Runs on your side
Core features execute on your device. The platform supplies the runtime and the boundary, not a place your work has to live.
- computes on device
- works offline
- exports on demand
croftry.com
Small tools, worked by hand,
and taken home to run.
Independent makers bring tools to the bazaar. Every one is struck with a mark before it reaches you — measured from the shipped build, not from the maker's description. You open a link and take the tool home.
In plain terms
the same claims, without the metaphor
- local-first
- Computes on your device. The data stays there.
- web app
- Opens from a link. Installs nothing.
- offline
- Keeps running with the network off.
- sandboxed
- Runs on its own origin, inside a frame the shell controls.
- declared egress
- Lists every host it can reach, before it ships.
- export
- Hands your data back in a format you can read.
running defaults
What every tool here has to do
Four running defaults. They are not claims about intent — each one is a property the platform measures and the mark records.
Declares where it reaches
Every outbound address an app can reach is declared before it ships, and the shell enforces the declaration at the origin boundary.
- declares egress hosts
- brokered or direct, stated
- blocked by default
Waits to be approved
Capabilities that touch a camera, a file, or a machine on your network stop at a prompt. Grants are listed, and they are revocable.
- prompts per capability
- lists every grant
- revokes on request
Takes the short route
When an app can reach your machine or your network directly, nothing relays through a server. Where a broker is used, the mark says so.
- direct where possible
- relay is marked
- route is legible