to the real thing runs through self-hosting and federation—when you run the relay, the trust stops being someone else’s to grant. Until then, treat the hosted service as encrypted-at-rest convenience and read the Threat Model for exactly what that does and doesn’t buy you.

Why this matters for organizing

Every prior wave of digital organizing was mapped and disrupted through the platform that hosted it. When you organize on infrastructure you don’t control, you’re renting a room with a backdoor for your boss, your landlord, and the local police. A deaf server has no backdoor to rent, because it has nothing to hand over.

Builders: verify it

Don’t trust the poster—trust the property. The privacy claims here are meant to be checkable, not believed. See the Threat Model for the adversaries we design against, and Self-Host the Relay to run a deaf server yourself.