Your thoughts stay the way you wrote them
When you save a thought in Origo, it becomes permanent. We do not edit it, and neither does anyone else. If you later change your mind, Origo records the correction as a new entry that points back to the original. Nothing is quietly rewritten. Your record grows, but it does not shift underneath you.
That is a promise every company makes. What follows is how you can check ours.
Why a promise is not enough
Most services that hold your data also hold the only record of whether that data changed. If something were altered, whether by mistake, by a bad actor, or by a company under pressure, you would have no way to know. You are asked to take their word for it.
We think that is backwards, especially for a system built to hold the things you cannot afford to lose.
How it works
Three steps, none of which require anything from you.
Every entry gets a fingerprint. When you save a thought, Origo calculates a short code from its contents. Change even one character and the code changes completely.
Each fingerprint includes the one before it. Entries are linked in a chain, where every link depends on the link before. You cannot alter one entry, or remove one from the middle, without breaking every link that follows. There is no quiet edit.
The chain is witnessed outside Origo. Each day we take a single summary value representing the whole chain and place it somewhere we cannot reach back into and change. It goes to you directly, and it is stamped by an independent service that records the date. Later, anyone can compare today's record against what was witnessed months ago. If the two disagree, something changed, and it will be obvious.
That last step is the point. It moves the guarantee out of our hands.
It reveals nothing about you
The value we publish is a string of characters calculated from your history. It cannot be reversed. Nobody can read a word of your Chronicle from it, or work out how much you have written, or when. It is safe to publish precisely because it carries no meaning to anyone but the person checking it.
This has already been checked, from outside Origo
On 1 September 2026, the chain described above was published: witnessed, and timestamped by an outside authority. On 3 September 2026, a separate tool, one that needs no account and makes no network request, read that publication's export and receipt bundle and confirmed it, using only those two files.
That is not a claim in a policy document you will never read. It is a dated check, against a real publication, that anyone with the tool and the two files could repeat.
What is not yet true: that you can obtain your own bundle and run that check yourself. Today the bundle is produced by a founder-operated export; a self-serve way for you to get yours does not exist yet. Until it does, this section describes what has been checked, not what you can check.
What we do not claim
Nobody can make data impossible to alter. Anyone who tells you otherwise is overselling.
What we can do is make alteration impossible to hide. That is a meaningful difference, and it is the honest version of the promise. Origo is tamper-evident, not tamper-proof. If something changed, you will be able to tell, and you will not need to trust us to find out.
There is one limit worth stating plainly: the witness runs on a schedule, so there is a short window between one record and the next. We tell you what that window is rather than implying it does not exist.
Why this matters
Memory is only worth keeping if it stays true. A record you cannot verify is a record you have to take on faith, and faith is a lot to ask of software.
This is what lets you put something down and stop carrying it.