Trust
Don't take our word for it. Take the wire's.
No company vouches for anyone here. What you can do instead is look: every claim on this page is one you can check in your browser's network tab during a session.
What crosses
Between two phones, through one small function, for the length of a session:
- A six-character session code.
- Two names, if typed. Neither is required.
- What was asked for: four head moves, a stamp, a place — as words.
- The guest's answer: one word about a place (yes / no / can't say). Never a position. Whether the moves happened is not something the guest's phone gets to say — see the frames.
- The stamp — a 360×480 duotone still with the code pressed on it — once, deleted the moment the host has seen it.
- The four moves the host drew, revealed at Start, and a nonce that ties the answer to them.
- Up to twenty-five small frames of the guest — five holding still, up to five per move — 256 px, plain JPEG, measured on the host's phone and deleted the moment that is done. No template is ever sent by the guest; if the host holds a photo, the comparison happens on the host's phone from those frames.
- A second stamp, taken mid-move at a moment the guest did not pick, seen once like the first.
- One word about the guest's camera — phone, webcam, virtual, unknown — as the browser reported it.
- The host's verdict: accepted, or ask again.
Everything is dropped two minutes after either side goes quiet, and outright when either side presses Done. The server keeps no log of sessions — with one exception for accounts: when a signed-in host accepts a signed-in guest, a row records that, with the code, so the "Verified N×" beside a name is a count of real acceptances and nothing more.
What never leaves your phone
- Your camera feed. The face is found and measured in your browser; no frame is uploaded.
- The raw picture. The stamp is cropped and tinted on your phone before anyone — you included — sees it. A plain photo never exists.
- Where you are. Your phone answers yes or no about a city the other person named. The coordinates are read and dropped in the same breath.
- The reference photo the host holds. It is read on their phone and stays there.
How to check: open a session, open your browser's developer tools, watch the requests to /.netlify/functions/room. What you see is the list above, nothing else.
What it proves, and what it doesn't
It proves that a live human was on the other end, moments ago, doing what you asked in an order you chose — and, if you held a photo, that the face measured like the one in it.
It does not prove who they are, that they are honest, or that a good real-time face swap could not pass the moves. That last one is why the stamp exists: a still, at a moment they didn't pick, for your own eyes. A pass is a signal. If money is involved, it is one signal.
Accounts, if you want one
Optional, everywhere. A passkey account keeps your name and a count of times you've been accepted by a signed-in host. Linking BankID stores only a salted hash of the personnummer, your given name, and the date — enough to make one person one account, not enough to identify anyone from what's stored.
Accounts live in a database in the EU. No analytics, no advertising, no third-party scripts beyond the face-detection library, the passkey helper and the fonts.
Found a hole?
Tell me first, and give me a few days before you tell anyone else. Anything that lets a face or a location cross that shouldn't, or lets a claim pass that shouldn't, is what I most want to hear about.
What is deliberately not fixed yet is listed too: a good real-time face swap can follow a head turn, so the moves prove a live person, not that the face is theirs. The stamp — a still at a moment they didn't choose — is your eyes' check on that, and it is not automatic.