Xorsand OÜ · Tallinn, Estonia · one-person studio
Nothing to hand over.
Four tools built on one idea: your data should stay with you. A VPN that gets through blocks, an AI layer that runs on your own machine, reporting from the people who were actually there, and messages that never sit on someone else’s server.
Introducing
Re Suite
Three tools that share a surname and a stance: get through, tell the truth, say it to one another. Relane carries the traffic, Retold carries the evidence, Recon carries the conversation. Each is useful on its own, and each is built so the next one plugs straight in — a VPN that a reporting app can lean on, a messenger that doesn’t need the reporting app to trust it.
OS One
The next computing interface.
For forty years the way to get something done on a computer has been: pick the app, learn the app, do the work yourself. OS One replaces that. You say what you want; an intelligent layer sitting above your files, apps and accounts does it. Apps become plumbing — still there, no longer where you spend your day.
- Local firstRuns a model on your own machine. It finds or installs the engine, recommends a model your hardware can handle, verifies it and tests it. Cloud is optional and per-task.
- Generates tooImages and photo work run on-device as well, so the things you make never have to leave the computer they were made on.
- You approveReading and analysing happen freely. Sending, deleting, buying and posting stop and ask, every time.
- Not for developersNo API keys, no agent frameworks, no terminal. Built for lawyers, consultants, founders, researchers and students.
Relane
No blocks. No logs. No limits.
A VPN for networks that are actively trying to stop you — national filtering, campus blocks, hotel Wi-Fi, throttled mobile data. Censorship resistance is not a feature bolted on the side; it is the reason the app exists. Live on Android and Windows now, with a free plan that stays free.
- Gets throughWireGuard, VLESS and more, chosen automatically. Traffic is shaped to survive deep packet inspection, not merely to be fast on a friendly network.
- Zero logsNo activity records, no browsing history, nothing to sell and nothing to surrender. Anonymous sign-up: no name, no phone number, no email.
- €3 a monthUnlimited data, three devices, full speed. Or stay on the free plan: 10 GB every month, every server, every protocol.
- ExtrasA private browser built into the app, and internet-freedom news so you know where blocks are landing before you hit one.
Retold
Documented by the people who were there.
Not a news aggregator and not a commentary feed. Retold is citizen journalism on a world map: short video reports filed from where they happened, transcribed and translated automatically, and weighed on evidence rather than stamped true. Over years, every report stays pinned to its place — a living historical record of what people actually witnessed.
- Map firstBrowse by place, not by algorithm. Open a city and see what people filed there; switch to a feed when you would rather scroll.
- Any languageUploads are transcribed, subtitled and translated. A report filed in Persian is watchable with English subtitles minutes later.
- Evidence, not verdictsCorroboration weighting, capture time and place, media metadata, duplicate and manipulation detection, verified organisations.
- Safe to fileLocation precision is the reporter’s choice, anonymity is first class, and uploads are built for watched or throttled networks.
Recon
Messages travel between people, not through an archive.
Most private messengers still route every word you write through a company’s infrastructure and ask you to trust the encryption. Recon takes the server out of the path wherever it can: your device talks to theirs directly, and a middle only exists when the network leaves no choice — and even then it cannot read anything.
- Direct firstPeer-to-peer with STUN/TURN for networks behind NAT. An encrypted relay is the fallback, never the default and never permanent storage.
- Thin serverIdentity, @username lookup, connection setup and short-lived signalling. Your conversations are not stored, because they are never seen.
- Keys on deviceEnd-to-end encryption with keys that stay with you. Keeping local history is a choice you make, not a default you discover.
- Honest about metadataWho talks to whom and when is the hard problem, and nobody has fully solved it. Recon states plainly what it protects and what it does not.
Downloads
Get it, or get told when it lands.
Relane is live on Android and Windows today — free plan, anonymous account, nothing to install a licence for. The other three are in the workshop; leave an address and you will hear the day a build lands.
How everything here is built
Four rules, no exceptions.
Local by default
Work happens on your machine. Anything that leaves it is your call, made explicitly, every time.
Nothing to leak
Data that was never collected can’t be subpoenaed, sold or breached. That’s the whole security model.
Works where the net doesn’t
Blocked, throttled, filtered, offline. Multiple transports and fallbacks are designed in, not bolted on.
Plain, not clever
If it needs a manual, it isn’t finished. The hard engineering should be invisible to the person using it.
The team
One person, four products, in public.
Xorsand OÜ is an Estonian company with a headcount of one. That is a real constraint and it shapes everything here: no committee decides what ships, nothing is built to satisfy an investor, and there is no growth team looking for data to monetise. It also means honest timelines — Relane took the long road because it had to work in the places that matter.

“I’d rather ship four tools that can’t betray you than one that asks you to trust me.”
Sepehr Jabbari Khorsand (Sep) — founder & engineer. Writes the code, answers the support mail, picks the servers, argues the architecture on Discord. Based in Tallinn.
