How it works

The short version

• No accounts. No email, no phone number, no password, no cookies, no analytics.
• Your history lives on your device. Your name, scores, streaks and the calendar are stored in your browser and never uploaded on their own. Publicly you're just a random Anthropologus number.
• Friends and groups are end-to-end encrypted. Scores you share are locked with keys only the people involved hold. Our server stores the locked boxes and nothing else.
• Secrets travel in the part of a link after the #. Browsers never send that part to any server, ours included.
• Everything expires. Unanswered invites vanish after a day; shared scores after about thirteen months.

What lives where

Adding a friend

1. You make an invite

   Your device creates a one-time secret and a fresh key pair, then builds a link like ethnogvessr.com/f#v1.…. Everything after the # (the secret, your public key and your name) stays on the devices that open the link. You send it however you like; iMessage is the trust channel, and we never see it.

2. Your friend opens it

   Their device makes its own key pair, combines it with yours (Elliptic-curve Diffie-Hellman, P-256) and derives a shared pair key using HKDF-SHA-256 salted with the invite secret. It posts its public key and name back, sealed so only someone holding the invite secret can open it. The link is wiped from the address bar as soon as it's read.

3. You confirm

   You see "Ludwig wants to pair" and choose. Accepting sends a confirmation sealed with the pair key, so only the real invitee can read it. Each invite works once and dies after 24 hours, so a forwarded or leaked link can't quietly pair a stranger: you'd see their name first.

Why both a secret and key exchange? The secret proves the reply came from someone holding your link. The key exchange means that even someone who sees the link later, but not either device, can't work out the pair key.

Sharing the daily score

When you finish, your device writes one small record per friend: the date, your total, the ten round scores, your current display name and the time you finished. Each copy is encrypted with AES-256-GCM using that friend's pair key.

It's filed under a label computed as an HMAC of the date and direction, keyed by the pair key. To the server, every friend, every day and every direction looks like an unrelated random string. It can't tell that today's box and yesterday's belong to the same two people.

Your friend's device recomputes the same labels, fetches the boxes and unlocks them. Head-to-head records, streaks and the standings table are all calculated on your devices. A friend's score only appears after you've finished your own game, so nobody spoils anybody.

What our server can and can't see

Like any website, our host (Vercel) keeps standard request logs including IP addresses. We don't add anything to them, and we don't store IP addresses ourselves.

Share links are public, on purpose

"Share link" creates a URL like ethnogvessr.com/r/AgEdAAER…. The 30 characters after /r/ are the result: the date, ten scores and your Anthropologus number, packed into the link. Nothing is stored anywhere. The preview card in iMessage is drawn on the fly from the link.

Share links contain scores only: no guesses, no answers, no group names, so they never spoil the day. Anyone who has the link can read what's in it, which is why it never contains your name.

Anthropologus numbers

Your device picks a random four-digit number for you, like Anthropologus #4821, the first time you play. There's no registry: no server hands numbers out or keeps a list, so two people can occasionally share one. That's fine, because a number is only ever a label, never used to look anyone up. Your friends' devices learn your number through the encrypted channel when you pair, so when Ludwig opens your share link, his phone shows your name. Everyone else just sees "Anthropologus #4821".

The daily distribution

hbd.gg only reveals how everyone else did in exchange for a finished game, exactly as on their own site. So when you finish, your game is sent to hbd.gg once, through our server: where you clicked each round, the distance, the points, the time and a random session ID. Your name and friends are never included. If you'd rather not, don't open the results screen until the next day; after the day rolls over nothing is sent.

Groups

A group is for a group chat: one link, and everyone who joins sees everyone else's daily scores. Each group has its own random key that only members hold. The link carries a separate join secret; the server keeps the group key locked under it, so the link lets new people in. The member list and every member's daily score are sealed with the group key, filed under labels only members can compute.

Groups are permanent until their creator deletes them or the last member leaves; nothing expires while anyone is playing. The creator can reset the link at any time: the old link stops working and everyone already inside stays. Inside each group you appear under a random member ID made just for that group, so your groups can't be linked to each other or to your friends.

Linked devices

Your phone, laptop and home-screen app can be one Anthropologus. Linking works like pairing with a friend: one device makes a single-use link, you open it on the other, and you approve the request on the first. Each linked device then shares a private sync space whose secret only your devices hold. Every device keeps an encrypted, compressed snapshot there (history, friends, groups, your name and today's game), and merges the others' in.

Unlinking a device rotates the secret. The new one is sealed separately to each remaining device's own key pair, so the unlinked device can't follow anything new. It keeps whatever it already had. Your browser and a home-screen app keep separate storage, and a browser may clear a site's data after a week without a visit (home-screen apps are exempt), so linking the two is the easy way to keep your streak safe.

Removing a friend or leaving a group deletes the key from your devices; old boxes expire on their own. Clearing this site's data in your browser removes everything we ever stored on that device.

The recovery key

No accounts means no password reset. Instead you can make a recovery key: 32 random characters that unlock one encrypted box on our server holding your sync secret, your name and your Anthropologus number. The box is sealed with a key derived from the recovery key, and filed under a label derived from it, so the server can neither read it nor tell whose it is.

Save it with the Save in 1Password button (it goes straight from the page into your vault, through the 1Password extension) or copy it anywhere safe. If you ever lose every device, open ethnogvessr.com/restore; your password manager fills the key in, and this device joins your record as a new linked device.

Anyone holding the key can restore your record, so treat it like a password. When a device is unlinked, the old key is destroyed and you're asked to save a new one, because the removed device might have seen it.

It can't cost anyone money

The database runs on Upstash's free plan with automatic upgrades switched off, and the site runs on Vercel's free plan. Both stop rather than bill. We also count our own usage: at 70% of the monthly allowance the owner gets a warning, and at 90% new friend invites pause until the month resets. Existing friends keep working.

Honest limits

• This hasn't been audited. It uses standard, well-reviewed browser cryptography (WebCrypto), but the design is ours.
• A friend can always screenshot what you share with them. Encryption protects the pipe, not the people.
• If your device or browser is compromised, so are your keys. We can't help with that.
• Our server fetches and caches the faces, answers and descriptions, so your browser never asks another site for them. The one exception is the score submission described above.