Haute Lumière · Luminous Prosperity
Everything you read, everything you write, and everything you say — behind one key, and the key is yours.
Three hundred and thirty-five books. A hundred and thirty-nine of them read aloud. Your passwords, your files, and your conversations in the same place, sealed on your device before they leave it.
a month. The whole house.
And eleven gigabytes are free to everyone, always.
Count the companies that can read your things.
Your books are in one, and you do not own them — you own a licence that ends when the company does. Your notes are in a second. Your passwords are in a browser made by a third, whose actual business is advertising. Your files are in a fourth, which scans them. Your conversations are in a fifth, which keeps them forever and hands them over when asked.
Five companies. Five passwords. Five privacy policies you have not read, each of which reserves the right to change. And every one of those companies holds a key that opens your material, because that is what "encrypted at rest" means — encrypted, with a key they keep.
You did not choose that arrangement. It accumulated. Each piece was reasonable on the day you signed up, and the total is a life stored in five places, none of which are yours, any of which can be read, closed, repriced, or subpoenaed without you being in the room.
You are not a customer of five services. You are renting your own mind, in five pieces, from five landlords.
The Stack is the other arrangement. One place, one key, and the key is derived on your device from a password we never see and could not produce if a court asked us to.
Three things here are free, and none of them expire.
The first chapter of every one of the three hundred and thirty-five books, to anybody, with no account and no card. Luminize, which sets any page you are reading in the house's own type. And eleven gigabytes of encrypted room, free to everyone, always. None of that is a trial. The door is simply open.
Open the shelfThree hundred and thirty-five volumes. Eleven million eighty-four thousand five hundred and thirty-three words. A hundred and thirty-nine of them narrated. All of it original work, on six shelves, each set in its own register of light.
| The shelf | Volumes | |
|---|---|---|
| The Developmental Canon | 112 | How a person, and an organisation, actually grows |
| The Luminous Hundred | 100 | A hundred short instruments |
| The Living Economy | 56 | and other narrations |
| Living Systems Economics | 33 | The economy read as a body, not a machine |
| The Luminous Library | 30 | Practice, embodiment, the rooms a life is lived in |
| The Press | 4 | What is being written right now |
You are not buying access to a catalogue somebody licensed. You are buying a decade of one person's work, in one place, indexed, narrated, searchable, and yours to keep reading for as long as you are here.
One argument, run through five disciplines: that living systems and economies and people all grow by the same logic, and that most of what we build fights it.
The economics shelf reads markets as bodies rather than machines — thirty-three volumes on why a system optimised for extraction eventually eats the thing it extracts from, and what the alternative actually looks like when you cost it out. The developmental canon is the longest shelf and the spine of the whole corpus: a hundred and twelve volumes on how a person, a team and an institution actually move between stages, why the moves cannot be forced, and what happens in an organisation that demands a stage its people have not reached.
The Luminous Library is the practical wing — embodiment, attention, the rooms a life is lived in, the ordinary machinery of being a person with a nervous system. The Hundred are short instruments: one idea each, taken to the floor, readable in a sitting.
If you have ever finished a business book and thought that it was a magazine article in a hard cover, this is the other thing. These are long, they are cited, and they assume you are willing to be changed by them rather than merely informed.
Audible charges $14.95 a month and gives you one credit. One book. Spotify includes about one. Everand gives you one premium unlock. Here, a hundred and thirty-nine narrations are simply on the shelf, and the eleventh one you start this month costs exactly what the first one did, which is nothing.
Stop reading chapter seven on the train. Press listen on the walk home and the voice starts at the paragraph your eyes left. Open the page that evening and it is waiting where the voice stopped. Phone, desk, wrist, television, and the air — one bookmark, not five.
Every chapter is written to disk before it is shown to you and kept after. Your shelf opens on a plane. Nothing you own is ever lost to a connection.
A question about chapter seven, answered out of chapter seven, with the sentence it relied on quoted first. Where the book does not say, it says the book does not say, and names what it does say that is nearest. It will not tell you what the internet thinks. It reads this book and shows you where it looked.
