Our vision

Every community owns the infrastructure it depends on: its records, its identities and its conversations. Nobody outside it can switch that off, read it, or price it out of reach.

We get there one drop at a time. A single self-hosted node becomes a community running its own services, and communities that choose to connect become a network with no company, server or person at its centre.

The measure of success is simple: a community on this network can lose its internet provider, its cloud vendor or its power for a day, and still have its memory, its members and its voice.

The problem

Mutual-aid records, member rolls, scheduling, messaging, transparency logs — the connective tissue of local communities lives on platforms that can deplatform, subpoena, price out, or simply shut down. When that happens the community loses not just a tool but its memory.

ODTAW is the infrastructure to take it back: each community hosts its own data on its own hardware, private information never leaves, and only the records meant to be shared replicate across the network — with no company, server, or person the whole thing depends on.

What needs to be built

Community services

Identity protection

A community-run identity layer that gives members one login for everything on the network — and makes them hard to track for using it.

• One community login. Members authenticate to their own community, not to Google, Apple, or a platform. The same identity works across the marketplace, chat, the AI assistant, and the VPN.
• Pseudonymous by default. Each service sees a per-service handle, not a name. No service — and no one observing the network — can correlate a member across the stack.
• Prove eligibility without revealing identity. Selective-disclosure credentials let a member show “verified member” or “FoodShare-eligible” without exposing who they are.
• Private internet access. The community VPN routes members' traffic out through the community gateway — no ISP logging, no advertiser fingerprinting, no per-site identity leak.
• No brokers, no trackers. No third-party sign-in, no analytics SDKs, no data-broker exposure anywhere in the stack.
• Recovery without custody. Multi-party account recovery, so no single administrator can impersonate a member or lock them out.
• Data minimization. Each service stores only what it needs; the authoritative record and audit trail stay in the member's home community.

Running today

Proof of concept

What it has to prove

1. 1Center-less sync. Community A adds a catalog item offline; Community B edits a different field offline; on reconnect both converge to the same state — no coordinator, no lost writes.
2. 2Private data stays home. Community A's directory and audit log are unreachable from B or C — enforced at the network layer, not by policy alone.
3. 3Cross-community identity without disclosure. A user authenticated at Community A performs a shared action Community B recognizes, without B being able to enumerate A's members.
4. 4Resilience. Kill a node mid-write and the survivors keep serving; partition the mesh for ten minutes and it converges cleanly on heal; pull the power and the data restores from WAL backup.
5. 5Private communication. A message from a user on Community A to one on Community B: the content never appears in transit — only an authenticated fetch link does — and it works across the mesh.

Collaborate