The local-first bet
Local-first software keeps the primary copy of your data on your device, treats the network as an optimization, and hands you your data as something you can hold. The term comes from Ink & Switch's 2019 essay and named a movement that had been waiting for a name; the essay and localfirstweb.dev map the wider ecosystem.
Most software makes local-first claims aspirationally. selfstore exists so an app can make them demonstrably: each commitment below is checkable against an artifact, not a promise.
No server anywhere in the loop
Save, backup, restore and merge all run in the browser. There is nothing to host, nothing to subpoena, nothing that sees the data. Not "minimal backend": none.
The user owns a real file
A backup is a genuine ZIP a person can hold, move, and open elsewhere. Unencrypted, any archive tool reads it. Encrypted, it still says what it is in cleartext.
Encrypted the moment it leaves the device
Sealed at rest under a per-device key, then AES-256-GCM over Argon2id the instant data heads for a file or a cloud. The storage provider holds opaque bytes.
Offline is the normal case
The working copy is IndexedDB. The network is an optimization: durable homes and merges catch up whenever the device is back online. No spinner waits for a server.
Leaving is easy, verifiably
The format is specified independently of the library, with test vectors and a Python reference reader. Files written years ago still read; newer files are refused honestly.
What we do not claim
Honesty is a feature with a spec, too. selfstore does not do real-time collaborative editing (embed a CRDT document for that; it travels happily inside a snapshot). It does not handle multi-gigabyte archives: everything fits in memory, by design, for personal-app scale. It keeps no history: last-writer-wins is final locally, and dated backup copies are the honest time machine. And client-side encryption does not defend against malicious code inside your own origin: the threat model states the non-goals in writing.
Why a library, not a platform
The local-first movement does not need another cloud with better adjectives. It needs the boring-but-hard parts, a file format, correct crypto, a deterministic merge, a lifecycle, solved once, small, MIT-licensed, and specified so thoroughly that replacing the library is easy. That is the bet: infrastructure you cannot be locked into, because the spec outlives the implementation.