RIPLEYOS — AGENT-NATIVE PRIVACY OS

Privacy isn't a setting. It's the operating system.

A no-KYC privacy OS — native desktop and browser. Ripley can plan instantly or run a real Local AI model entirely on your device, then use app-exposed skills across the whole stack. Your keys and local inference never leave the device, and nothing is ever logged.

Just tell Ripley what you want
ripley>
↵ ASK RIPLEY
Ripley Terminal — native desktop · macOS · Windows · Linux · live
Agent-native Native or in-browser Monero-native Private Local AI Panic wipe
TWO WAYS IN

Run it in a tab. Or run it for real.

The browser gives you the whole OS and WebGPU Local AI in one click. Ripley Terminal takes it further with a native-accelerated model runtime, embedded Tor, your own Monero node, and a wallet that lives on your machine.

In the browserLive now
  • Zero install — boots in a tab at app.ros.rip
  • WebGPU Local AI — Qwen3.5 2B free, 4B with Pro on supported hardware
  • Model downloads only after consent and can be removed at any time
  • First-party APIs ride their .onion on Tor Browser
  • Real-time feeds are limited over Tor — WebSockets can't tunnel
Launch in browser →
On the desktopLive now
  • Native Local AI — Metal-accelerated on macOS, with the model kept ready in memory
  • Real embedded Tor — route requests without relying on browser proxy support
  • Your own Monero node and an on-device wallet daemon
  • Native confirm-to-sign — nothing spends without a tap
  • The same app skills and safety gates across Planner, Local AI, and BYOK
Download Ripley Terminal →
macOS · Windows · Linux · live
LIVE — NOT A SCREENSHOT

The whole OS, running right here.

This is the actual RipleyOS — the real thing, booting live in the frame below. Open apps, generate a key, poke around — it all runs on your device, and nothing you do here is stored anywhere we can see.

app.ros.rip
LIVE
ghost@ripley:~$ boot
loads the live desktop in this frame
RIPLEY — THE AGENT

Tell it what you want. It can think right here.

Ripley can use the instant private Planner, a real Local AI model running on your device, or your own OpenAI-compatible provider. Every backend sees the same app skills and waits for confirmation before sensitive actions.

Natural-language commands“Long 5× ETH with 200 USDC” · “swap 0.1 BTC to XMR, best no-log rate” · “set a stop at $3,200.”
Acts across appsOne instruction can charge from Monero, open Markets, place the trade and report the txid — surfaced as an action chip.
Confirms, then signs on-deviceRipley never moves value silently. It shows the exact order and waits for you; keys never leave the device.
Planner, Local AI, or BYOKStay instant with the Planner, download Qwen3.5 2B free, unlock the larger 4B model with Pro, or bring an OpenAI-compatible key.
Same skills, same safetyLocal AI can query Markets, read public webpages, and call every app-exposed skill. Confirm-required tools still stop and ask you first.
Rripley — agent consoleTHINKING
ripley> long 5× ETH with 200 USDC, best no-log rate
routing 200 USDC from XMR via Swap Engine
signing on burner 0x4a…7xJk · on-device
◧ OPENED MARKETS · LONG 0.06 ETH · 5×
est. liq $2,910 · taker fee $0.07 — open it?
RIPLEYOS PRO · LIVE

More capability. The same privacy boundary.

Pro unlocks the larger on-device Local AI model and every Pro shell while membership is active. Free Local AI and free skins stay free.

4B
Qwen3.5 4B · Local AIPro

A larger on-device model for stronger tool selection and conversation. It uses WebGPU in supported browsers and the native accelerated runtime in Ripley Terminal; prompts and inference stay on your device.

LumenPro
Menu bar · dock · launchpad

macOS-style chrome, traffic lights, app menus, soft aurora desk.

FreeMintPro
Floating glass taskbar

Linux Mint–inspired glass, mint accents, leaf vector desk, Windows captions.

OrchidPro
Win11 Fluent · centered

Mica-style bar, violet haze, Fluent panes on a vector desk.

XP ProPro
Luna blue · classic Start

Nostalgia shell with Bliss-style hills (day) or night Luna (dark).

GNOMEPro
Top bar · Activities

Adwaita blues, overview launcher, no bottom taskbar — clean and calm.

SakuraPro
Cute pastel · soft bounce

Pill taskbar, candy dots, blossom vector desk — soft motion when enabled.

Qwen3.5 2B and the Monero, Amber, Ice, and Matrix skins remain free. Pro and lifetime shell unlocks live in the Store; pay in crypto.

MARKETS

Trade perps, predictions & stocks. No KYC, no account.

RipleyOS brings perps, prediction markets and tokenized stocks into one terminal. Fund from Monero through the no-KYC Swap Engine into a burner you sign on-device, then sweep back when you’re done. The burner separates venue activity from your long-lived RipleyOS identities.

app.ros.rip/markets
SOLO APP
ghost@ripley:~$ open markets
one app, standalone — like a normal application

Perps Hyperliquid

Market, limit & TWAP orders, leverage, TP/SL and a live order book — on crypto and equity perps. Margin posted in USDC, sourced from your privacy coins.

Predict Polymarket

Binary, multi-outcome and 5-minute price markets with live probability charts. Settle in USDC, signed on a burner — no account at the venue.

Stocks Tokenized

Buy tokenized equities — AAPL, TSLA, NVDA, SPY and more — as real on-chain tokens. Pay in USDC sourced from Monero; the trade routes and settles on-chain, no brokerage account.

ONE OS, OR ONE APP

Every app also runs solo.

Boot the full desktop — or open one app at its real window size. Your on-device identities and local state remain available; only the desktop shell stays out of the way.

