The Desk

Why own the machine

Add up what you currently pay for cloud storage, a messaging service, an email platform, a website host, and whatever takes a cut of your subscription revenue. The number is usually larger than people expect, and it is not the interesting part. The interesting part is what none of that money buys.

It does not buy the right to keep your files if an account is flagged. It does not buy the right to keep your subscriber list if a platform changes its terms. It does not buy the certainty that a conversation is unreadable by the company carrying it. And it does not buy the ability to publish something a payment processor dislikes.

You are not paying for a service. You are paying for permission, monthly, and it can be revoked.

What you are renting now

Three separate dependencies, each with the same structural weakness.

Storage. Your archive lives on hardware owned by a company that can read it, scan it, deduplicate it against other people's copies, and lose access to it on your behalf. Encryption at rest exists on every major service and in almost every case the provider holds a key — which is the only reason server-side search and preview work at all.

Messaging. Even the good services keep metadata, and most keep more than that. The pattern of who you spoke to, when, and how often is more revealing than the content, and it is retained by default because it is operationally useful.

Publishing. This is the expensive one and the least noticed. Every hosted newsletter platform sits between you and the people who chose to hear from you. Some take a straight percentage — the best-known takes ten per cent of everything you earn, permanently, on revenue generated entirely by your own work. All of them hold the list.

The three things you lose

The archive. Not the files — the ability to hold decades of work in one place, uncompressed, unscanned, and searchable by you alone. Most people's actual body of work is scattered across four services and two dead laptops.

The relationship. A subscriber list held by a platform is not a relationship, it is an introduction that platform can withdraw. The single most valuable asset a writer builds is a list of people who want to hear from them, and it is routinely the one thing they do not possess.

The margin. Ten per cent of subscription revenue sounds modest until it is compounded across years. On a publication earning a hundred thousand a year, that is ten thousand a year for hosting a database — and the platform's own costs do not rise with your success.

Why one machine fixes it

Because all three problems are the same problem, and it has the same solution.

Every one of them exists because the computer doing the work belongs to someone else. Move the computer and the whole class of problem disappears at once: there is no provider to read the archive, no server to retain the metadata, and no intermediary between you and the person paying to read you.

The reason this is not the default is that owning a server has historically meant being a systems administrator — a Linux install, a firewall, a certificate renewal, a backup regime, and a 3 a.m. failure you are personally responsible for. The Desk removes that and nothing else. The machine is yours; the maintenance is ours.

Four hundred and forty-four terabytes

The number is deliberate and it is not a marketing figure. It is the point at which storage stops being a thing you manage and becomes a thing you stop thinking about — which is a different product from a bigger allowance.

444.44 terabytes

Usable, after redundancy, in a single addressable pool. Not a tier you can be upgraded out of, not a soft limit with overage billing, and not a figure that assumes compression.

To make it concrete: that is enough for roughly a hundred thousand hours of professional video, or every photograph you will take in a lifetime at full resolution with the raw files kept, or the complete uncompressed archive of a working studio across several decades. Most people who buy this will never approach the ceiling, and that is precisely the intent — the value is not the capacity, it is the end of capacity as a consideration.

Practically, it means you stop curating. No more deciding which projects to keep at full resolution, no more moving old work to a cheaper tier, no more archives on drives in a cupboard that nobody has verified in six years.

Encrypted at rest, with your keys

The pool is fully encrypted at rest, and the distinction that matters is who holds the key.

On every major cloud service, the provider holds a key — necessarily, because that is what allows server-side indexing, thumbnail generation, and content scanning. Their encryption protects your data from a stolen disk. It does not protect it from them.

Here, the key material is generated on the machine at setup and exists in your custody. We hold no copy. There is no administrative override and no support process that can decrypt your pool, because either of those would defeat the property being sold.

The honest consequence, stated before purchase rather than after: if you lose your key material and your recovery envelope, the data is gone. Permanently. We can rebuild the machine and we cannot rebuild the archive.

What that actually holds

Not just files. The vault is the substrate the other two functions sit on.

The copies

One copy is not a backup and a vault with a single point of failure is not a vault.

Redundancy is built into the pool, so a failed drive is a replacement rather than an event — the machine keeps serving while it rebuilds, and we ship the replacement before you have noticed. Snapshots are taken on a schedule and retained, so a deletion or an encrypted-ransomware event is recoverable to a point in time rather than merely regretted.

For off-site, the recommendation is a second Desk in another building — which we will configure to replicate, encrypted end-to-end, so the second machine cannot read the first. Where that is excessive, an encrypted copy to any cloud provider works exactly as well for the purpose, because they receive ciphertext and hold no key.