Come talk
Four ways in.
Feature requests, bug reports, architecture arguments, partnership questions — they all reach the same person.
Next step
Start with the one you need.
Relane works today. The rest are coming, and the fastest way to shape them is to say what you want from them.
Live · Android and Windows
Relane
No blocks. No logs. No limits.
Relane is a VPN built for the networks that fight back. It picks a protocol that survives inspection, connects in one tap, keeps no record of what you did, and asks for nothing about who you are. Free forever at 10 GB a month; €3 lifts every limit.
Shipping now · Android
Relane
No blocks. No logs. No limits.
A VPN designed for networks that are actively trying to stop you — national filtering, campus blocks, hotel Wi-Fi, throttled mobile data. Censorship resistance isn’t a feature bolted on the side here; it’s why the app exists. One tap, and you’re through.
- Gets throughModern protocols including WireGuard and VLESS, so when one path is blocked another still works. Traffic is shaped to survive deep packet inspection, not just to be fast on a friendly network.
- Zero logsNo activity records, no browsing history, nothing to sell and nothing to surrender. Sign up anonymously — no name, no phone number, no identity attached to your traffic.
- Private browserA browser built into the app, with its traffic encrypted through the tunnel. Useful when you don’t want the rest of the device routed, or when the default browser is the leak.
- One tapOpen, connect, done. No config files to import, no server lists to decipher, no protocol menus to guess at — the app picks what works where you are.
- Free foreverA free tier that stays free, with slower speeds. €3 a month lifts the cap: unlimited data, three devices, full speed.
- Stays informedInternet-freedom news in the app, so you know when and where things are being blocked — often before you hit the block yourself.
- Status
- Open beta, live on Google Play · iOS and desktop next
- Protocols
- WireGuard, VLESS and others, selected automatically
- Free plan
- Free forever, 10 GB a month, reduced speed
- Paid plan
- €3 / month — unlimited data, 3 devices, full speed
- Logging
- None. Anonymous accounts, no personal details required
- Extras
- Built-in encrypted browser · internet-freedom news feed
- Good for
- Censored networks · public Wi-Fi · travel · throttled connections
- Support
- [email protected] · FAQ at relane.xorsand.eu/faq
Interface preview — tap the button
Under the hood
What actually happens when you press the button.
A VPN is easy when the network is friendly. Everything interesting in Relane is about what happens when it is not — when a filter is looking at the shape of your packets and deciding whether to let them past.
Probe
The app tests which paths are alive from where you are standing right now. A route that works in Berlin may be dead in Tehran, and one that worked this morning may be dead this afternoon, so this is checked at connect time rather than assumed.
Choose
It selects between protocols — WireGuard when the network allows it because it is fast and modern, VLESS and others when the network is inspecting traffic and WireGuard would be recognised and dropped.
Blend
Traffic is shaped so that a filter looking at packet size, timing and handshake patterns sees something ordinary. Deep packet inspection is the adversary here, not bandwidth.
Hold
If the route degrades, the app moves rather than dying. Networks change under you — switching from Wi-Fi to mobile data mid-session should not mean reconnecting by hand.
- Protocols
- WireGuard and VLESS today, selected automatically; the list grows as blocking techniques change
- Fallbacks
- Multiple transports per server, re-selected live when a route stops working
- Account
- Anonymous — a key, not an identity. No email, no phone number, no name
- Logging
- No connection logs, no activity logs, no DNS logs
- Devices
- One device on free, three on the paid plan — mix Android and Windows freely
- Platform
- Android and Windows live; macOS, iOS and Linux in development
Everything in the app
Small app, few settings, several deliberate decisions.
Relane ships with a handful of things that matter and nothing that does not.
- One tapOpen, connect, done. No config files to import, no server lists to decode, no protocol menu to guess at. The app makes the choice because the app is in a better position to make it than you are.
- Private browserA browser built into the app whose traffic runs through the tunnel, for when you do not want the whole device routed — or when the default browser is itself the leak.
- Anonymous accountSign-up creates a key. There is no password reset by email because there is no email. That is the trade-off of not knowing who you are, stated openly rather than buried.
- Freedom newsA feed of internet-freedom reporting inside the app, so you learn that a service is being blocked in your country before you run into the block yourself.
- ReconnectNetwork changes — Wi-Fi to mobile, cell to cell, a train through a tunnel — are handled without you noticing or reconnecting by hand.
- Free tier that means it10 GB every month, renewed, at reduced speed, with access to every server and protocol. Not a trial that expires into a paywall.
Four people, one problem
Different situations, same wall.
Relane is built for people who hit a network that has decided for them what they may read.
Inside a filtered country
The service you need is simply gone.
- Blocked social platforms and messaging apps
- Filtering that changes week to week
- Protocols that work today and stop working tomorrow
- No desire to explain a configuration file to anyone
On someone else’s network
Campus, office, hotel, airport.
