Our longevity pledge — draft

1. The app keeps working without us

• Your system lives on your device. Starting a system needs no account, no sign-in and no internet connection.
• The apps for iOS, Android, macOS, Windows and Linux work fully offline, for as long as your device can run them. Nothing in them expires, and nothing needs to check in with our servers to keep working.
• Ourcana keeps its own snapshots of your system on your device: hourly for a day, daily for a week and weekly for a month.
• The web version keeps your data in your browser, but the app itself is loaded from ourcana.space each time you open it. If you rely on the browser alone, keep an export somewhere safe or install one of the apps. Part 4 explains how we keep that address alive.

2. The sync server stays open source

• Thatch, the server that syncs and backs up Ourcana, is free software under the GNU Affero General Public License, version 3 or later. Its source code and release binaries are public at code.heni.lol/Ourcana/thatch.
• You can run your own Thatch with a single Docker command or a downloaded binary, then add it to the app under Settings ▸ Backup. It works on its own, alongside our hosted sync or instead of it, and costs nothing.
• Everything you sync is encrypted on your device before it leaves, so any Thatch server, ours or yours, only ever stores ciphertext. If a server disappears, you lose a mirror, not the copy on your devices.
• The installed apps carry a copy of Thatch inside them, so your devices can also sync directly over your own network with Sync over LAN, with no server on the internet at all.
• Our hosted sync is Thatch with a small subscription service in front of it. That service only checks whether a subscription is paid, isn’t open source, and isn’t needed to run Thatch yourself.

Our promise: Thatch stays under the AGPL or a more permissive open source licence. We will never move it to a closed licence.

3. Your data leaves in an open format

• Ourcana exports to Pluralport, an open, MIT-licensed format for moving plural system data between apps.
• A Pluralport export from Ourcana holds your members, tags, journals and notes, front history, and profile, banner and card images. It also carries Ourcana’s own data in an extension, so Ourcana can restore from it without squeezing anything into the shared format.
• The snapshots Ourcana keeps on your device are Pluralport files too, and Settings can also save a full backup file. Exports are ordinary files that stay with you; you don’t need an account to make one.
• Ourcana imports Pluralport files as well as exports from PluralKit, SimplyPlural, PluralSpace, Florality, Octocon and others.

Our promise: Pluralport export stays free and available in every version of Ourcana, with no account or subscription needed.

4. If Ourcana ever ends

This proposed sunset plan requires the owner’s approval, funding and release arrangements before adoption.

• Notice. We will announce it on this site, in our Discord and in an app update at least 90 days before the hosted sync shuts down.
• Subscriptions. We will stop taking new sync subscriptions and stop renewing existing ones on the day we announce.
• Builds. We will publish a final release of every app and keep the direct downloads public. The app’s own source code isn’t public today. If the project ends, we will publish it under an open source licence, so anyone can keep building and running Ourcana.
• Sync server. Hosted sync keeps running for the whole notice period, so there is time to move to your own Thatch or export. Thatch’s source and release binaries will also be archived with Software Heritage and mirrored somewhere outside our own servers.
• Your data. The copy on your devices isn’t affected; it keeps working as before. At the end of the notice period we will delete the encrypted copies on our hosted servers, along with the server keys. We never had the keys to read them.
• Domains. Data kept by the web version belongs to the web address it came from. We will keep ourcana.space and ourcana.cards registered for at least five years after the end, serving a final copy of the web app so browser-only systems can still open and export their data. We will never sell or hand these domains to anyone else.
• Signing keys. The keys we use to sign app releases, app updates and Thatch releases will never be sold or handed to anyone else. After the final release, we will destroy them and close our publishing accounts, so nobody can ship an update in Ourcana’s name. Anyone who carries the project on can build it from the published source under their own name and keys.

Keeping ourselves honest

The facts in parts 1 to 3 describe how Ourcana works right now. Before adopting this pledge, we must verify them against a shipped release and approve each proposed commitment below.