The real objections, straight answers

Only brothers and sisters admitted to the degree the document is intended for. Papers are encrypted end-to-end in the browser, before they leave: the server receives ciphertext, and the key that opens it does not belong to it. We do not read them, and neither do the administrators of the platform: it is not a promise, it is how the thing is built. See the Security page.

On first sign-in every member sets a recovery code: if you keep it, you use it to reset your password and get your keys back. The honest part: if you have lost the recovery code as well, your personal keys cannot be restored: no one, not even us, can decrypt on your behalf. The secretary can re-enrol you with a new key and the lodge hands you its key again, so you can read the archive according to your degree once more; but what you had encrypted for yourself alone remains unreadable. It is the unavoidable flip side of real encryption.

The lodge is suspended, not deleted. Members' access is blocked with a courtesy page, but the data and the keys remain intact: reactivation is complete and lossless, and changing your mind costs nothing. We never delete silently: final destruction happens only if you ask for it, explicitly.

Nothing automatic. There is no card to charge and no silent conversion: at the end of the ninety days you decide together, calmly. The content stays encrypted and readable only by the lodge; if you choose not to continue, you export everything and request final deletion.

No. The ninety-day trial starts without a credit card and without payment details: there is nothing that could go off on its own.

With a single annual invoice made out to the association, payable by bank transfer: one fee per lodge, stated per month and billed once a year, in tiers according to the number of members. No recurring charges, no per-user cost. The full figures are on the Pricing page.

Not during the year: the fee is per lodge, never per person. The tier is reviewed at renewal, talking it over together: no intrusive counting, no surprise recalculation because someone joined or left.

Yes, at any time: exporting the archive is included in the fee, and each member reopens their own perimeter with their own password, with no need of us. If the lodge decides to leave the service, a read-only window remains for completing the export; then the data is deleted for good, by destroying the keys. The way out is described on the Security page.

The infrastructure is hosted with a cloud provider, on servers in the European Union; the encrypted backups are kept in a separate region. The exact scope (provider, region, retention) is stated in the legal notice and in the service contract.

Even faced with a legitimate request, we can only hand over what we actually hold: ciphertext and some metadata (that a lodge exists, the counts, the rhythm of the sessions). We do not have the keys (they live on the devices of those who belong to the lodge), so the plaintext is not in our possession and we cannot produce it. Online sessions leave no aftermath to hand over, because they are not recorded; and while they are in progress, with high privacy their stream is encrypted end-to-end, so what reaches the server are only opaque envelopes it cannot open. What the visible metadata implies we explain, with no discounts, on the Security page.

No. Subscriptions, cash movements and charity are encrypted in the browser of whoever records them, like the papers: the server receives sealed boxes. Balances and the report are computed on the devices of the lodge's appointed members; we see only that a treasury is in use and the rhythm of its entries, never amounts, descriptions or names. And each member sees their own subscription status, not anyone else's.

Yes. As well as in person, a session can take place by video call, in a virtual room that takes up the setting of the Temple. You schedule it from the calendar like an ordinary session, ticking online session, and the room opens shortly before the appointed time. Entry is guarded, never automatic: a digital Tyler welcomes at the door and admits or turns away one by one, because the vetting stays a human act, in real time. Members enter from the portal with a tap, guests with a link and an invitation code. In the room you find live video and audio, those present arranged by column and degree around the East, the control of the floor, the open vote and the gavel. No session is recorded. And there is no third-party video service: the infrastructure that routes the connections is ours, on the same servers in the European Union as the rest of the service. What our server sees while the sitting is in progress we tell you below, with no discounts.

Here the line is now the same as for the rest of the archive, and it is appropriate to say so clearly. Papers, minutes and the treasury are encrypted end-to-end, and with high privacy so now is the audio and video stream of an online session: it leaves the devices of those present already encrypted, and our server, the one that routes the connections, conveys only opaque envelopes it cannot open. The key of the meeting is born and stays on your browsers, and we record nothing. What stays visible, by contrast, is the metadata of the sitting: who is connected at that moment, with temporary identities and without the real name, the times and who is speaking. The server does not know which sittings are online, because the fact that an event has a room, and the coordinates of the room, live in the event's encrypted data; and real names do not travel at the entrance, it is the Tyler who assigns them at the door. An honest caveat: live encryption requires a recent browser, and on a browser too dated that participant falls back to the clear, with the room declaring it to everyone. The line in full is on the Security page.

Yes, with strict discipline. Candidacies (referral, vetting interview, meetings, ballot) live in an area reserved for the council the lodge appoints, and are encrypted like everything else: we see that files exist and how far along they are, never who they concern. The file holds only the essential fields; unfavourable outcomes and withdrawals are deleted after a stated period, with no permanent lists. And when an applicant is admitted, the file is deleted all the same: their story in the lodge starts afresh, clean.

No: it feeds them. It is the lodge's internal register, with no official fiscal standing. The yearly report is exported from the treasurer's browser and becomes the basis for the association's accounts, which remain a separate obligation.

No, and there is none, anywhere. We use no artificial intelligence models, neither in the product nor on your data: it would be impossible anyway, since the server sees only ciphertext. The tools are ordinary and predictable.

An independent, small-scale project, run by those who maintain its infrastructure; the service owner's details are stated in the legal notice. But this is precisely the point of the architecture: your privacy does not depend on trusting us as people: it depends on the fact that we do not hold the keys. You do not need to know us to verify it.