Sheet 10 · Anonymity

How anonymity works.

When you answer a room’s question or write on the wall, no one can tell it was you. Not other visitors, not Noah, and not me, even with the whole database open in front of me. I’m 3eyes, the artist who made the Ark. Here’s what I keep, how it works, where it falls short, and how you can check.

What I keep when you answer

This is an answer as it’s stored: every column, nothing left out. The words are made up; the rest is exactly the shape of a real one.

id: "4b6f0d2e-9a1c-4f6e-8d3b-2c7a5e9f1b08"A random number. It isn’t a count, and there’s no time hidden in it.
prompt: "laundry"Which room’s question it answers.
status: "SHOWN"Waiting for Noah, shown, or left out.
text: "I tell everyone I’m vegetarian. I have a bacon sandwich in the car every Saturday."The words.
to: nullWho it’s to, for the questions that ask.
choices: []The boxes ticked, for questions with a list.
value: nullA number, for questions that ask for one.
data: nullAnything else its kind of question needs: a height and weight, two countries, a picture’s file.
titleKey: nullFor the film and TV questions: which title on the list it counts for.
reason: nullWhy it was left out, if it was. Only I see this.
screenedBy: "NOAH"Who let it go up: Noah, or me.
screenedAt: "2026-10-15T14:30:09Z"When Noah read it. Noah reads in rounds, every quarter of an hour, so this says which round, not when you wrote it.
ownerHash: "9f2c6b1e…a4d07"A fingerprint of a key only your browser has. It lets your browser find this answer again. Nothing else can.
revision: 0How many times you’ve changed it since.
seq: nullFor the phone passed between strangers: a reply’s place in the conversation, given when Noah lets it in, so it says nothing about when it was written.
day: 2026-10-15The day you gave it. Never the time.

That’s all of it. A writing on the wall keeps less: the words, the day, and whether Noah let it up. A search history is kept only until Noah has read it, then all but a few searches are deleted, and those few are kept with the day and nothing else.

What I don’t keep

Your account
Nothing in an answer points to who you are, and nothing anywhere else points to your answers.
Your email address
It’s only used to sign you in and send you what you asked for.
Your IP address
The address your internet connection uses. I don’t store it with anything you give.
The time
Only the day. Answers from the same day are kept in no order at all.
Your device
No device id, no browser fingerprint, nothing that says which phone or laptop it came from.

I don’t keep a list of what you’ve answered, either. Your own answers are on the browser you gave them from, and nowhere else, which is why your account page no longer lists them.

How the tickets work

When you sign in, your browser gets tickets that I stamp without being able to see them. You hand one in with each answer. I can check the stamp is mine, so I know a member wrote it, but I can’t tell which member, and nor can anyone with the database.

01
Once a day, your browser gets tickets
One for every room’s question, one for the wall and one for the search history. It always asks for the whole set, so asking says nothing about what you’ll do with them.
02
I stamp them without seeing them
Your browser wraps each ticket in a random number only it knows, like an envelope lined with carbon paper. I stamp the envelope without opening it. All I write down is that your account had today’s tickets.
03
Your browser unwraps them
The stamp comes through onto the ticket and is still good, but I’ve never seen the ticket itself, so I can’t match it to any envelope I stamped.
04
You hand one in with each answer
Your browser sends the ticket with your answer and without your sign-in. I check the stamp is mine, cross the ticket off so it can’t be used twice, and keep the answer. One ticket per question a day is also how I stop anyone answering the same question over and over.

For the technically minded: the stamps are partially blind RSA signatures (RFC 9474, with the public metadata of the IETF draft on partially blind RSA). Each stamp is tied to what its ticket is for and the day, so a ticket for one question can’t be used for another, and an old one isn’t taken.

How Noah still knows you took part

Noah’s opinion of you counts how much you’ve given aboard. When you hand in a ticket, your browser also gets a receipt, stamped the same blind way, that says only “an answer” or “something else”, a writing on the wall or a search history, without saying which. On a later visit, at least two hours later and up to a day, your browser hands its receipts in while you’re signed in, and your count goes up. I learn how many things you’ve given, never which, and the wait means the timing doesn’t give it away.

Your answers live on your browser

Your browser keeps a private key for each of your answers. That’s how it shows you what you said and whether it’s gone up, and lets you change the ones you can change: the same day straight away, on a later day with that day’s ticket. Clear your browser’s storage, or use another browser, and those keys are gone. Your answers stay aboard, but no one, you included, can pick them out again.

The limits, honestly

No system is perfect. These are the ways this one can fall short.

My host’s logs
Vercel, which runs the site, keeps a log of requests for a short time: the address each came from, the page it asked for, and when. It doesn’t show your account or your words, but on a quiet day someone with those logs and my database could try to match them up. I don’t copy them anywhere.
Someone watching as it happens
Everything here is about what’s kept. Someone who could watch the site’s traffic or the database minute by minute could see a member sign in and an answer arrive soon after. On a busy day that tells them little; on a quiet one it might tell them more.
My database’s history
The company that hosts my database keeps a short history of changes, so mistakes can be undone. That history knows roughly when each answer arrived, though still not who sent it.
The AI that reads answers
Before words go up, an AI model reads them to keep out anything nasty. It sees the words and the question, never a name or an account.
Votes and arcade names
Your votes and your arcade high scores are linked to your account on purpose. They’re public, under the name you chose.
What you write
If you put your own name, or something only you would know, in an answer, that’s yours to give away. I turn away email addresses, phone numbers and @handles I can spot, but I can’t catch everything.
Quiet days
I keep the day, so if only one person answered a question on a given day, that answer is the only one from that day. The more people aboard, the safer everyone is.
Pictures
A picture you give is stored as a file, and the file store notes when each file was saved.
One browser a day
Each day’s tickets go to the first browser that asks. If you clear your browser’s storage, or switch to another one, you’ll have to wait until tomorrow.
Trusting the code
All of this is what the site’s code does, and whoever runs a site can change its code. The checks below are the parts you can test without trusting me.

How to check

My public key is at /api/tickets/key. Its fingerprint is cc62a3f88223cb57, a 2048-bit key. It only changes if I replace the key, and then every ticket already given out stops working.

Anyone with a ticket and that key can check a stamp. Your browser checks every stamp it’s given against the published key and throws away any that don’t match. Compare the fingerprint here with a friend’s, and you’ll know you were both given the same key.

In your browser’s developer tools, open the network tab and answer a question. The request goes to /api/answers/… with no cookie, carrying your answer, a ticket, the fingerprint of your browser’s key and a sealed envelope for a receipt, and nothing else.

Someone reading the site’s code would need to look at these files:

prisma/schema.prismaThe tables. Answer, WallWriting and SearchSubmission have no account column; TicketBatch, SpentTicket and RedeemedReceipt are all the tickets leave behind.
prisma/migrations/20261015130000_anonymous_content/migration.sqlThe change that took the links out, for good, from everything given before.
lib/tickets/tickets.jsGiving out tickets, checking and crossing them off, and counting receipts.
lib/tickets/keys.jsThe stamp itself.
lib/tickets/pbrsa.jsThe envelope, as your browser makes it, and the check it makes on every stamp.
components/world/tickets.jsYour browser’s wallet: what it sends and when, and that answers go without your sign-in.
lib/answers/answers.js, lib/contributions/wall.js, lib/contributions/searches.jsKeeping what you give, with the day and nothing else.
lib/contributions/rounds.jsNoah reading in rounds, and the tables being reshuffled, so even the database’s own bookkeeping forgets the order things came in.

Every room aboard asks one question. No one will know which answers were yours.

Board the Ark Your account