Point it at your own documents and it works the same way — which is the one thing no encrypted storage company on earth can offer you, because they have nothing to read.
Signal's Double Ratchet was designed in 2013 for two people, and it is superb at that. Groups are where it strains. The usual workaround is a construction called Sender Keys — what Signal itself uses for group chats — and the literature is blunt about the cost: with Sender Keys, achieving good post-compromise security is prohibitively expensive. A group is a harder problem than a pair, and the pairwise protocols were adapted to it rather than designed for it.
The room is a group. Eight readers inside one chapter is the normal case here. So it is built on MLS — Messaging Layer Security, RFC 9420, the IETF standard published to solve group encryption properly.
| Pairwise / Sender Keys | MLS · the room | |
|---|---|---|
| Forward secrecy | Yes | Yes |
| Heals after a key is stolen | Prohibitively expensive | Yes — including across joins and leaves |
| Cost per message, group of n | O(n) | O(log n) |
| Designed for | Two people | Groups, from the first line of the spec |
In a sentence you can use: if a key is ever stolen, the conversation heals itself. The group state is a tree and it moves forward with every message; every arrival and departure rekeys it. Somebody who gets in once does not stay in — they are locked out the moment the room turns, and they have to break in again from nothing.
And it costs less to run, not more. A pairwise group encrypts a separate copy of every message for every member, so a room of forty is forty times the work. MLS grows with the logarithm of the room. The better guarantee is also the cheaper one, which is what happens when a thing is designed for its job instead of adapted to it.
Your identity is an X25519 key pair made on your device and nowhere else, its private half sealed under your own master key. We do not hold it. Not in escrow, not in a recovery table, not in any form we could produce under a warrant — and a company that cannot hand something over cannot be made to.
Most houses ask you to believe they will not read your messages. This one is built so that it cannot.
No unread count in red. No double tick, no blue tick, no one-is-typing ellipsis. Someone composing a message is writing, and delivery is a hairline that fills in gold. The room sits beside the chapter, in the same type, on the same page — because the reason to read here rather than anywhere else is the other readers, and putting them in a separate app admits they are an afterthought.
If the house cannot read the room, how does the house stop the room becoming a sewer? Most encrypted services simply do not say. Some run a server-side filter that has nothing to filter, which is theatre.
Here the check runs on your device, before anything is sealed, and it is about conduct rather than vocabulary — because a filter that fires on words instead of aims catches quotations and misses cruelty. When it fires, the message stays in your field and stays yours to edit. It is held, never rejected, and never counted against you anywhere. Nothing it sees is sent anywhere, including when it fires.
No review, no appeal, no waiting on us, and they are not told. It never passes through the warden at all.
Your device holds the key, so it hands over that message with its neighbours for context and nothing else. We never decrypted anything — you chose to show us.
A machine sorts the queue. A person decides. You are told what was reported, what was decided, and when it ends.
Never a number going up somewhere you cannot see. Resting ends by itself. It is not a punishment surface.
Than the one who decided. To a human, at an address, who answers inside a day.
Including the ones later reversed. A house that cannot audit what it did to somebody is not administering anything.
The line the house acts on is published in full and it is short. Being wrong is not on it. Being rude is not on it. Being political is not on it. Quoting an ugly thing in order to talk about it is not the ugly thing, and any filter that cannot tell the difference gets fixed.
And the part most houses will not put in writing: paying does not make you unremovable. Cross the line and the door closes, membership or not, with the unused month refunded — because the alternative is a house where the worst person in it is the one who paid, and everybody else leaves. We would rather have the smaller house.
What is never taken is your reading. Your books, your place, your marked passages and your gigabytes stay yours to open and export whatever happens in the room. The room is a privilege of good conduct. The library is not.
Your master password is stretched on your device — three hundred and ten thousand rounds of it — against a salt derived from your own username. A branch of the result becomes the key that seals every item, before it leaves the machine you typed it on.