- Ports blocked and categories banned
- Shared Wi-Fi you would not trust with a password
- Traffic visible to whoever runs the router
- You just want it to work in one tap
Working from anywhere
Contractors, remote staff, travellers.
- Services that geo-block you the moment you land
- Mobile data that throttles video and calls
- Public networks in unfamiliar places
- A per-device budget of about the price of a coffee
Being straight with you
What Relane does not do.
A VPN is one layer, not a cloak. Anyone selling total anonymity is selling something.
- It is not anonymityRelane hides your traffic from the network you are on and your address from the sites you visit. If you log into an account that knows your name, that account still knows your name.
- It cannot fix your deviceIf the device is compromised, or the app you use is the one leaking, an encrypted tunnel around it does not help.
- It is not magic against a state adversaryRelane is built to defeat commodity filtering and deep packet inspection at scale. A targeted adversary with resources aimed at one person is a different threat model.
- It has to be trusted with routingTraffic passes through servers Xorsand runs. There are no logs to hand over, which is the strongest structural guarantee available, but it is not the same as a claim that trust is unnecessary.
Pricing
Free forever, or €3 a month.
No ads, no trials that expire into nothing, no upsell screens between you and the connect button. The free plan is a real plan — it is just slower.
Free
€0 / forever
- 10 GB every month, renewed automatically
- Every protocol and every server location
- Reduced speed, especially at peak hours
- One device
- Anonymous account — no email, no phone number
- Zero logs, exactly as on the paid plan
Unlimited
€3 / month
- Unlimited data, no throttling
- Full speed on every server
- Three devices on one account
- Priority routes when a region gets congested
- Cancel any time — a subscription, not a contract
- Directly funds the servers and the next platform
Payment never touches your traffic. An account is identified by a key, not by who you are — billing and browsing never meet.
Getting started
Four taps, start to finish.
From an empty phone to an encrypted connection, without reading a manual.
Install
Get it from Google Play. If the Play Store itself is blocked where you are, write to [email protected] and ask for the direct APK — same signing key, same build.
Open
An anonymous account is created for you. Nothing to fill in, nothing to verify, no address to hand over. Save the account key if you want the plan on another device later.
Connect
Press the button. Relane probes routes and picks the protocol that works on the network you are actually standing on.
Forget it
It reconnects on its own when the network changes. Use the built-in browser when you would rather not route the whole device.
Downloads
Get it, or get told when it lands.
Android and Windows are live now. macOS, iOS and Linux are in development — leave an address and you will hear the day each one lands.
Already using Relane
Manage your account.
Subscription, devices, data allowance and billing all live in the panel. It runs on its own domain on purpose — if this site is ever blocked where you are, your account stays reachable.
relane.xorsand.eu/panel
Questions
Straight answers about Relane.
Does Relane keep logs?
No — not connection logs, not activity logs, not DNS queries. Accounts are anonymous, so there is no record tying traffic to a person. This is the point rather than a marketing line: data that was never collected cannot be requested by a court, sold to a broker or lost in a breach.
Will it work where VPNs are blocked?
That is the case it was designed for. Relane runs several protocols including WireGuard and VLESS, shapes traffic to survive deep packet inspection, and moves to a different route when one stops working. No VPN can promise permanent success against a filter that keeps changing — what it can do is keep changing back.
What exactly do I get for free?
10 GB a month at reduced speed, on one device, with access to every server and every protocol. It renews monthly and does not turn into a paywall.
Why is the paid plan only €3?
One person, low overheads, no investors expecting a return. €3 covers bandwidth and servers with enough left over to keep building. If it ever has to change, you will hear the reason.
Do I need to give an email address?
No. Sign-up is anonymous by design — which also means there is no “reset by email” path, so keep your account key somewhere safe if you are paying.
Which countries have servers?
A spread across Europe with more added as demand and blocking patterns shift. The app chooses for you by default; you can pick manually if you prefer a specific exit.
Can I use it on more than one device?
Three devices on the paid plan, one on free.
When are iOS and desktop coming?
Both are in development. Android came first because it is the platform most used in the regions Relane was built for. Ask on Discord or Telegram to be told the day they land.
What happens if I stop paying?
You drop back to the free plan. Nothing is deleted, because there was nothing stored about you in the first place.
Built by Sepehr Jabbari Khorsand — founder and engineer at Xorsand OÜ in Tallinn. One person writes the code, answers the support mail and picks the servers. If something here is wrong or missing, it is my fault and my inbox.
More about the studioNext step
Get through today.
Free plan, anonymous account, no logs. Two minutes from here to connected.
In development · Windows & macOS
OS One
The next computing interface.
For forty years, using a computer has meant choosing an app, learning the app, and doing the work yourself. OS One replaces that arrangement. You say what you want; an intelligent layer sitting above your files, apps and accounts carries it out — on your own machine, and stopping for your approval before anything leaves it.
The idea
Apps become secondary.
