A quiet room,
rebuilt in code.

The Cloister is a private walled garden for people who already trust one another — no company in the middle, no admin who can silence you, no algorithm deciding what you see. This page is your guide: what each room does, what is truly safe, and what it asks of you in return.

Where this came from

The first Cloister was a single quiet room, kept by a monk in the Himalayas — a place to speak freely, write things down, and trust that no one was listening who shouldn't be. This is that room, rebuilt in code. Your identity here is a pair of cryptographic keys that no company issues and no company can revoke. Your words travel over nostr, an open protocol nobody owns, instead of sitting in a corporation's database. And your private conversations are sealed before they ever leave your device, so the wires carrying them only ever see locked boxes, never letters.

Nothing about that is a metaphor for marketing's sake — it's the literal architecture. The sections below walk through what that actually means, room by room, in plain language.

Who this room is kept for

For seekers, not for crowds.

The Cloister is not built for the general public. It is built for people who already believe that love is the one true thing that binds us together — a small circle who come here to connect, learn, heal, and evolve through honest conversation and Socratic inquiry. It has no advertising, no growth targets, and no interest in being popular. Its entire design — a shared circle passphrase, a small default relay set, a plain and undecorated interface — assumes you already know and trust the people you'll meet inside it.

If you have found your way here by some other path, and the words above don't describe why you came — this is not the app for you, and that's alright. If you choose to use it anyway, what you do here, and what it costs you, is yours to answer for — not the monk who built the room, and not the open protocol it's built on. That is stated once here, plainly, and again at the close of this page.

A guided walk

Every room, in the order you'll meet it

Thirteen rooms, laid out exactly as they appear along the bottom of the app. No jargon first — just what each one is for and how to use it. A short technical note sits under each, for anyone who wants to look closer at the stonework.

I Home

The Wall

This is the front room — the shared, scrolling wall everyone in The Cloister posts to. Write a thought, tap post, and it appears for the whole circle. You can attach a photo, mark a post as art to send it to the Gallery too, or mark it as a Scriptorium piece for longer writing.

To use it: type in the box at the top, choose any tags that fit, and post. Tap any post to open its comment thread and reply.
Each post is a signed Nostr kind 1 event, tagged so it belongs to this circle. It's cached on your device (IndexedDB) so reopening the app shows something instantly, before the relays even finish reconnecting.
II Search

Search

Find a person or a post. Paste in someone's key, or their name@domain verified handle if they have one, and The Cloister will look them up.

To use it: type a name, a key, or a verified handle into the search bar and tap a result to open that person's profile.
Resolves NIP-05 identifiers by fetching /.well-known/nostr.json from the domain given — the same mechanism email verification uses, adapted for Nostr identity.
III Arts

The Gallery

Every piece tagged as art lands here on its own, shown large — photography, audio, video — instead of buried in the scroll of the Wall. It's the room for things meant to be looked at, not just read past.

To use it: when posting from the Wall, check "Tag as Art" to send a copy here too. Tap any piece for a full view, a download, or a link to share it.
Same underlying event as a Wall post, filtered into its own gallery view by an additional tag — no separate upload pipeline, no separate storage.
IV Scriptorium

The Scriptorium

Where longer writing lives — reflections, notices, teachings, write-ups — set apart from the fast scroll of the Wall so they don't get lost under it. The first line you write becomes the title.

To use it: check "Tag as Scriptorium" when posting something longer than a passing thought. It will appear here, calmly, for anyone to find later.
A monastery once had a room where monks copied and preserved texts by hand — this is that room's namesake, functionally just a filtered, slower view of the same event stream.
V Groups

Groups

A group is its own small wall inside the wider Cloister — for a class, a study circle, or a project. Anyone can start one (up to seven), give it a name and purpose, and others can join and post within it.

