Howl: Exposed

Howl is the chat product at howlpro.com, with the app at app.howlpro.com. The homepage calls it the private Discord alternative: servers, voice, video, screen share, end-to-end encrypted DMs and calls, open source, self-hostable, and "Your conversations are nobody's product." On 9 July 2026 a developer wrote that federation was in progress. The live Matrix comparison says federation is a long-term goal and is not being built. On 20 June 2026 he wrote that Howl was functionally completely ready. On 15 October 2026 the Windows build was still trying to open app.example.com.

Checked 30 October 2026. Quotes are from the live marketing pages fetched that day, the public repo Howl-LLC/Howl (default branch production, head commit 8f222c2097d9807d1c54ff1bb13e45832dded15a, pushed 15 October 2026), and posts the developers put on Reddit. Reddit's own JSON returned HTTP 403 from this network, so the comment text is the Arctic Shift copy, linked back to reddit.com. The app's legal URLs return a JavaScript shell. The privacy policy and terms quoted below are the HTML files in that commit, not a rendered view of the app. If a slop cannon can find this much contradiction, with citations, there is likely more under the hood.

What the homepage says

howlpro.com, fetched 30 October 2026, opens with "The private Discord alternative" and this line: "Everything your community needs (servers, voice, video, screen share) with end-to-end encrypted DMs and calls. Open source, and self-hostable with Docker. Your conversations are nobody's product."

The same page draws a boundary, and the boundary is real. Under "What's end-to-end encrypted" it lists direct messages, group DMs, DM file attachments, and every voice, video, and stage call. DMs use MLS (RFC 9420). "If a DM call can't be encrypted, it doesn't connect at all." The next paragraph:

Server text channels are encrypted in transit and at rest but not end-to-end, so moderation, search, and backups work.

The security page says the same thing, and so does u/MattHowlPro in post 1vkoog2 on 10 August 2026: server text channels are readable, because "Moderators cannot moderate what they cannot read." That disclosure is on the record. This page does not treat it as a hidden limit.

The rest of the homepage, the same day:

"No ads, no data sales. Revenue is subscriptions and donations."
"The whole platform is AGPL-3.0."
Self-hosting: "Every Pro feature unlocks free, with no phone-home."
Discord import: "Bring your channel history with you."

The migration guide in the repo, docs/marketing/migrate-from-discord.md, is narrower than the homepage sentence. Import is a third-party per-channel JSON export, then an upload. Text and reply threading come across. Roles, members, permissions, reactions, and voice channels do not. Attachments stay as links back to Discord. Imported messages land in server channels, which the same guide says the server can read. Up to 100,000 messages per file. The guide says this. The homepage says "bring your channel history."

The security page also says the reviews so far are internal, and that Howl has not commissioned an outside audit of the kind it cites for Discord's call protocol. The compare page says the same: "Not by a third party yet." That is a limit they print. The page's own stamp still reads "Last verified: 2026-07-10," with the rule that competitor facts are re-checked when that date moves. Commits on the repo continue through 15 October 2026. The stamp has not moved.

Federation, in progress and not being built

On 9 July 2026, u/MattHowlPro posted "Howl, here is Howl" (1ura7p8). The third sentence of the post:

Federation is currently in progress as well.

The live page howlpro.com/compare/matrix, fetched 30 October 2026, says the opposite, twice:

Federation. Matrix communities can talk across servers on the open network; Howl instances can't. Federation is a long-term goal, not something being built today.

No. Howl instances are isolated, with no bridging to other networks, and federation is a long-term goal rather than active work.

The same sentences are in docs/marketing/compare-matrix.md at the 15 October commit. A search of that tree for "federation" and "federated" in .ts, .tsx, .js, .md, and .html hits that file and docs/marketing/self-hosted-discord-alternatives.md, where Matrix is the federation benchmark. There is no federation implementation in those files. The FAQ on the live page tells a reader who wants federation today to pick Matrix.

The compare page still prints "Last verified: 2026-07-10." His "currently in progress" sentence is from 9 July 2026 and was still on the Reddit thread when this page was written.

Completely ready, then example.com

On 20 June 2026, in comment ost1i5s on r/DiscordAlternatives:

Functionally Howl is completely ready. We're ready to support users. We are ready for users to be on the app.

The same afternoon, comment ossoucg, he wrote that he was "1/2 devs," that Howl "was made publicly available in April," that it had "been in development for over 8 months," and that "We are actively working towards open sourcing as we speak." He described "a small user base consisting of friends and small communities," said they do not believe in a minimum viable product, and said the project is self funded.