This is the part worth understanding before any feature list. The app model made sense when software was the scarce thing and a computer could only do what someone had built a window for. That is no longer the constraint.
- ThenYou held the plan in your head and executed it by hand. Open the folder, open the reader, copy the number, open the spreadsheet, paste, open mail, attach, send. The apps were the work.
- NowYou state the outcome. The layer figures out which files, which services and which steps, and drives them. The apps still exist and still do their jobs — you simply stop being the one clicking through them.
- Which meansThe interface stops being a grid of icons and becomes a conversation with your own machine. Not a chatbot in a window: a layer over everything already on the computer.
- And criticallyIt runs locally. An interface this central cannot be something that ships your work to a stranger’s server by default — which is why the model lives on your machine and the cloud is opt-in, per task.
New · desktop · Windows & macOS
OS One
Everything is one ask away.
Not a chatbot in a window — an operating layer for your computer. OS One sits over your files, apps, accounts and services and does the work. You never touch an agent framework, an API key, a model registry or a terminal. You ask; it acts; anything that leaves your machine waits for your yes.
- Runs localDetects or installs a local AI engine for you, then recommends a model your hardware can actually run — downloads it, verifies it, tests it. Cloud models stay optional, for the heavy jobs you choose to send out.
- You approveReading, searching and analysing happen on their own. Sending mail, deleting files, spending money and posting publicly always stop and ask, every time.
- AutomationsDescribe a routine in plain language once — a morning briefing, a watched folder, a follow-up chase — and it becomes a task that keeps running without you.
- MemoryIt remembers your projects, people and preferences so you stop re-explaining yourself. The memory is yours to read, edit and wipe.
- Built for workAimed squarely at people who have work to do, not tools to tinker with: lawyers, consultants, business owners, researchers, students, freelancers.
- Platforms
- Windows and macOS
- Intelligence
- Local engine by default · cloud models optional, per task
- Surfaces
- Home · Ask · Tasks · Automations · Activity · Memory · Files · Connections · Models
- Access
- One global shortcut from anywhere on the desktop
- Permissions
- Passive actions run free · sensitive actions need explicit approval
- Status
- In development — first access group forming
Interface preview — the approval step is real, try it.
Inside the app
Nine surfaces, one shortcut.
OS One opens over whatever you are doing with a single keystroke. Behind that are nine places, each doing one obvious thing.
- HomeWhat is running, what finished while you were away, what needs a decision from you.
- AskThe main surface. Plain language in, work done out — with the plan visible as it goes rather than a spinner and a result.
- TasksLonger jobs that run in the background. Watch them progress, pause them, or read what they did afterwards.
- AutomationsRoutines you described once and no longer think about: a morning briefing, a watched folder, a weekly report, a chase-up on unanswered mail.
- ActivityA complete record of every step taken, in order, including what was read and what was changed. Nothing happens silently.
- MemoryWhat it knows about your projects, people and preferences, so you stop re-explaining yourself. Readable, editable, and erasable by you.
- FilesThe documents it can see, and the boundaries of what it may touch.
- ConnectionsAccounts and services you have linked, each with its own permissions rather than one blanket grant.
- ModelsWhat is installed, what your hardware can handle, what a task will cost in time or tokens, and which jobs are allowed to use the cloud.
On your machine
It brings its own intelligence.
Most AI software is a thin client for someone else’s datacentre. OS One is the other way around: it sets up an engine on your computer, picks a model your hardware can actually run, and treats the cloud as an option you reach for deliberately.
Detects
On first run it looks for a local AI engine and installs one if there is none. You are not asked to pick a runtime, edit a config file or open a terminal.
Recommends
It reads your hardware — memory, GPU, disk — and recommends a model that will actually be pleasant to use on it, rather than the largest one that technically loads.
Verifies
Downloads are checked and then tested with real prompts before being handed to you, so a corrupted or mismatched model is caught by the app rather than by you wondering why answers are strange.
Generates
Images and photo work run on-device too. What you make on your computer can stay on your computer — no upload, no queue, no usage meter.
- Platforms
- Windows and macOS. Linux under consideration
- Memory
- 16 GB is a comfortable floor for local text models; more unlocks larger ones
- GPU
- Optional. A discrete GPU means faster generation, particularly for images
- Disk
- Space for the engine plus whichever models you keep — it tells you before downloading
- Network
- Needed to fetch a model the first time. After that, offline work is normal
- Cloud
- Optional, per task, and always visible when it happens
The permission model
It asks before it acts.
Most agent tools are all-or-nothing: hand over the keys and hope. OS One splits actions in two and treats that split as the product rather than a setting.
Runs freely
Reading files, searching, comparing, summarising, drafting, organising. Nothing leaves your machine, so nothing needs asking.
Waits for you
Sending mail, posting publicly, deleting, spending money, sharing a file outside the machine. Every time — not once per session, and not a checkbox you tick in a hurry on day one.