To use it: tap Create Group, name it and describe its purpose. To join an existing one, open it from the list and tap Join.
Built on NIP-72 (moderated communities), simplified: there's no approval queue here — anyone who joins can post directly, keeping it light for small trusted circles.
VI Events

Events

Announce a gathering — a meditation, a talk, a call — with a start time, an optional end time, and a location or link. Others can RSVP so everyone can see who's coming.

To use it: tap Announce Event, fill in what's happening and when, and publish. Tap RSVP on any event you plan to attend.
Uses NIP-52 calendar events for the announcement and a separate RSVP event kind for attendance, so a "yes" is its own signed, independently verifiable record.
VII Message

Direct Messages

A private conversation between two people, sealed before it leaves your device. Only the two of you can ever read it — not the relay carrying it, not anyone else in The Cloister.

To use it: paste the other person's key to start a conversation, then write and send as you would in any messenger. You can attach photos, video, audio, or a PDF.
NIP-44 v2: ChaCha20 encryption, HMAC-SHA256 authentication, keys derived with HKDF-SHA256. Relays store and forward only ciphertext — they cannot read a single word.
VIII Circle

The Circle Room

A shared, encrypted room for everyone who holds the circle's passphrase — not a one-to-one chat, but a group conversation for the whole gathering. Whoever enters the passphrase first founds the room; sharing that same phrase with others lets them in.

To use it: enter the passphrase you were given (or choose one, the first time, and share it directly with your circle — never post it in the open). It unlocks the room for that session; tap Lock when you're done to forget the key on that device.
One shared symmetric key (AES-GCM), derived from the passphrase, distinct from your personal identity key. It protects message content, not who is speaking — messages are still signed by each sender's own key.
IX Call

Voice & video calls

A direct, peer-to-peer call — audio, video, or file transfer — with one other person. Nothing about a live call passes through any server; it travels straight between your device and theirs.

To use it: enter the other person's key and tap Call. Once connected, you can mute your mic or camera, and drag files in to send them instantly while the call is live.
WebRTC with a NIP-44 encrypted signaling handshake carried over relays only to establish the connection — the media and file streams themselves are direct peer-to-peer, end to end.
X Keys

Your identity

This is the room that holds what makes you you here: a private key, generated on your own device, that nothing and no one else controls. There is no username and password, no company account, no "forgot password" link. Your key is your account.

To use it: protect your key with a passphrase so it's encrypted at rest on this device. Use "Move to Another Device" to hand it to a second device by QR code. Use "Export Profile Blueprint" to save a backup copy somewhere safe.
Keys are secp256k1 keypairs (the same curve family Bitcoin uses). At rest, the private key is encrypted with AES-GCM under a key derived by PBKDF2-SHA256 (310,000 iterations) from your passphrase — never stored in plain form.
XI Profile

Your profile

Your name, a short line about you, a picture, and — optionally — a Lightning address so others can send you sats. This is also where your personal mute list lives.

To use it: fill in what you'd like to show and tap Save & Publish. To quiet someone's posts from your own view, mute them from their profile.
Your profile is a signed kind 0 event, visible to any Nostr client, not only The Cloister. Muting is personal and local (NIP-51) — it filters only what you see. There is no admin here who can ban, purge, or approve anyone; the protocol has no such lever to pull.
XII Saved

Saved

A quiet shelf for anything worth finding again — a contemplative thread, a Scriptorium piece, a piece of art. Bookmark it once, and it stays here.

To use it: tap the bookmark icon on any post. Open the Saved tab any time to see everything you've kept.
Stored locally on your device only — bookmarking something never publishes anything to relays or reveals what you've saved to anyone else.
XIII Settings

Settings

The quiet controls: which relays carry your traffic, quiet hours for notifications, clearing your local cache, and the Sovereignty Backup that lets you rebuild your whole presence here on a new device.

To use it: add a relay of your own here for extra redundancy — it stays local to your device. Use Export Backup to save your key, relays, bookmarks, and Circle Room passphrase as one encrypted file before switching devices.
The backup file is encrypted under a passphrase you choose at export time. Keep the file and that passphrase in two separate places — either one alone is useless to a thief, and both are the only way back in for you.
Read this before you trust anything

What's actually protected — and what isn't

Every serious tool deserves an honest account of its own limits. Here is exactly where The Cloister's walls are strong, and where they are not.