The public Git history after that sentence is 28 commits on production, from the first snapshot on 30 June 2026 through 15 October 2026. Several of them are titled "Public release snapshot." Later subjects include removing non-functional items from the DM context menu (17 July, 76e07d1aa5), relaxing discovery listing thresholds "for platform cold start" (20 July, 6c9a4fc7f0), removing a demo GitHub handle from the landing showcase (2 July, f974cea33f), and stopping message edits from doubling newlines (5 October, 22baa18fc2 and e4e649e240). The one that matches a user-facing failure is the Windows installer.

Commit 8f222c2097d9807d1c54ff1bb13e45832dded15a, 15 October 2026, author name Raja Pradhan, subject "fix(electron): stop shipping example.com placeholder URLs in release builds." The commit message says the real release-config.json was removed during open-source prep, the example template used example.com, and builds since then packaged those placeholders, "so the Windows app tried to load app.example.com and failed to launch with ERR_NAME_NOT_RESOLVED." The fix refuses example.com, example.org, and example.net at build time, and ignores placeholder URLs at runtime so the app falls back to howlpro.com.

The same day, on the July launch thread, u/MattHowlPro answered the report. Comment pgw71hz, 15 October 2026, 13:14 UTC: he had not seen it happen after a download, he could not fix it until later that day, and "that should be a 2 minute thing." Comment pgx4bkl, 15:38 UTC: "The windows installer is all good now!" The commit is timestamped 14:51 UTC, between those two replies. GitHub's releases list for the repo, fetched 30 October 2026, was empty, so this check did not measure an installer file.

"Functionally completely ready" is his sentence from 20 June. The commit he shipped on 15 October describes release builds that could not resolve a hostname.

Open source, on their clock

The repo and the GitHub org Howl-LLC were both created on 20 June 2026, the day of the "completely ready" comments. The org lists one public repo. The repo's license field is AGPL-3.0. package.json at the October commit says name howl, version 1.0.5, description "Futuristic real-time messaging app," license AGPL-3.0-only. On 30 October 2026 the API reported 4 stars, 0 forks, and 0 open issues. Homepage on the repo is howlpro.com. Default branch is production.

The first commit, ce2da15bd9, is 30 June 2026, authored as sleepish: "Public release snapshot (2026-06-29): DM MLS AIK rotation-attestation chain + incident fix." On 4 July 2026, u/Spookiish wrote in comment ovf38v9:

I made howl! It's a discord alternative where users can self host, customize their experience with encryption options, and fully customize their own front end! We are going open source tonight!

The comment links app.howlpro.com. The public snapshot was already on GitHub on 30 June, four days before "tonight." Matt's 20 June comment said they were still working toward open sourcing. The 4 July sentence treats that night as the start.

"Fully customize their own front end" is the other half of that comment. The English settings string in the same tree is "Personalize your Howl experience: themes, layout density, and typography." The pricing page sells banner images, GIF banners, profile effects, name color, name font, and colored chat text on the paid rows. Matt's 9 July post says "very extensive client side customization and honestly since we are open source you can also make your own." A self-hoster can change AGPL source. This check did not find a product feature for swapping in your own front end.

The eight-month figure is also his, from 20 June 2026. Eight months before that date is October 2025. What the public record shows is later. howlpro.com was registered 18 February 2026 (RDAP: Squarespace Domains LLC, Cloudflare nameservers bradley.ns.cloudflare.com and megan.ns.cloudflare.com, last changed 18 March 2026, expires 18 February 2027, no registrant name in the response). The oldest Prisma migration in the tree is 20260213221941_init, 13 February 2026. The tree has 163 migration folders. The earliest public post this check found that points at the app is u/Spookiish on 2 May 2026, "Try Howl" (1t1v8rp), linking app.howlpro.com. "Publicly available in April" is his date. This check did not find an April page, and it cannot see private work from before the February schema.

CLA.md asks contributors to grant Howl LLC a license under AGPL-3.0 "AND under separate commercial or proprietary license terms, at Howl LLC's discretion." The LICENSE on the repo today is AGPL-3.0. With 0 forks, that second grant is a term for future patches, and the copyright headers already say "Copyright (C) 2026 Howl LLC."

