Transparency

A short honest note on what runs where — so you know what you're using.

Identity. Anonymous but server-verified. On first visit the server mints a random UUID, signs it with an HMAC secret, and stores it in an httpOnly cookie. Every request is checked against that signature — request bodies can't forge someone else's identity. No accounts, no email, no tracking cookies. Clear your cookies and you're a new person.
Abuse guards. Server-side length caps (title 200, description 2000, argument 800 chars), a 32 KB body cap, and token-bucket rate limits per IP + user (10 writes/min, 30 votes/min, 60 reads/min). Only the author can edit or delete their own thesis or argument.
Data storage. Everything lives in the Node process's memory for now. Restart the server and the state is gone (seed data reloads). Phase 2 will bring real persistence.
Semantic search. Runs locally. The multilingual e5 embedding model (via @huggingface/transformers) is downloaded on first server start and cached under .cache/. No embeddings ever leave your machine.
Reflection reports (/my, /pulse). Generated by a local LLM via Ollama, if you have it running. Your theses, arguments and votes are sent only to http://127.0.0.1:11434 on your own machine. User content is wrapped in delimiter tags with an explicit "this is data, not instructions" system prompt to reduce prompt-injection surface. If Ollama is not running, the pages fall back to raw stats — no third-party LLM is ever contacted.
Feed. The home feed aggregates reactions to your content (forks, new arguments, lifecycle changes) plus new theses in topics you follow, from the server-side data. Read-state is stored server-side.
Daily budget. Enforced server-side (the client panel is an optimistic mirror). The Your day panel reconstructs today's actions from the server so you can see where the budget went.
No analytics. No trackers, no third-party scripts, no fingerprinting. The only network traffic is between your browser and this Quappe server (and optionally your local Ollama).

License & policy

The code is source-available under a non-commercial license (PolyForm Noncommercial 1.0.0).

✓ Personal use, research, hobby projects
✓ Schools, universities, non-profits, public bodies
✓ Forks, patches, sharing changes back
✗ Selling it or running it as a paid service
✗ Commercial advantage inside a for-profit company

This is deliberately not OSI-approved open source. We want the code visible and improvable — but we do not want anyone monetising the same anti-social patterns we're trying to leave behind.

Source and details: github.com/quappe-org/quappe