Shows its work
Every step is in Activity, in order, with what it read and what it changed. If you cannot audit it, you cannot trust it.
Yours to undo
Memory is readable and editable. Automations pause. Connections revoke one at a time. None of it is a black box you have to take on faith.
What people actually ask it
Three hours of admin, gone.
These are the jobs OS One is built for: obvious to a person, tedious to do by hand, and spread across four apps that were never designed to talk to each other.
The lawyer
Contracts, versions, deadlines.
- “Compare these two drafts and list only what changed in the liability clauses”
- “Pull every date out of this bundle into a calendar”
- “Draft the reply, but do not send it until I have read it”
- “Keep client files off the internet entirely”
The consultant
Research, decks, follow-ups.
- “Summarise these twelve PDFs into one page with sources”
- “Chase anyone who has not replied to Tuesday’s email”
- “Every Friday at four, build a status note from my project folder”
- “Make three image options for this slide”
The researcher
Papers, data, notes.
- “Find every mention of this method across my library”
- “Turn this spreadsheet into three charts and explain the outlier”
- “Keep a running note of what I decided and why”
- “Work offline on the train and sync nothing”
How it differs
Not a chatbot, not an agent framework.
Three categories get confused with each other constantly. The distinction is worth stating plainly.
- A chatbot
- Lives in a window and answers. It cannot open your folder, drive your mail client or run on Tuesday morning without you.
- An agent framework
- Powerful and developer-shaped: keys, configs, orchestration, YAML, a terminal. The capability is real, the audience is small.
- OS One
- A layer over the desktop for people who are not going to configure anything. Local by default, permissioned at the point of consequence, with memory and scheduled work built in rather than assembled.
- The bet
- That the thing which wins is not the smartest model but the one ordinary people can safely hand their actual computer to.
Downloads
Get it, or get told when it lands.
OS One is in development. The first access group is small, hands-on and talks to me directly — if you have work that would suit it, say what you would ask it to do.
Questions
Straight answers about OS One.
Do I need to know anything technical?
No, and that is the entire design goal. No API keys, no model names to research, no terminal, no agent framework to wire together. It finds or installs an engine itself and picks a model your machine can run.
Does my data go to the cloud?
Not by default. The model runs on your machine. Cloud models are optional and per-task — you choose to send a specific job out, and Activity records it when you do.
What hardware do I need?
A modern laptop with 16 GB of RAM runs useful local models. More memory or a discrete GPU unlocks larger ones and faster image generation. If a task would be painful on your hardware, it says so instead of crawling.
It generates images too?
Yes, on-device. The same principle as the text side: what you make on your computer can stay on your computer.
How is this different from a chatbot with plugins?
A chatbot answers in a window. OS One works across your files, apps and accounts as a layer over the desktop, remembers your projects, runs automations on a schedule, and holds a permission boundary exactly where actions become irreversible.
What stops it doing something stupid and irreversible?
The permission split. Anything that leaves the machine or destroys something waits for an explicit approval, every single time, and every step it takes is recorded in Activity.
Windows or macOS?
Both, from one codebase. Linux is not committed — say so on Discord if you want it and it moves up the list.
Will it be open source?
Undecided and worth arguing about. The local-first architecture is the substantive guarantee; source availability is a separate question I would rather answer honestly later than promise loosely now.
What does it cost?
Not set. It will not be a per-message meter, because the work happens on hardware you already paid for.
Built by Sepehr Jabbari Khorsand — founder and engineer at Xorsand OÜ in Tallinn. One person writes the code, answers the support mail and picks the servers. If something here is wrong or missing, it is my fault and my inbox.
More about the studioNext step
Get in early.
The first group shapes what this becomes. Tell me what you would hand it on a Monday morning.
In development · web & mobile
Retold
Documented by the people who were there.
A world map of first-hand reports. Short video, filed from where it happened, transcribed and translated automatically, and weighed on evidence rather than stamped true. Every report stays pinned to its place — so what accumulates is not a feed but a record.
The problem
The footage exists. The context does not.
When something happens, dozens of people film it. Those clips scatter across platforms built for engagement, stripped of location, stripped of time, reposted out of context, and buried within a day. Six months later nobody can find them, and nobody can tell which were real.
- Platforms lose itFeeds are optimised for what is popular now. A clip from a small town with forty views disappears, even when it is the only record of what happened there.
- Context is strippedRe-encoding removes metadata. A repost carries no capture time and no place, so an old video from another country resurfaces as today’s news and cannot be checked.
- Verification does not scaleNewsroom verification is careful and slow and expensive, so it reaches the big stories and skips everything else.
- And the network fights backIn exactly the places where documentation matters most, uploading is slow, watched, or blocked outright.
In development · web & mobile
Retold
Important events should be documented by the people who are actually there.
Not a news aggregator and not a commentary feed. Retold is citizen journalism built on a world map: short video reports, filed from where they happened, by the people who were standing there. It runs alongside professional journalism rather than pretending to replace it — its job is first-hand evidence.