What the server stores, in full: an id, a kind, ciphertext, a domain hint, and two timestamps. The hint is the registrable domain only — enough to offer the right login when you land on a form, and worthless to anybody who steals the database. The authentication hash we hold is derived from the master key rather than the password and stretched again on our side, so compromise of the entire user store never yields a vault key.
That is not a policy we promise to keep. It is the shape the data is in.
Recognises a login and offers the right item.
Sealed as you sign up, before it is stored.
On your device, from your device's own randomness.
TOTP lives in the item, sealed with everything else.
For the things that are not a username and a password.
Same envelope. A note is a password with more words in it.
On the website, in Chrome, in Safari, and in a native Mac app. Four surfaces, one contract.
You are reading something. An article, a specification, a report, a badly-set document somebody emailed you. You press two keys.
About a minute later it is a magazine. A cover. A contents page set like a fashion index. Movements with kickers. A lexicon of its own terms. A reflection. A works-cited spread that is never trimmed to make a layout fit. A colophon. Photographs throughout, in whichever of the seven registers of light suits it. One self-contained file, at a permanent address, that you can hand to anybody.
People do not believe this until they press it once.
And the rule that makes it trustworthy
The original is always kept. Every luminize writes the page exactly as it was supplied, and the extracted reading text, beside the issue. Both downloadable forever.
Luminizing never replaces a source. It stands beside it. If the issue reads the argument wrongly, the argument is one click away, unaltered, for as long as your account exists.
The pictures come from a real library first — ninety-two of the house's own curated photographs, then a cache that returns the same frame for the same seed forever, so an issue you loved last year looks the way you remember it. Only then does it generate. And if everything fails it returns a register plate: paper, one gold hairline at the golden section, a monogram at twelve percent. Calm, on system, never broken. A missing image is a bug everywhere else. Here it is a designed state.
Your bookmarks get the same treatment — a mark with a photograph, a note and tags, in a grid you can actually look at. A hundred text bookmarks are a graveyard. A hundred pictures are a memory.
Come in free, and we will write to you before it ends.
Not a receipt buried in an inbox — a note with the date on it and one click to leave. A house that hopes you forget is not a house. And the card is not touched until you have decided.
Come iniPhone, iPad, Mac, Apple Watch, Apple TV and Vision Pro — one source tree, six real applications. The Mac app is a Mac app, with menus and keyboard commands and a window that behaves. Nothing here is a web page wrapped in a frame and shipped as native, which is what most of this category does and what you can feel within about four seconds of using it.
What changes between them is measured deliberately, in one place: how far a hand travels, how much of a page a piece of glass can honestly hold. Everything else is identical, because a book is a book.
The whole shelf, and the room as a sheet that dims the page behind it.
The room sits beside the chapter as a rail, in the same type, on the same page.
One thing only: the narration you are inside, and a crown that scrubs it.
The television, at ten feet, with the chapter title set large enough to read from a sofa.
Vision Pro, where a page can simply hang where you left it.
Everything the apps do, plus the extension for Chrome and for Safari.
And the light follows the hour. Seven registers, dawn to night — the paper warms through the afternoon and cools after dark, and the photographs are graded to match rather than merely tinted. You can hold it wherever you like, or let it move on its own. It is the difference between an application that has a dark mode and one that knows what time it is.
Files are sealed the way everything else here is: a key that never leaves your device, content encrypted before it is sent, and filenames encrypted too — because a directory listing is a document in its own right, and most services leak yours without noticing.
Eleven gigabytes are free to everyone, always — not for a trial period, not for the first year. The house carries a hundred and eleven on top of that, and The Desk carries eleven hundred and eleven.
Room is its own line and is never folded into a subscription. There is no plan to be on. A block is a hundred and eleven gigabytes for eleven dollars and eleven cents, which is a shade over ten cents a gigabyte, and you hold as many blocks as you want. Take one this month and none the next.
A magazine with your name on it, or the whole instrument.
Your own weekly magazine, under your name, set the way this house sets its own work. Not a newsletter template with your logo dropped in the corner — an issue: a cover, a contents page, movements, plates, a works-cited spread. It arrives every week whether or not you felt inspired, because that is what a publication is and what a newsletter never quite becomes.