THE MANIFESTO

Built to forget you on purpose.

Most software is designed to remember everything about you. RipleyOS is designed to remember nothing — because what doesn't exist can't be leaked, sold, or subpoenaed.

01

Local-first, always

Everything runs in your browser. No backend account, no cloud sync, no server holding your data. Close the tab and the surface area for surveillance closes with it.

02

Keys never leave the device

Your Nostr identity and separate PGP keyring are generated and held on-device. Messages and Local AI inference stay local — there is no plaintext or prompt history on our side to hand over.

03

Monero-native money

Payments default to Monero, with Bitcoin, Lightning and USDT supported across pay, mail and swap. Spend and receive without a paper trail or a KYC gate.

04

Disappear on command

One action wipes every key, message and file from the device. panic isn't a feature bolted on — it's a first-class part of the system.

THE TOOLKIT

A full desktop of private tools.

Agents, communication, money, identity and daily work — device-local where that fits, with explicit network boundaries where a service is required. Nostr, PGP, Vault and anonymous-room keys stay separate by design.

Ripley On-device

Use the instant Planner, downloadable Local AI or BYOK. Every backend sees app-exposed skills and shares the same confirmation gates.

Auto Grants

Create budget- and run-capped recurring or price-triggered buys of XMR and supported tokenized stocks. Ripley Terminal also adds native XMR sell grants.

Markets No-KYC

Explore Hyperliquid perps, Polymarket predictions and tokenized stocks from one terminal. Trading uses a separate on-device burner.

#
Chat Encrypted

One app for anonymous rooms with rotatable room identities, Nostr DMs and optional end-to-end PGP Ghost channels.

Ghost Mail No-KYC

Free burner inboxes plus persistent paid identities with aliases, replies and attachments. PGP decryption happens on-device when enabled.

Identity Keyring

Manage the Nostr key behind social and Pro access, plus a separate PGP keyring with Shamir backup. RipleyOS warns before a destructive Nostr reset.

Swap No-KYC

Compare live routes by privacy grade, rate and speed; create a no-KYC order, then fund its provider deposit yourself or from an eligible burner.

Nostr Social

Follow people, publish signed notes, reply, react and manage profiles across multiple relays. Your Nostr secret remains on-device.

Vault Encrypted

A passphrase-encrypted AES-256-GCM store for secrets, with auto-lock and clipboard clearing. Its passphrase is separate from Nostr and PGP.

🗓
Planner Local

Encrypted to-dos, timeline blocks, recurring tasks and reminders. Uses session encryption or a non-extractable device key.

Privacy Audit

Audit network posture and local data, run a WebRTC leak test, wipe one category or panic-clean the device.

Store Pro

Install apps, unlock shells, manage Pro and Local AI 4B, or buy gift cards, prepaid products, eSIMs and SMS with crypto.

2FA Auth · Pay · Dead Drop · Wallet · Browser · Files · Contacts · Crypto Toolkit · Dev Center and more — a full system, not a demo.
HOW IT HOLDS UP

Privacy you can verify, not just trust.

E2E Nothing to subpoena

Keys are generated and held client-side. Encryption and decryption happen in your browser, so there is no plaintext and no server-side copy to compel.

OPEN Standards, not silos

Built on PGP, Nostr and Monero — open protocols you can audit and route yourself. Drop-in module, no proprietary lock-in.

0 No accounts, ever

There is no sign-up, no email, no phone number. Your keypair is your identity — create it, back it up, and carry it anywhere.

QUESTIONS

The fine print, in plain words.

01Do I need an account?+
No. Your on-device Nostr key is your social identity and derives an unlinkable subject for Pro membership; PGP remains a separate encrypted-communications key. There is no email, phone number, or server password.
02Where is my data stored?+
Locally, in your browser, encrypted at rest. Nothing touches a server we control. Wiping the device — or hitting panic wipe — removes it for good.
03Is it really no-KYC?+
Yes. Swap, Ghost Mail and payments require zero identity verification. You never upload a document or confirm a phone number.
04What coins and chains are supported?+
Monero-first, with Bitcoin, Lightning, and USDT on TRON and Ethereum across Pay, Ghost Mail and Swap.
05Is it open and self-hostable?+
RipleyOS is built on open protocols and ships as a drop-in module. Run it from app.ros.rip or host it yourself — the encryption happens client-side either way.
06What if I lose my key?+
Back up the Nostr nsec shown in Identity: it restores your social identity and access to any Pro membership derived from it. Back up the separate PGP key too if you use encrypted Ghost channels. There is no recovery email, by design.
07Does Ripley act on its own?+
No. Ripley drafts the action from your command — routing funds, opening an app, building an order — but it always shows you the exact details and waits for an explicit confirm before anything is signed. Signing happens on your burner, on-device.
08Can I run just one app instead of the whole desktop?+
Yes — that's solo mode. Open any tool standalone at app.ros.rip/<name> (e.g. /markets) and it loads as its own application, sized for that app, with the same on-device identities and local state — without the desktop shell.
09Does Local AI download automatically?+
No. RipleyOS first checks device support, names the third-party model hosts, shows the download size, and asks for explicit consent. The model can be removed from Agent Settings at any time.
FOR BUILDERS

Ship an app. Install it on the desk.

Dev Center lives in the OS as a solo app — the open-app standard, a sandbox demo, and install flow. Start at app.ros.rip/devcenter.

Open Dev Center → solo · app.ros.rip/devcenter

No accounts. No logs.
No trace.

Open the desktop and generate your first key. It takes about ten seconds.

Launch RipleyOS →