================================================================================ THE ACTIVIST'S ENGINE What this protects you from, and what it does not ================================================================================ Read this before relying on this tool for anything that carries risk. The same text is in section 23 of the manual. WHAT IT DOES PROTECT YOU FROM -------------------------------------------------------------------------------- Interception in transit. There is no transit. The file makes no network requests of any kind, and a Content-Security-Policy inside it instructs the browser to refuse them regardless of what the code attempts. A provider being compelled. There is no provider. Nobody holds a copy of your campaign, so nobody can be served with a warrant or a subpoena for it. A company changing its mind. No account, no terms that can be revised, no service that can be discontinued while your data is inside it. Ordinary snooping of an exported file. Encrypted export uses AES-256-GCM through the browser's own Web Crypto. With a long passphrase it is genuinely hard to break. WHAT IT DOES NOT PROTECT YOU FROM -------------------------------------------------------------------------------- Somebody holding your unlocked device. By default your campaign sits in browser storage in readable form. Anyone with access to the machine, or to a forensic image of it, can read it. This is the most important limitation on this page and the one people most often assume away. Use the "Leave nothing on this device" switch in the Files tab if this is your threat. Your operating system. Browser history, cache, session restore, swap and hibernation files, and backup software all sit outside this file and outside its control. A modified copy. If you did not get this from offline.ltd, check it against the fingerprint in CHECKSUMS.txt before trusting it. A single HTML file is easy to alter, and this one is meant to travel by hand. Anyone you share an export with. State files are plaintext unless you encrypt them. Send the encrypted form and send the passphrase another way. Being compelled to open it. No software helps with this. There is no hidden compartment in this tool and we will not pretend otherwise: in a single HTML file a concealed second vault is readable in the source, so it announces its own existence and makes matters worse rather than better. Traffic analysis, informants, or physical surveillance. This is a planning tool. It cannot address who knows that you are organising. IF YOUR ADVERSARY IS A STATE OR AN EMPLOYER -------------------------------------------------------------------------------- Talk to people who do this for a living before relying on any tool, including this one. These organisations advise organisers at no charge: Front Line Defenders https://www.frontlinedefenders.org Access Now Digital Security Helpline https://www.accessnow.org/help/ Tactical Tech https://tacticaltech.org They will tell you more about your own situation than any manual can. ================================================================================ \ Offline.Ltd, Amsterdam ยท hello@offline.ltd ================================================================================