- Map firstBrowse by place, not by algorithm. Open a city and see what people filed there; switch to a feed when you’d rather scroll. Follow reporters, upvote, discuss.
- Any languageUploads are transcribed, subtitled and translated automatically — a report filed in Persian is watchable with English subtitles minutes later.
- Evidence, not verdictsRetold doesn’t stamp things true. It weighs them: independent corroboration, where and when the footage was captured, media metadata, the reporter’s history, duplicate and manipulation checks, verified organisations.
- Safe to fileLocation is central but adjustable — reporters choose how precise it is. Reporting from somewhere dangerous shouldn’t mean broadcasting your street.
- Survives blockingBuilt assuming the network will fight back: VPN integration, alternative upload paths, heavy compression and delayed sync for when the connection is watched or throttled.
- The long gameEvery report stays pinned to its place. Over years that becomes a live historical map — open a location and see everything people documented there.
- Shape
- A world map of short video reports, filed locally, browsable as a map or a feed
- Media
- Adaptive streaming at several qualities
- Automatic transcription and subtitles
- Translation across languages
- Trust
- Corroboration weighting across independent reports
- Capture location and timing
- Duplicate and manipulation detection
- Privacy
- Location precision chosen by the reporter, anonymity supported throughout
- Resilience
- VPN integration and alternative upload paths
- Compressed, resumable uploads
- Delayed sync for watched networks
- Clients
- Web and mobile
Basemap © OpenStreetMap © CARTO · pins are illustrative
How a report is weighed
No verdicts. Evidence, scored.
Retold never tells you something is true. It shows how much independent support a report has and lets you judge — the way a newsroom would, at a scale a newsroom cannot reach.
Filed
A reporter uploads video from a place. Capture time, location at their chosen precision, and media metadata travel with it. What the phone recorded is more useful than what anyone claims afterwards.
Processed
Transcribed, subtitled, translated. Checked against known duplicates and for signs of manipulation, re-encoding or reuse from an older event elsewhere.
Corroborated
Independent reports of the same event, from different accounts, at the same place and time, raise confidence. One lone clip stays visibly marked as one lone clip.
Pinned
It stays attached to its location permanently. Years of reports on one map become a record you can walk back through.
- Corroboration
- How many independent reporters filed the same event, from what angles, how close together in time
- Capture evidence
- Recording time and place, at the precision the reporter permitted
- Media forensics
- Duplicate detection, re-encoding traces, signs of editing or splicing
- Reporter history
- A handle’s track record over time — earned, not bought, and not tied to a legal name
- Verified organisations
- Newsrooms and NGOs can be verified, and their material is labelled as such rather than silently ranked higher
- What it never does
- Assign truth. The score describes the evidence, not the reality
If reporting puts you at risk
Built for hostile conditions.
The people with the most important footage are often the ones for whom uploading it is dangerous. That constraint shaped the architecture rather than being handled at the end.
- Your locationPrecision is a slider, not a fixed value. Report at city level when street level would identify you — the map still works, and your street does not become public.
- Your identityAnonymous accounts are first class. Reputation accrues to the handle, so you can build credibility over years without ever attaching a name to it.
- Your connectionVPN integration, alternative upload paths, heavy compression and delayed sync for networks that are watched, throttled or intermittently cut.
- Your footageUploads are chunked and resumable, so a dropped connection does not mean starting over on expensive mobile data — and a phone that has to be put away mid-upload can finish later.
- Your deviceA report that never finished uploading should not sit on the phone as evidence against you. Handling that properly is an explicit design goal.
The media pipeline
What happens to a clip after you press upload.
Most of the engineering in Retold is here — turning a phone video from a bad connection into something watchable, searchable and checkable in any language.
- Ingest
- Chunked, resumable uploads sized for weak mobile networks
- Transcode
- Multiple qualities so it plays on a slow connection as well as a desktop
- Validate
- Format, duration and integrity checks before anything is published
- Transcribe
- Speech to text in the original language, timed to the video
- Translate
- Subtitles generated across languages so material crosses borders as fast as it crossed the street
- Index
- Geospatial and full-text indexing, so the map query and the search box hit the same record
For newsrooms and researchers
A source layer, not a competitor.
Retold is not trying to replace journalism. Reporters, editors and fact-checkers do work that a platform cannot. What a platform can do is get first-hand material in front of them, with its provenance attached.
- Find materialSearch a place and a date range and see what people on the ground filed, with corroboration counts rather than view counts.
- Check provenanceCapture evidence and duplicate history travel with each clip, so verification starts from something instead of nothing.
- Verified presenceOrganisations can be verified, so their reports are identifiable as institutional without being ranked above eyewitnesses.
- Long memoryBecause reports stay pinned by place, a story from three years ago is still findable at the coordinates where it happened.
Downloads
Get it, or get told when it lands.