Crash reporting is split in the same tree. src/sentry.ts starts Sentry for the web app only when a DSN is set and localStorage key howl_cookie_consent has analytics set to true. The privacy policy says error reports are collected if you consent. That matches the web client. main.js starts Sentry in the desktop process before the app is ready, whenever release-config.json or the environment supplies a DSN. The comment in that file says native crash minidumps upload automatically. That block does not read the cookie flag. release-config.json is gitignored and is not in the public tree. This page does not claim the shipping desktop app is uploading crashes.

Three names for one switch

English UI and the security page use two names. Self recovery is the default: the server holds nothing that can read your DMs, and losing the password and the recovery key means the history is gone. Server recovery is opt-in: you upload a server-readable copy of the vault key, and for that account the server can decrypt DMs. The security page says so. Matt's 10 August post says so: "Then we keep a copy of your keys and can rescue a forgotten password. The cost is that, that key for decryption is on our servers." The self-host guide uses the same two names.

The privacy policy and the terms, in the 15 October tree, still use the older pair. Section 5 of the policy and section 7 of the terms say "Maximum Privacy" for the default and "Secure & Easy" for the escrow. The policy's last-updated line still reads 16 June 2026. A reader who has the English settings screen open and the policy beside it is looking at two vocabularies for one toggle.

The locale files do the same split. In en-US.json and en-GB.json, encryption.maxPrivacy is "Self recovery" and encryption.secureEasy is "Server recovery." In de.json, es.json, fr.json, ja.json, ko.json, pt-BR.json, and zh-CN.json, those keys are still the English phrases "Maximum Privacy" and "Secure & Easy," and dm.encryption.pdModeLabel is still "Secure & Easy mode." The English label is "Server recovery."

The warning under that toggle is shown only while the toggle is off. components/settings/EncryptionTab.tsx renders dm.encryption.pdModeWarning when passwordDerived is false. In English, off means Self recovery, and the warning says "You are using Self recovery." In the seven other locale files, the string in that same slot still begins "Switching to Secure & Easy mode..." A German, Spanish, French, Japanese, Korean, Brazilian Portuguese, or Chinese UI shows a Secure & Easy warning in the state the English UI calls Self recovery.

The about-page copy is softer than the security page. about.securityKeysBody in en-US.json:

By default your keys are derived and stored on your device with Argon2id. Our servers store only ciphertext and can't read your DMs. Prefer recoverable backup? You can opt into encrypted recovery. It's your choice, and it's off by default.

"Encrypted recovery" is the phrase. The security page's phrase for the same option is a server-readable copy of the vault key, and the ability to decrypt that account's DMs. The about block states the ciphertext rule in the same breath as the opt-in.

The about story, same file: "Howl isn't backed by venture capital or big tech. It's built by two friends who were tired of platforms that treat people as products. We don't harvest your data. We don't sell your info. We never will." And: "no compromises on features." The values block: "No ad networks, no data brokers, no selling your information. Howl is funded by optional Pro subscriptions, not by mining you." And: "Core communication is never paywalled. Pro adds flair, not access."

Reporting a DM

On 22 July 2026, u/MattHowlPro answered a thread about Discord alternatives, comment oz3hgdt:

And reporting a dm hands key for a specific message. Chats are not backwards decrypt-able unless a user willingly opts into an optional sever held key escrow.

The escrow half matches the security page, spelling and all on "sever." The key half does not match the code, the dialog, or his own later post.

On 10 August 2026, post 1vkoog2:

Reporting: if you report a DM, your own client decrypts that one message and sends it to our moderators. Reporting is something you trigger, not something we do.

components/ReportMessageModal.tsx does that. For an unlocked encrypted DM it sets payload.plaintext to the message text already on screen. The comment above that line: "the server cannot decrypt MLS content; no encryption key is ever disclosed." The dialog text:

Reporting this message will share your decrypted copy of this single message with Howl's moderation team. No encryption keys are shared, and our team cannot read any other messages in this or any other conversation.

backend/src/routes/reports.ts stores that string with contentSource set to reporter_disclosed. The comment says there is no server-side cryptographic verification that the submitted text is the plaintext of the stored ciphertext. If the client sends no plaintext, the stored content is "[E2E encrypted - content not disclosed at report time]." If the DM channel is not marked encrypted, the same handler decrypts the stored content on the server and marks the source server. That branch runs when the channel's encrypted flag is false. The homepage says DMs are end-to-end encrypted, and the encrypted path stores only the text the reporter submitted.

What a report hands over, in the October code and in the August post, is the text of one message, chosen by the person filing the report. The 22 July comment said it hands the key for that message.

