# Forestorers.org

A private, local-first foreskin restoration journal that lives in your browser.

Track Coverage Index (CI) progress, log tugging and retaining sessions, keep progress photos, and, only if you choose, connect with restoration buddies over an end-to-end encrypted peer-to-peer network. Works fully offline, no account, no analytics, no trackers, free.

**Live app:** https://forestorers.org

## Privacy architecture

- **All data stays on your device.** Journal entries, photos, and settings are stored in your browser (IndexedDB + localStorage). There is no server-side database of user content.
- **Optional at-rest encryption.** A password-derived AES-256-GCM key encrypts your data on-device. There is no recovery: we can't read your data, so we can't reset your password.
- **Buddy network is end-to-end encrypted.** Contacts are identified by P-256 ECDH public keys. Each pair derives a unique AES-256-GCM key; nothing is ever transmitted in plaintext.
- **The relay sees only ciphertext.** A small WebSocket signal server (`server/signal.js`) brokers WebRTC handshakes and queues encrypted messages for offline delivery. It cannot decrypt anything. Direct P2P via WebRTC data channels is used whenever possible.
- **No third-party scripts.** Fonts are self-hosted. The only third-party contact the app ever makes is the relay host (plus STUN/TURN during WebRTC negotiation, which is standard WebRTC plumbing).
- **Verify it yourself.** The app ships unminified. Open DevTools, read the code, watch the network tab.

## Running it

The client is a static site with no build step and no dependencies. Serve the folder with any static file server:

```
python3 -m http.server 8080
```

or just open `index.html` from disk. The app is a PWA: after the first visit it works fully offline and can be installed to your home screen.

### Relay server

The optional relay in `server/` is a plain Node.js WebSocket server:

```
cd server && npm install ws && node signal.js
```

The client's relay URL is set in `js/p2p.js`. Running your own relay is supported and encouraged for self-hosters.

## Repository layout

```
index.html        app shell (all HTML)
css/style.css     styles
fonts/            self-hosted DM Sans + DM Mono
js/               application code (plain JS, no framework)
  storage.js      IndexedDB + localStorage helpers
  identity.js     ECDH keypair + crypto helpers
  encryption.js   at-rest encryption (password to AES-256-GCM)
  p2p.js          WebRTC P2P + relay client
  journal.js      journal CRUD + entry UI
  ...             one file per feature area
server/signal.js  WebSocket signal relay (Node.js)
sw.js             service worker (offline support)
```

## Contributing

Issues and patches are welcome. Ground rules:

- Privacy is the product. No analytics, no third-party scripts, no CDNs, no affiliate anything, ever.
- Local-first: every feature must work offline and degrade gracefully without the relay.
- Data safety: never break existing users' stored journals, keys, or buddy relationships. Migrations must be idempotent and tested with at-rest encryption enabled.

## Release notes

See [CHANGELOG.md](CHANGELOG.md).

## License

[GNU AGPL-3.0](LICENSE). You may use, study, modify, and redistribute this software. If you run a modified version as a network service, you must offer its source to your users under the same license.
