The things organizers ask first.

No. They paste a join code and they're in — the Tor connection, the credential exchange, and the keys are all handled for them. The hard part is hidden.

No — and not even you, which is the whole point. Your issuer key signs a member's request without seeing what's inside it, so the approval you granted and the posts they write are two facts that can never be joined up, even by the person running the relay. The mechanism is on the privacy page.

Not the way you'd expect. You can hide their content for every conforming client, and the dashboard can rotate the community credential to force everyone to re-enrol. What you cannot do is make the relay refuse their next post — it can't tell which post is theirs. Hides, bans and reports are advisories that conforming clients honour; a modified client can ignore them and keep publishing.

Authorship-blindness and server-enforced expulsion are mutually exclusive. Stiq chose blindness, and moderation therefore constrains what members see, not what the relay accepts.

You build and sign the app for your community and hand it out yourself; no signed build is published with the source. One build joins any community, so this is a one-time job — but keep the signing key safe. Swapping it later forces members to uninstall, and an uninstall destroys the identity held in their device's secure store.

The app and the source are free and MIT-licensed. You pay only for the server your relay runs on — a small VPS is a few dollars a month, or nothing at all if you host on hardware you already own.

Members keep reading either way — everything already fetched sits in an encrypted cache on their devices. And a community doesn't have to live on one box: the organizer can publish mirror relays, and the app reads from the primary and every mirror at once, switching over on its own if one goes quiet. Run a single relay and pulling the plug stays a real off switch; add mirrors and the community outlives any one machine.

None of it. Stiq invents no cryptography and no routing: it's Nostr over Tor v3, with standard NIPs for posts, comments, DMs, channels, groups and events, and RFC 9474 blind signatures for membership. The whole thing — client, relay, issuer and installer — is MIT-licensed and readable end to end at github.com/olightening/stiq-source.

Your events are ordinary Nostr events, and the whole stack is yours to run and fork. Be clear-eyed about one thing, though: writes are admitted by your community's blind credential, so “point it at another relay” isn't a switch you flip. What you're not locked into is a vendor — there isn't one.