No ad networks, and the terms

Homepage, 30 October 2026: "No ads, no data sales. Revenue is subscriptions and donations." About page, about.valuesNotForSale: "No ad networks, no data brokers, no selling your information."

The terms file in the same commit, section on advertisements:

The Service may display advertisements served by third-party ad networks (currently Google AdSense).

The privacy policy is conditional: "If ads are enabled on certain pages, ad serving is handled by Google AdSense," and the processor list includes "Google AdSense: If ads are enabled." config.ts defines ADSENSE_CLIENT_ID, ADSENSE_SLOT_HEADER, and ADSENSE_SLOT_SIDEBAR from Vite environment variables. The comment: "when set, real ad slots are rendered on the home page; when unset, placeholders show." A search of the .ts and .tsx files finds those constants in config.ts and in vite-env.d.ts. No component reads them.

The content security policy in index.html allows scripts from 'self', 'wasm-unsafe-eval', https://challenges.cloudflare.com, and https://static.cloudflareinsights.com. It does not allow an AdSense host. font-src is 'self' and data:. A search of the HTML, TypeScript, JavaScript, and CSS in the tree found no fonts.googleapis.com and no AdSense host. The privacy policy still says Google Fonts may receive your IP "when fonts are loaded."

The terms describe AdSense as current. The about page says there is no ad network. This tree does not render the AdSense slots, and the policy on the app shell would block the script those slots need. The pages fetched for this check did not show ads. "We don't sell your info" is the sentence in the about story. The privacy policy is the list of what the service stores anyway.

That list, same file, effective 4 March 2026, last-updated line 16 June 2026:

Account data, including email and a date of birth used for an age check. Howl is for users 13 and older. Ages 13 to 17 confirm, with a separate checkbox, that a parent has consented. The policy says Howl does not currently verify that with a parent-side challenge. The affirmation is an attestation. Family Link tools are optional. This page did not exercise them.
A raw IP address and the full user-agent on each session record, kept for up to 90 days of inactivity, then nulled. A truncated salted hash of the IP on every login session.
"Metadata (sender, recipient, timestamp, channel ID, approximate message size) is not encrypted and is accessible to us."
Upload safety hashing: a perceptual hash (PDQ) and a SHA-256 on uploaded images, compared with a database of known harmful content. The policy distinguishes that from end-to-end encrypted DM contents, which the server cannot read in the default mode.
Sign-in with Google, Apple, or Steam, and optional links to Riot, Steam, Twitch, YouTube, GitHub, Reddit, and Spotify, plus stat APIs including apexlegendsapi.com, marvelrivalsapi.com, fortnite-api.com, and r6.arenyze.com.
Stripe for payments, Resend for email, Cloudflare Turnstile, and Sentry if you consent on the web.

Commit 2f0c665c54 on 3 October 2026 is "docs(legal): update data-provider lists for R6/Fortnite API changes." The printed last-updated date on the policy and the terms is still 16 June 2026. The body already names r6.arenyze.com and fortnite-api.com. "We don't harvest your data" is the about page. The policy is a harvest list with a sale denied. Both documents are theirs.

Flair, and the price table

howlpro.com/pricing, fetched 30 October 2026. The heading is "Simple pricing, nothing essential paywalled." The paragraph under it: "No genuine features are paywalled: the paid tiers add extras like higher-resolution screen sharing and more customization." The about string, quoted above, is "Pro adds flair, not access" and "no compromises on features."

Plan	Price on the page	Limits the table shows
Free	$0, "forever"	50MB uploads. 720p 30fps webcam. 1080p 30fps screen share. Voice at 96 kbps. 2 showcase cards. Banner color only.
Pro Essential	$4.99 a month	100MB uploads. Webcam up to 1080p 30fps. 1080p 60fps screen share. Voice at 128 kbps. 4 showcase cards. Banner image.
Howl Pro	$8.99 a month	500MB uploads. Webcam up to 1440p 30fps. 1440p 60fps screen share. Voice at 384 kbps. Up to 12 showcase cards, including a hero card. GIF banners. Profile and name effects. Custom name color and font. Colored chat text.

Voice, video, and screen share exist on the free row. The free row is a lower bitrate, a lower resolution, and a lower frame rate, and a 50MB upload cap against 500MB. Colored chat text and GIF banners sit on the $8.99 row with those caps. "Flair, not access" is their description of that table. "Nothing essential" and "no genuine features" are the heading and the deck.