Protected

  • The content of your Direct Messages and Circle Room conversations — sealed with encryption before they ever leave your device.
  • The content of a live call's audio, video, and any file sent during it — travels directly between two devices, never touching a server.
  • Your private key at rest on your device, once you've set a passphrase — encrypted, not stored in the open.
  • Your bookmarks and local cache — never leave your device at all.

Not protected

  • Metadata. Relays can see your IP address, when you're active, and your public key on every single event you send. Content is sealed; the fact that you spoke is not hidden. For real unlinkability, route your connection through Tor or a trusted VPN.
  • Files sent outside a live call. Only the link is encrypted — the file itself is uploaded in the clear to a public file server and is reachable by anyone who has or guesses that link. Files sent during a live call bypass this entirely, going peer-to-peer.
  • Anything posted to the Wall, Gallery, Scriptorium, Groups, or Events. These are public by design — visible to anyone with a relay connection, and, once published, effectively permanent. Muting only changes what you see; it cannot remove a post from the network.
  • Your device's QR key-handoff screen. Anyone who captures it can act as you completely. Never show it on a shared screen or in a screenshot.

There is no password reset here. Your key is the account. If you lose it without a backup, no one — not the monk who built this, not any relay, not anyone — can recover it for you. Back up your key the moment you create it.

Power and responsibility

A room with no one watching over you

The same design that keeps The Cloister private and unowned also means it has no administrator — no one with the power to delete a post, ban a person, or step between two people mid-conversation. That isn't an oversight; it's the entire point of building on an open protocol instead of a company's platform. But a room with no warden only stays gentle if the people inside it choose gentleness themselves.

01

You are the only moderator you have

Muting is real and immediate, but it only ever changes your own view. There is no one else to appeal to and no one else to blame for what you choose to read, keep reading, or walk away from.

02

Encryption is a responsibility, not just a shield

The same sealed room that protects a hard conversation between two people healing something also hides whatever anyone chooses to put in it. Use that privacy the way you'd want it used on you.

03

Nothing here can be un-said

Public posts are effectively permanent once they reach the open network. Write to the Wall, the Gallery, and the Scriptorium the way you'd write something you're willing to stand behind indefinitely.

This app is powerful precisely because it asks so little of you by way of permission, and so much of you by way of character. It was built on the belief that a small circle bound by love and honest inquiry doesn't need a warden — it needs each person showing up with the same ethics they'd bring to a room with no locks on the door, because that's exactly what this is.

Before you enter

Nothing here is perfect. Enter with open eyes.

The Cloister is built and maintained by one person, in the open, without a company or a security team behind it. It has been audited carefully and repeatedly — but no software, and certainly no single-file app built without paid infrastructure, is ever beyond flaw. Treat every safeguard described on this page as a serious, good-faith effort, not a guarantee.

Use at your own risk

You are responsible for your own key, your own backups, your own words, and your own judgment about what to share and with whom. The Cloister cannot undo a lost key, unsend a public post, or reach into a relay you don't control.

Who this is for

This app is not built for public or general use. It exists for a specific, small circle of seekers of truth — people who hold love as the thing that binds us together, and who come here to connect, learn, heal, and evolve through pure, honest, Socratic conversation.

If you've arrived some other way

The Cloister is open-source and runs on an open protocol, which means, by nature, it cannot be locked to any one group of people — anyone technically capable can find and run it. If you are using it without sharing the intention described above, you are welcome to leave. If you choose to stay and use it anyway, you alone are responsible for your own actions, words, and their consequences — not the person who built this room, and not the open protocol it stands on.

Come in quietly. Leave it better than you found it.

The door was left open on purpose, for the people it was built for. Walk in the way you'd walk into a friend's home — carefully, honestly, and with your shoes at the door.