Retold is in development. Web comes first, with mobile close behind — mobile is where the filming happens.
Questions
Straight answers about Retold.
Is this a news app?
No. Retold carries first-hand material from people at the scene, not articles about it. It is meant to sit alongside professional journalism as a source of evidence, not to replace reporters and editors.
How do you stop fabricated reports?
You cannot stop them entirely, and anyone claiming otherwise is selling something. What Retold does is make fabrication expensive and visible: corroboration weighting, capture metadata, duplicate detection, manipulation checks, reporter history and verified organisations.
Who decides what is true?
Nobody, deliberately. There is no editorial verdict — only a description of how much independent evidence a report has. Readers judge; the platform shows its working.
What if filming puts me in danger?
Set location precision low, use an anonymous handle, and upload over a VPN. The app assumes the network is hostile rather than treating that as an edge case.
Which languages?
Uploads are transcribed and translated automatically, so a report filed in one language becomes watchable in another within minutes.
Can I delete something I filed?
Yes. Pinning a report to a place permanently is about the record surviving platform churn, not about trapping reporters.
How is this different from a hashtag on a social platform?
Place instead of algorithm, evidence weighting instead of engagement ranking, permanence instead of a feed that forgets by Thursday, and an upload path designed for censored networks.
When can I use it?
It is in development. Leave your address and you will hear when the first public build lands.
Built by Sepehr Jabbari Khorsand — founder and engineer at Xorsand OÜ in Tallinn. One person writes the code, answers the support mail and picks the servers. If something here is wrong or missing, it is my fault and my inbox.
More about the studioNext step
Be there when it opens.
Retold needs reporters more than readers. If you are somewhere things happen, I want to hear from you.
In development · peer-to-peer
Recon
Messages travel between people, not through an archive.
Most private messengers still route every word you write through a company’s infrastructure and ask you to trust the encryption. Recon removes the server from the path wherever it can: your device talks to theirs directly, and a middle only appears when the network leaves no choice — and even then it cannot read a thing.
The problem
Encrypted is not the same as absent.
Good encryption means a company cannot read your messages. It does not mean the messages are not there. Every conversation still crosses infrastructure someone owns, in a pattern that is itself informative, and the existence of that pipe is a permanent invitation.
- The archive problemA server that carries every conversation is a target — for a breach, for a subpoena, for a change of ownership, for a change of law. Encryption narrows what can be taken, it does not remove the thing being aimed at.
- The phone number problemMost private messengers identify you by phone number, which is issued by a carrier, tied to your legal identity, and trivially linked to everything else about you.
- The metadata problemWho talks to whom, when, how often, from where. Content encryption does nothing about it, and for many people that pattern is the sensitive part.
- The honest positionNone of this is fully solvable. Recon’s stance is to remove what can be removed, and state plainly what remains.
In development · peer-to-peer
Recon
Messages should travel between people — not live permanently on somebody else’s server.
Most private messengers still route every word you write through a company’s infrastructure and ask you to trust the encryption. Recon takes the server out of the path wherever it can: your device talks to theirs directly, and the middle only exists when the network leaves no choice.
- Direct firstPeer-to-peer connections with STUN/TURN for the awkward networks behind routers and carrier NAT. An encrypted relay is the fallback, never the default and never permanent storage.
- Thin serverThe backend does four small things: identity, username lookup, connection setup and short-lived signalling. It never holds your conversations, because it never gets to see them.
- @usernamesPermanent handles are the whole discovery layer — no phone number required. Your networking details are only revealed once you accept a connection.
- Keys on deviceEnd-to-end encrypted with keys that stay with you. Keeping conversation history locally is a choice you make, not a default you discover later.
- Offline deliveryIf you’re not reachable, a short-lived encrypted blob the server cannot open waits for you, then is deleted the moment it’s delivered.
- Honest about metadataWho talks to whom, when, from which address — that’s the hard problem, and no messenger has fully solved it. Recon will say plainly what it protects and what it doesn’t.
- Practical, not puristA relay is fine if it makes delivery reliable without giving the server your content. Decentralisation is a means here, not a religion.
- Transport
- P2P first (STUN/TURN) · encrypted relay fallback · no permanent server storage
- Server knows
- Identity, @username discovery, auth, temporary signalling
- Server can’t
- Read messages, calls or files — keys never leave your devices
- Discovery
- Permanent @username · no phone number · address shared on accept
- Offline
- Short-lived encrypted blobs, removed after delivery
- Planned scope
- Messaging, file transfer, voice and video calls, groups
- Open question
- Group architecture — mesh, designated relays, or a hybrid
Finds @them, introduces the two devices, then drops out of the conversation.
- Sees
- Identity, username lookup, connection setup
- Never sees
- Messages, files, calls
- Stores
- Nothing — offline blobs die on delivery
Architecture
Direct where possible, relayed where necessary.
