Your entries are private. The draw is still checkable.
How many entries you hold is nobody's business. An entry count is an activity tracker: it says how often you eat out, and read alongside your takes, roughly where and when. So it is visible to you and to no one else.
That creates an obvious problem. A prize draw nobody can inspect is indistinguishable from a rigged one, and "trust us" is not good enough from a site whose entire argument is that other people's review scores cannot be trusted.
So the two things are separated. Who entered stays private. Whether the draw was honest is published.
Private, you only
- Your entry count
- Your entry ledger, line by line
- Any retractions against you
- Which takes earned what
Published every week
- Total entries in the pot
- How many people entered
- A hash of the sealed entry list, before the draw
- The random seed, after the draw
- The winning handle
How a draw runs
Four steps. The only part that needs explaining is the third, and it is a fifty year old idea rather than anything clever.
The month closes
At midnight on Sunday, entries stop. Nothing can be added, removed or reordered after this point, including by us.
The list is sealed and fingerprinted
Every entry is written into one ordered list. That list is run through SHA-256, which turns any amount of text into a single 64 character fingerprint. Change one character anywhere in the list and the fingerprint changes completely.
The fingerprint is published before the draw happens. It gives nothing away about who is in the list, because you cannot work backwards from a hash to its contents.
a3f1c8e2b47d9056f1ae338c7b2409dd51e6f0a8c94b2d17e83f5a6019cb7e42
1,412 entries · 87 entrants
The seed is drawn and published
A random seed picks the winning position in the list. The seed is published straight after, alongside the winning handle.
This is what makes the whole thing checkable. Because the fingerprint went out before the seed existed, we could not have looked at the list, picked a favourite, and worked backwards. And because the seed is public, anyone holding the list can rerun the selection and get the same answer.
7c41d90f2ba85e63
Position 1,046 of 1,412 · won by nunhead_nomad
Anyone who entered can verify their own line
Your private ledger shows your entries and the position numbers they occupied. Check those against the published seed and you can confirm your own entries were in the sealed list and were treated the same as everyone else's.
What you cannot see is anyone else's. That is the trade, and it is the right way round: you can verify the process without anybody being able to profile you from it.
The record
Every draw since the first. Commitments and seeds stay published permanently.
The first weekly draw is at the end of September. The prize is a fifty pound voucher, spendable at any place in Peckham.
Why not just publish everything
The obvious answer to a trust problem is total transparency, and it is the wrong one here. A public list of entries per handle would let anyone build a picture of how often a given person eats out, and cross referenced against their takes, which streets they are on and roughly when. Several people would reasonably stop contributing rather than publish that.
A commitment scheme gets both. The list is fixed before the winner is known, and provably so, without the list ever being shown. It is the same principle used for sealed bids and for lotteries that publish draw integrity without publishing tickets.
If you want to check the arithmetic yourself, the fingerprint is a plain SHA-256 of the entry list as UTF-8 text with one entry per line. Nothing bespoke, and any hashing tool will reproduce it.