Part III

The Line

Messaging and calls on the same machine, using the protocol that the entire field agrees is the standard — running on iron you own rather than on somebody's fleet.

The Signal protocol

The cryptography is not ours and it should not be. The Signal protocol is the most thoroughly reviewed messaging cryptosystem in existence, it is open, it has survived a decade and a half of adversarial attention, and it is what every serious competitor either licenses or copies.

What we change is where it runs. The protocol handles the encryption; our machine handles the routing; and because the machine is yours, the routing metadata has nowhere to accumulate.

Two properties come with the protocol itself and are worth stating because most people assume they have them and do not. Forward secrecy — keys ratchet forward with every message, so a key compromised today does not open yesterday's conversation. And encryption by default on groups, which the most widely used messenger in the world still cannot do.

No phone number

A phone number is the worst possible identifier and it is what nearly every messenger insists on. It is a SIM-swap target — an attack that works by persuading a carrier's employee rather than by breaking any cryptography. It ties an account permanently to a legal name. And it lets anyone holding the number confirm the account exists.

Identity here is a keypair generated in your device's own secure hardware. The private key never leaves it. The public key is the account. There is nothing to swap, nothing to enumerate, and no carrier in the trust chain.

Voice, video, and files

Calls are peer-to-peer where the network allows it and relayed through your own machine where it does not — which means that in the worst case the relay is a computer you own rather than a service you rent. Group video runs on the same path.

Attachments are the part people underestimate. On a hosted service, sending a large file means uploading it to a third party's storage and sharing a link that outlives the conversation. Here the file goes into your own vault, encrypted, and the recipient pulls it from your machine directly. Four hundred terabytes of storage means the practical file-size limit is the network, not a policy.

No logs

The same discipline as the rest of the house: logging is disabled at source across every layer rather than written and deleted. A log that is rotated nightly existed — on a disk, in a backup, recoverable by forensics. A log never written did not.

No IP address is recorded at any layer. Message content is held encrypted only until delivered, then removed. Calls are never recorded at any point in the path. If you were compelled tomorrow to produce every address that had connected to your machine, the truthful answer would be that you hold none.

The full architecture, including the outbound-tunnel design that means no port is ever open to the internet, is set out in The Server.

A publication, not a blog

The publishing layer is Ghost, self-hosted, in full. Not a cut-down version, not a hosted tier with features withheld — the complete open-source platform with every capability switched on, running on your machine, with no plan above it to be upgraded into.

Ghost is the right choice and the reasoning is specific. It is purpose-built for publishing rather than being a general-purpose content system with publishing bolted on. It is open source under a permissive licence with fifty-one thousand stars and a decade of production use. It is fast — Node.js and a lean data model rather than a plugin ecosystem fighting itself. And critically, it is the only serious platform whose business model does not require taking a percentage of your revenue.

What Ghost gives you

The editor

Worth its own section, because it is the surface you will actually spend your hours in and it is unusually good.

The design principle is one we share: invisible until you need it, powerful when you do. No toolbar crowding the text, no drag-and-drop page builder, no chrome competing with the sentence you are writing. It is a clean column and a cursor.

What it will do when asked is considerable. Rich content cards for image galleries, video, audio, downloadable files, bookmarks that unfurl into cards, callout boxes, accordion toggles, product cards, and embeds from anywhere. Markdown throughout for anyone who prefers to type rather than click. Drafts, scheduled publishing, and preview links you can send before anything is live.

Calm by design, with advanced workflows by default. We did not write that line, and we would have.

Members and money

The membership layer is the reason to use Ghost rather than a static site, and it is fully yours here.

Readers sign up through forms native to your own site — no third-party embed, no redirect to somebody's checkout. They become members with accounts on your machine. You can offer a free tier and several paid tiers, gate individual posts or whole sections by tier, and send different newsletters to different segments.

The list lives in your vault. Email addresses, membership state, payment history, engagement — on the encrypted pool in your own building, exportable at any moment, and not held by any company that could change its terms or lose interest in your continued existence.

The zero per cent

This is the number that decides the economics and it deserves to be stated plainly.

Ghost takes no percentage of your revenue. Not on the hosted product and certainly not self-hosted. Your only transaction cost is Stripe's processing — roughly 2.9% and thirty cents — which is unavoidable for anyone accepting a card anywhere.

The comparison is stark. The best-known newsletter platform takes ten per cent of everything, permanently. On a publication earning $50,000 a year that is $5,000 annually, forever, for a database. At $200,000 it is $20,000 a year. The Desk costs $1,333.32 a year, fixed, and takes nothing — which means the arrangement becomes cheaper than a percentage the moment your publication earns about thirteen thousand dollars, and the gap widens every year after.