The same pricing page says self-hosting unlocks every Pro feature free, with no phone-home. The security page and the self-host guide say that too, and they say voice stays off until the operator supplies LiveKit. That sentence is about an instance you run. On the hosted service, the table above is the difference between $0 and $8.99 a month. The compare pages in the repo repeat "We don't run ads" next to the "no genuine features" line. FUNDING.yml lists a Stripe donation link and leaves the other funding platforms blank, which matches "subscriptions and donations" on the days ads are not actually serving.

The company on the policy

The terms open: Howl is operated by Howl LLC, "a Wyoming limited liability company." The privacy policy, the terms, and the refund policy give this mailing address:

Howl LLC, 30 N Gould St Ste N, Sheridan, WY 82801.

Support on those pages is [email protected]. Suite N at 30 N Gould Street is the published address of Northwest Registered Agent Service, Inc. The Sheridan Press, 29 November 2024 (updated 5 January 2026), describes 30 N Gould Street as a registered-agent building used by thousands of companies. This check did not retrieve a Wyoming Secretary of State filing for an entity named Howl LLC. Other companies that use the word Howl were not matched to this one. A registered-agent address is a mailing address. It does not show that anyone on the project works in Sheridan, and it does not, by itself, say anything about the software.

Section 24.2 of the terms: "These Terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law provisions." The company in the opening paragraph is a Wyoming LLC. The governing-law clause is Delaware. Members are not named on the policy.

Section 26 is an Apple App Store section. It says "Howl, not Apple, is solely responsible for the iOS application and its contents," and it walks through maintenance, warranty, and Apple as a third-party beneficiary. The compare page, fetched 30 October 2026, says Howl is "mobile-friendly in the browser, with native apps on the way." Matt's 9 July post: "On windows and linux right now, and we are looking into mobile apps for iPhone and Android." The terms and the privacy policy both define the Service to include "our website, desktop application, mobile application." The Apple section describes an iOS app the marketing page still lists as not shipped. The opening line of each legal file does the same.

The accounts on the record

The about page says Howl is "built by two friends." The public labels are four. This page does not treat them as four people, and the repo does not say which GitHub account is which Reddit account.

u/MattHowlPro, flair "App.howlpro.com." He calls himself "1/2 devs." On 10 August 2026, comment p2vpr5g, he wrote that he manages [email protected] and that people can also write to [email protected]. On 22 July 2026, comment oz4jcu2, he wrote: "we have used agentic agents for things like boilerplate code, internal documentation, development of units in the system along with tests and debugging." He added that he and his co-founder are software engineers and that both use AI driven development at work. He said an outside audit would come as the platform matures. The security page still says the reviews so far are internal.
u/Spookiish. On 4 July 2026, "I made howl," quoted above, with the front-end sentence and "going open source tonight." On 18 June 2026, comment osh4mrr, he wrote "as someone that works in cryptography" while telling another project to name its algorithms. That is his description. This check did not verify a credential. On 23 July 2026, the day after Matt's agentic-agents comment, he wrote on a criteria thread that "The majority of programs today will have AI driven development" and that "There is a huge difference in vibe coding and AI driven development" (oza3txn), and in the next comment (oza40qo) that "Fluxer uses ai for development." Both comments are his, a day apart from Matt's, on different threads.
GitHub Rpradhan43, display name Raja Pradhan. The account was created 27 January 2023 and listed 7 public repositories when this page was checked. He is the author on the 15 October example.com commit and on the 3 October legal-docs commit. The commit object carries an email address. This page cites the commit URL and the name on the profile.
GitHub sleepish. The account was created 4 June 2015. The public profile has no name and no bio, 0 public repositories, 0 followers. Two commits on Howl are linked to that login, including the 30 June snapshot and a 2 July landing fix. Other commits are authored under the name Sleepish, or under the name Howl, with no linked GitHub user. Raja Pradhan's commits are a separate author field.

Sleepish and Spookiish are adjacent names, and Spookiish wrote "I made howl." That is as far as those two strings go. This page does not promote either pair into a legal identity.

