Proof of Activity

Every activity you record on FlowStake is checked before it counts. Not by an honour system, and not by trusting the number your phone reports — by examining the recording itself for the physical signatures of a real human moving through real space.

This page explains how that works, what it catches, and — just as important — what it cannot.

Why this exists

Almost every fitness platform takes your word for it. You finish a run, the app records a distance, and that number is treated as fact by leaderboards, streaks and challenges.

That works fine until something depends on it. The moment an activity carries weight — a competition, a group goal, a workplace programme — self-reported data stops being adequate. Screenshots can be edited. Location can be simulated by apps built for exactly that purpose. A treadmill and a phone in a car produce data that looks similar to a distant reader.

FlowStake's position is that a fitness record is only as useful as the evidence behind it. So instead of asking whether you say you ran, we ask what the recording itself can demonstrate.

What gets checked

Verification runs in two layers. The first is a set of hard checks — physical impossibilities. Failing one doesn't lower your score; it disqualifies the session outright.

• Speed ceilings, per sport. Every activity type carries its own plausible maximum. A run that reports 30 m/s is not a fast run, it's a car. A cycling session is held to a different ceiling than a swim, because the honest ranges genuinely differ.
• Position accuracy. Fixes reported with poor accuracy are down-weighted or discarded rather than silently folded into your distance.
• Continuity. Long unexplained gaps, teleports between consecutive fixes, and timestamps that run backwards are all disqualifying.

The second layer produces a confidence score from signals that are each individually forgeable but difficult to forge together and consistently:

• Track continuity — does the movement look like a body, with the accelerations, pauses and imperfections a body produces?
• Co-presence — were other FlowStake athletes independently recording near you at the same time?
• Route agreement — where multiple people recorded together, do their independent traces agree?
• Motion signature — does the pattern match the activity claimed?
• Social proof — corroboration from other people, weighted by how independent that corroboration actually is.

Tamper-evidence: the commitment

As you record, each GPS fix is folded into a rolling cryptographic commitment — a Merkle structure that produces a single root hash for the whole session.

The useful property is that the root depends on every point. Change one coordinate, delete one fix, shift one timestamp, and the root no longer matches. The session is committed at the moment it ends, before it is scored, so an activity cannot be quietly improved after the fact and re-submitted as though it were the original.

This is what makes a FlowStake activity checkable rather than merely stored.

Why other people matter

Here is the part most verification systems get wrong, and it's worth being direct about.

A phone can be lied to. Everything above runs on your device or on data your device produced, which means a sufficiently determined person with a modified device can eventually produce a recording that passes every solo check. Not easily, and not repeatedly without effort — but it is possible, and any system claiming otherwise is overselling.

What is substantially harder to fake is another human being. When two people independently record in the same place at the same time, each one's recording becomes evidence for the other. Two devices, two accounts, two sets of sensor noise that have to agree — without either party being able to see what the other is producing.

This is why the highest verification tier is not available to solo activities at all. It requires independent human encounters. The ceiling on a solo recording isn't a limitation we intend to remove; it's an honest statement about what a single device can prove on its own.

Verification tiers

Each verified session lands in a tier based on its confidence score:

Sessions that fail a hard check are not tiered — they're rejected, and you'll be told which check failed.

The numeric thresholds behind these tiers are working baselines, and they will move as we gather more real-world data. We would rather adjust a threshold in public than pretend the first values we picked were the correct ones.

What we don't claim

Being specific about limits is part of making the rest credible.

• This is not identity verification. Verification says a device recorded a plausible human activity along a plausible route. It does not prove who was holding the device.
• A solo activity has a ceiling. See above. Solo recordings can reach high confidence, but not the top tier.
• Thresholds are provisional. They are calibrated against real usage, and real usage is still accumulating.
• No system is unbeatable. The goal is to make cheating expensive, repeatable-detection cheap, and honest recording effortless — not to claim an impossibility.

Your data

Location data is among the most sensitive information a person can share, and verification is not a licence to expose it.

• Activity visibility defaults to a limited audience, not the public web.
• Precise start and end coordinates are treated as sensitive and are not exposed to other users through the app's public surfaces.
• Photos are stripped of embedded location metadata before upload.
• Verification runs on the data you already chose to record — it does not require additional tracking, background collection, or third-party sharing.

You can export or delete your data at any time from your account settings.

The full specification

This page is the readable version. The complete technical specification — the
container format, the Merkle Mountain Range track commitment, encounter records,
privacy profiles and the normative verification procedure — is published at
flowstake.com/protocol.

It is written for implementers: anyone building against the format, auditing the
verification claims, or checking that what this page describes matches what the
system actually does.