Four hundred and forty-four gigabytes of encrypted room carried with it, on top of the eleven that are free to everyone.
Everything above, and the instrument itself.
The writing instrument — a page on linen in the type you choose, on Mac, iPad, iPhone, Watch and Vision. The room where the sentence lives.
At your own address, syndicating to WordPress, Ghost, dev.to, Medium, Micro.blog and Mastodon — every copy carrying a canonical link home.
Set for you in the house grammar. Not written for you — set, the way a house compositor sets a manuscript.
The week's work bound as one issue, the way a quarterly binds a season.
Anything you set with Luminize publishes under your name, in the seven registers.
Encrypted, carried, on top of the eleven that are free to everyone.
This is the part that decides it if you write for a living. Substack takes ten percent of your revenue, for as long as you use it. A writer earning two thousand a month hands them two hundred. At five thousand it is five hundred. The fee grows exactly as fast as you do, which is a strange thing to have agreed to.
The Desk is a hundred and eleven dollars and eleven cents, flat, at any income. You keep every cent, and the work is set in a house style rather than a template.
A platform that takes a percentage is not a publisher. It is a partner you did not choose and cannot fire.
The most useful thing a subscription can tell you is how hard it will be to leave. So here is the whole list, before you have paid anything.
All of that is in the Covenant, which is the terms of service, written to be read. Most terms are written by a lawyer to protect a company from its own users. This one is written to say what the house will do, what it cannot do, and what it will never do to you. It is short on purpose. If any of it needs a lawyer to understand, that is a failure on this side and not yours.
The writing itself is licensed to you to read and to keep — not to resell, not to republish, and not to feed to a machine as training data. What you write in the room is yours; the house claims no licence in it and could not use it if it did, because it cannot read it.
The reasonable question about a house this small is who is behind it, and the reasonable way to answer is not a photograph and a paragraph about passion.
Eleven million words. Three hundred and thirty-five volumes. Written over years, by one person, and then — the part that matters — deposited. Every edition carries a DOI, an ORCID, a named affiliation and a licence, in a public scholarly archive that nobody here controls. Not self-published to a folder. Archived, citable, and permanently addressable by anybody who wants to check whether the work exists.
Every citation in the corpus is verified against public bibliographic databases before an edition ships, and where a volume's sources are still being checked, the shelf says so on the card rather than quietly hoping you do not ask. That is an unusual thing to build and an unpleasant thing to enforce, and it is the single best evidence available that the writing is meant seriously.
The software is the same story from the other side. Every claim on this page about what the encryption does and does not do is a description of code, written to a specification file that each of the surfaces was built against rather than toward. The terms are eleven hundred words of plain sentences. The moderation policy publishes the entire list of things it acts on, and the list is short enough to read in a minute.
A house that will show you its sources will usually show you everything else.
There is no venture money here and no growth team, which has one consequence you should weigh in both directions. Nobody is under pressure to raise your price, harvest your reading, or sell the company to somebody who will. And it is a small house, so you are buying the work of a person rather than the output of an institution. That is the trade, stated plainly, so you can decide whether it is the one you want.
Not four subscriptions with a discount stapled to them. One system, with one key ladder, where adding a product means adding a label rather than adding a company. The security story is one story. The recovery story is one story. And the thing you have to understand is one sentence: one password, held only by you, opens all of it, and the house cannot open any of it.
What that buys you over a year is not a feature list. It is that your reading, your writing, your passwords, your files and your conversations stop being scattered across five companies that can each read them, and start being one thing that only you can open. On six pieces of glass, in a house that publishes you if you want publishing.
A vault with nothing in it is a filing cabinet. A vault with a library in it is a house.
The house is $22.22 a month. The Desk is $44.44. And the door is open before either.
Start with a chapter, and eleven gigabytes, and Luminize — none of which cost anything or ever will. If it is not for you, you will know inside twenty minutes and it will not have cost you a thing. If it is, the other three hundred and thirty-four are waiting, and so are the narrations.
Open the shelf