Dates

When	What the record shows
13 February 2026	Oldest Prisma migration in the public tree, `20260213221941_init`. 163 migration folders follow. The latest folder name in this tree is `20260817120000_imagehash_filename_pattern_index`.
18 February 2026	`howlpro.com` registered. Registrar Squarespace Domains LLC. No registrant name in the RDAP response read 30 October 2026.
4 March 2026	Effective date printed on the privacy policy and the terms.
16 June 2026	Last-updated date printed on the privacy policy and the terms. Still printed on 30 October, after the 3 October provider-list commit.
18 June 2026	u/Spookiish: "as someone that works in cryptography."
20 June 2026	u/MattHowlPro: "Functionally Howl is completely ready," "over 8 months," "publicly available in April," "working towards open sourcing." GitHub org Howl LLC and the repo created the same day.
30 June 2026	First public commit, a "Public release snapshot," authored sleepish.
4 July 2026	u/Spookiish: "I made howl," "fully customize their own front end," "going open source tonight."
9 July 2026	Launch post: "Federation is currently in progress as well." AGPL, self-hosted or centralized, mobile "looking into."
10 July 2026	Date the security page and the Matrix comparison still print as "Last verified." The live comparison says federation is not being built.
17-20 July 2026	Public fixes: non-functional DM context-menu items removed. Discovery listing thresholds relaxed "for platform cold start."
22 July 2026	"reporting a dm hands key for a specific message." Same day: agentic agents for boilerplate, docs, units, tests, and debugging.
23 July 2026	u/Spookiish on AI driven development, and "Fluxer uses ai for development."
10 August 2026	Encryption post: one reported DM is decrypted by your client and sent as text. He publishes [email protected] the same day.
3 October 2026	Legal provider list updated. Printed last-updated date stays 16 June.
15 October 2026	Windows builds had been loading app.example.com. Commit `8f222c2097`. He writes that the installer is "all good now."
30 October 2026	This check. Live homepage, pricing, and Matrix comparison fetched. Repo head still the 15 October commit. GitHub releases list empty. 4 stars, 0 forks.

Sources

Opened 30 October 2026 unless a line says otherwise.

Live marketing: howlpro.com, pricing, security, compare/matrix, migrate-from-discord. App shell app.howlpro.com (meta description, and a JavaScript shell for the legal routes).
GitHub repo Howl-LLC/Howl, branch production, commit 8f222c2097d9807d1c54ff1bb13e45832dded15a. API: repo, org, commits (28), releases (empty list). Accounts Rpradhan43 and sleepish. Files cited above, at that commit: package.json, CLA.md, config.ts, index.html, main.js, src/sentry.ts, src/locales/en-US.json and the other eight locale files, components/settings/EncryptionTab.tsx, components/ReportMessageModal.tsx, backend/src/routes/reports.ts, public/_legal-privacy-policy.html, public/_legal-terms-of-service.html, docs/marketing/compare-matrix.md, docs/marketing/security-page.md, docs/marketing/migrate-from-discord.md, docs/self-hosting.md, FUNDING.yml.
RDAP for howlpro.com.
Reddit, via the Arctic Shift copy, because reddit.com JSON returned HTTP 403 from this network. Permalinks: u/MattHowlPro, u/Spookiish, posts 1ura7p8 and 1vkoog2, comments ost1i5s, ossoucg, oz3hgdt, oz4jcu2, pgw71hz, pgx4bkl, p2vpr5g, ovf38v9, osh4mrr, oza3txn, oza40qo, post 1t1v8rp.
Sheridan Press, 29 November 2024, updated 5 January 2026, "30 N. Gould St. businesses blur lines of what it means to be a Sheridan business." Used here for the building, not for any other company in that story.

Corrections

This page records what those URLs said on 30 October 2026. A later edit on howlpro.com does not rewrite the text quoted here. A correction to this page belongs next to the sentence it fixes, with the date of the check.

Correction, same day: comment oyvuptw (21 July 2026), "Check out my alternative: http://localhost:3000/", is a joke on someone else's thread. It was removed from the account section and the dates table.

Not verified, and left out of the claims above: a Wyoming Secretary of State printout for this Howl LLC, any independent user count beyond his "friends and small communities," the bytes of a Windows installer (the releases list was empty), whether a production desktop build has a Sentry DSN configured, and whether Cloudflare injects a beacon at the edge. The content security policy allows static.cloudflareinsights.com. This check did not find a beacon tag in index.html, and an allowlist is not a running script. The cryptographic design was not audited. The live app's legal routes were shells, so the policy and terms quoted here are the files in commit 8f222c2097. Production settings can differ from the tree. The self-host guide tells a Chrome user on localhost to type thisisunsafe on the certificate warning. That is Chrome's bypass, written into their doc, and it is not a claim on this page about the hosted site. Other products that use the word Howl, including tokens and unrelated apps, are out of scope. howlpro.com's own footer says the project is not a token. This page does not build a charge out of anyone else's coin.