Once your data is out there,
can you ever really revoke it?

The Idea

Revocable links. Instead of handing over copies of your data, you share a live link to a master copy you host and control. Update it once and it syncs everywhere — revoke it, and their access is gone.

Explore the idea

An early research idea we're just beginning to explore — not a product. No software yet.

The Problem Today

Scattered & Trapped

You fill out forms. Your data is permanently copied and stored in thousands of vulnerable databases.

You have zero visibility into who holds your data.

Impossible to update everywhere when your info changes.

You can't truly delete it once it's sent.

The Idea

Sovereign & Revocable

The idea we want to test: you keep the master copy, others link to it instead of copying it, and you hold the kill switch.

Update your info once — the live link could keep everyone in sync.

One place to see exactly who has access, right now.

One click to revoke access — and trigger deletion downstream.

Open Questions

The hard parts to dig into.

If revocable, self-hosted data sharing is ever going to work, these are the problems it runs into. Think of them as directions for the research — open questions to explore, not a list of features that exist.

Just an idea, for now

Revoked is an early research idea, not a product. None of these directions are built yet — they simply map out where the exploration could go.

End-to-End Encryption

Could the Hub store your data without ever being able to read it? One direction to test: a zero-knowledge design where everything is encrypted client-side before it arrives.

Federated Mesh

How would independent, self-hosted hubs talk to one another safely — using verified domains and public-key cryptography?

DNS Verification

Could cryptographically tying a hub to a domain give requests a trustworthy, phishing-resistant identity?

Mobile-First Enclaves

Would dedicated mobile apps — leaning on OS-level secure storage — be a safer home for keys than a browser?

Multi-Organization RBAC

How should access control work when one person moves between personal and organizational spaces?

Deep Bookmarking

What would it take to keep an honest, tamper-evident record of every data flow into and out of a hub?

Live Telemetry

Can a hub reliably track the state of each share — active, paused, revoked, stale — and flag anything that looks off?

Temporal Hooks

Could the system nudge you before time-sensitive entries (like a passport) quietly go stale?

Once your data is out there, can you ever really revoke it?