Annual subscription revenue	Platform at 10%	The Desk, fixed
$25,000	$2,500	$1,333
$100,000	$10,000	$1,333
$500,000	$50,000	$1,333
$1,000,000	$100,000	$1,333

And the storage, the messaging, the archive and the machine itself are all inside that same fixed figure rather than beside it.

Design and the API

The publication looks like whatever you decide. Ghost's theme layer is a full templating system, so a design can be built from scratch rather than selected from a menu — and if you would rather not, there are hundreds of existing themes and we will fit one properly.

If you want to go further, the Content API turns the whole thing headless: Ghost becomes the writing and membership engine while the front end is anything you like. That is how you would put a publication inside an app, or drive a site set in a house design system, or feed the same text to a reader and a website at once.

There are no content policies, because there is no platform to have them. Nothing you publish can be removed by a third party's decision, and no algorithm sits between a post and the people who asked for it.

Moving in

Migration is included and it is not the hard part people expect.

From WordPress, an importer moves posts, pages, images, tags and authors, and preserves the URL structure — which matters more than it sounds, because it means existing links keep working and years of search ranking survive the move. From the major newsletter platforms, both the archive and the subscriber list transfer, including paid subscriptions, which continue billing without your members doing anything. From Medium, an export converts with a light cleanup pass.

We do the migration. You approve it on a staging copy before anything switches over, and the old site stays up until you are satisfied.

Part V

The Terms

A hundred and eleven eleven

$111.11 a month. One figure, for the machine and the maintenance of it. Cancel whenever, keep the data.

What is inside it: the enclosure and the drives, the 444.44 TB encrypted pool, the messaging server, the full Ghost installation, migration from wherever you are now, monitoring, patching, drive replacement when one fails, and a person to reach when something is wrong.

What is not inside it: your Stripe processing fees, which go to Stripe; your domain registration, which should stay in your own name; your electricity, which is a few dollars a month; and outbound email volume above the included allowance, which for most publications never arrives.

There is no seat count, no storage tier, no member limit, no bandwidth cap billed as overage, and no revenue share. The figure does not change because you succeed.

What it replaces

Worth laying beside each other, because most people are already spending more than this on strictly less.

What you pay for now	Typical monthly	On the Desk
Cloud storage, several terabytes	$30 – $200+	Included, at 444.44 TB
Newsletter and membership platform	$29 + 10% of revenue	Included, 0% of revenue
Website hosting and media	$20 – $80	Included
Business messaging and video	$15 – $30 per seat	Included, unlimited
Off-site backup	$20 – $100	Included in the pool

The point is not that it is cheaper, although it usually is. The point is that none of those five line items buys you the thing this does — and cancelling any of them costs you access to your own material.

All profit is yours

Said plainly, because it is the sentence the whole product exists to make true.

We take nothing from what you earn. No percentage of subscriptions, no cut of a product sale, no share of sponsorship, no fee on a course, no clip of a paid post. Not now and not at a threshold. The relationship is a flat monthly figure for a machine, and it has no mechanism by which your success could become our revenue.

This is not generosity, it is the design. A platform that earns a percentage has an interest in staying between you and your reader — that is where the percentage is collected. A supplier who is paid for hardware has no such interest, which is why the incentive can be aligned rather than merely promised.

There is no mechanism by which your success becomes our revenue. That is the product.

Leaving

The test of any arrangement like this is what happens when you end it, so it is specified rather than left to goodwill.

The machine is yours. Cancel the subscription and it keeps running — you simply stop receiving maintenance. Nothing is remotely disabled, no licence expires, and no software stops working. We will hand over administrative credentials and documentation on request.

The data is yours and always was. It is on your encrypted pool, in standard formats, on hardware in your building. There is no export to request because there is nothing to export it from.

The list is yours. Members, addresses, tiers, payment history — all in your own database, and your Stripe account was always in your name, so subscriptions continue billing to you regardless of what happens to us.

Part VI

Honest Costs

Six things this is worse at than the services it replaces. A page listing only advantages does not deserve to be believed.

Every one of those is the price of the same property: that there is exactly one place in the world where your material exists in readable form, and you own it. The services this replaces are better at all six and cannot offer that.

Part VII

The First Week

What actually happens between deciding and being live.

If at the end of the first conversation the honest answer is that a hosted service suits you better, that is what you will be told. Most people do not need four hundred terabytes, and we would rather say so than sell one.