Pure peer-to-peer sounds ideologically clean and fails in practice: phones sit behind carrier NAT, go offline, change networks. Recon is direct-first with an honest fallback rather than a purist design that drops messages.
Find
You look someone up by @username. The server confirms the handle exists and passes an introduction request. Your networking details are not revealed by a lookup.
Introduce
If they accept, the two devices are introduced through STUN/TURN and try to establish a direct connection. This is the only moment the server is genuinely needed.
Talk
From then on, messages, files and calls flow device to device, end-to-end encrypted with keys that never left either phone.
Fall back
When a direct path is impossible, an encrypted relay carries the traffic. It cannot read content. If you are offline, a short-lived encrypted blob waits and is deleted the moment it is delivered.
- Transport
- P2P first with STUN/TURN; encrypted relay as fallback, never as the default
- Identity
- Permanent @usernames. No phone number, no email required
- Keys
- Generated and held on device. The server has no key material and no ability to acquire it
- Storage
- No message archive. Offline blobs are short-lived and deleted on delivery
- History
- Local conversation history is your choice, not a default you discover later
- Groups
- Undecided — mesh, designated relays or a hybrid. Each has different metadata exposure
Threat model, stated plainly
What it protects — and what it does not.
Every messenger should publish this and most bury it. Here it is before the product has even shipped.
- Message content
- End-to-end encrypted. Keys never leave your devices, so the server cannot read messages, files or calls even under legal compulsion.
- Message storage
- Nothing is archived server-side. There is no history to seize because there is no history kept.
- Your phone number
- Never collected. Discovery works on permanent @usernames instead.
- Your address
- Networking details are shared only after you accept a connection, not to anyone who looks up your handle.
- Metadata
- Who contacts whom and when. A direct connection reveals your IP to your peer; the relay hides that but observes timing. Pick your trade-off knowingly.
- Your device
- If the endpoint is compromised, transport encryption is irrelevant. Turn off local history if that is your risk.
- Group architecture
- Genuinely undecided, and it has real metadata consequences. I would rather say so than pretend the design is finished.
- The relay operator
- When the fallback is in use, someone runs it. It cannot read content — but it exists, and pretending otherwise would be dishonest.
Compared with what you use now
Where Recon sits.
Not a claim to be better at everything. A different set of trade-offs, stated so you can tell whether they are the ones you want.
- Server-based E2E apps
- Excellent encryption and enormous networks, with every conversation still crossing a company’s infrastructure, usually keyed to your phone number.
- Fully decentralised networks
- No central party, and often difficult onboarding, unreliable delivery and heavy battery use. Purity paid for in usability.
- Recon
- Direct by default, relayed only when the network forces it, identified by a handle rather than a number, with no archive anywhere and the metadata caveats written down instead of hidden.
- The cost
- A smaller network at the start, and no “everyone already has it” advantage. That is the honest price of the architecture.
Roadmap
What ships first.
Order matters more than dates when one person is building it.
Text
One-to-one messaging over the direct path, with the relay fallback working properly. This is the hard part and it comes first.
Files
Transfers over the same channel, sized for real networks rather than ideal ones.
Calls
Voice and video, which the P2P layer already makes natural once the transport is solid.
Groups
Last, because the architecture is undecided and getting it wrong would leak exactly the metadata this is meant to reduce.
Downloads
Get it, or get told when it lands.
Recon is in development. Early builds go to people who will stress the transport layer and complain loudly.
Questions
Straight answers about Recon.
Why peer-to-peer rather than a well-encrypted server?
Encryption protects content; it does not remove the fact that a company holds a record of every conversation that passed through it. Taking the server out of the path removes the archive itself, not merely its readability.
What happens when a direct connection is impossible?
An encrypted relay carries it. The relay cannot read anything, and it is a fallback rather than the default. Delivery stays reliable on carrier NAT and hostile networks.
Do both people need to be online at once?
No. If you are unreachable, a short-lived encrypted blob the server cannot open waits for you, and is deleted the moment it is delivered.
How do people find me without a phone number?
A permanent @username. Looking you up does not reveal your networking details — those are shared only once you accept.
Does it leak my IP address to whoever I talk to?
On a direct connection, yes — that is inherent to peer-to-peer, and it is exactly the kind of thing that belongs in plain sight rather than a footnote. Using the relay path avoids it at the cost of a timing-visible middle.
Will it be open source?
That is the intention. A privacy claim you cannot verify is a marketing claim, and this one will need to be checkable.
What about the name?
Recon is the name. It was briefly shelved over a trademark question and is back in use.
When can I try it?
Beta list first, and it will be small. The transport layer has to be genuinely solid before more people arrive.
Built by Sepehr Jabbari Khorsand — founder and engineer at Xorsand OÜ in Tallinn. One person writes the code, answers the support mail and picks the servers. If something here is wrong or missing, it is my fault and my inbox.
More about the studioNext step
Get on the beta list.
Early builds go to people who will break it on purpose and tell me exactly how.







