Mirai Guide: a globe of where people came from, without tracking anyone

The physical exhibition has a wall map where attendees stick a pin on where they travelled from. The digital version is a rotatable globe with one dot per attendee, coloured by the character they picked. Building it meant answering a question the wall map never had to: how do you collect “where I’m from” without making everything else that device ever said geo-attributable?

Three identities, deliberately separate

The device already held two keys. An Ed25519 report key signs crowd reports, and its reporter hash trails across every stock report, queue report, and comfort pin that device files. A separate telemetry install id exists under a published disclosure promising it collects no location.

Binding a home region to either one would break something. Signing “I’m from Seoul” with the report key would make every stock report that device ever filed geo-attributable in the same table space. Attaching it to the install id would contradict a disclosure about to be published.

So the globe gets a third keypair, generated on first pin. The cost is real and accepted: the community plane inherits no trust history from the report plane. That is fine here — there is no consensus to weigh, only presence.

Coarse by construction, before signing

The wire payload never contains the raw tap point. The client snaps the location to a fixed global grid roughly 100 km on a side before signing, and only the cell id travels. The displayed centroid is derived from the cell id, never from anyone’s tap.

The grid is one degree of latitude by one degree divided by the cosine of latitude in longitude, so cells stay near-equal-area instead of collapsing into slivers near the poles. The cell id carries a version prefix, so the scheme can change without silently reinterpreting old rows.

The property that matters: a dot always means “somewhere in this cell”, never “this person’s town” — and that holds even if the table leaks. That is the difference between a privacy policy and a privacy property.

Counts are presence only — a global total and a per-cell total, with no per-character breakdowns anywhere and artifact counts capped. The character vocabulary is a closed set derived from the existing roster table rather than copied, so keys and localized names stay single-sourced, and the server validates against it.

The disclosure gates the deploy

Collecting per-item purchase facts changed what the telemetry disclosure had to say, so the disclosure was made a release gate: the feature does not reach production before the section is live in every offered locale. It states that the id is anonymous and not linked to crowd reports, that per-goods purchase facts are collected, that the data is retained beyond the event because the second purpose is a corpus for better stock prediction, exactly what is not collected — no identity, cart contents, prices, location, or search text — and that an operator can switch collection off.

The retention line is the one a boilerplate notice would miss, and it is the one that makes the second purpose honest.