Most VPN apps look the same: there's a big connect button, a list of countries and a speed number. The product works well when you never think about it, and that's a problem for us as a VPN team. Users forget you exist until something breaks.
We wanted to try something different. We didn't want another dashboard or another speed graph. We wanted a reason to enjoy opening the app.
The result is Colitu Passport: every country you connect to becomes a stamp in a personal passport. You can level stamps up, complete collections and compare passports with friends.
Gamification and privacy usually pull in opposite directions, though. Most engagement systems run on detailed behavioral data, and a VPN is the last product that should collect that. This post covers how we tried to build one without the other.
The core loop
The rules are simple:
- Unlock: stay connected to a country for 5 minutes and you earn its bronze stamp.
- Progress: while the VPN is on, you earn a puzzle piece at the 10th minute and another at the 60th minute of the day. That's a maximum of 2 pieces per day.
- Level up: each tier costs 12 pieces. The tiers are Bronze, Silver (12), Gold (24) and Diamond (36).
The math is intentional. At 2 pieces per day, a single level takes at least 6 days. There's no way to grind faster and no way to pay to skip ahead. Progress is tied to calendar days, not hours spent online.
That cap matters for a VPN in particular. We didn't want a system that rewards leaving the tunnel on 24/7 "for the points." Two pieces a day, earned early, means a normal day of use is enough to progress.
Structure: chapters and collections
Stamps are organized on two axes.
Chapters give the passport a progression arc:
- Origin: the first 10 countries (Sweden, Germany, Japan, the US and others).
- Horizons: 10 more (Norway, Canada, Turkey, Australia and others).
- Legacy: the mastery layer. Get every stamp to gold, then every stamp to diamond.
Collections group countries by theme: Nordic, Baltic, Across the Atlantic, Heart of Europe and Pacific Rim. Completing one unlocks its cover and seal. There's also one hidden collection, which we're not going to explain here.
On top of that come weekly expeditions (three small goals per week), achievements and titles, selectable passport covers and app icons.
Design rule #1: count minutes on the server, not the client
The first technical decision was where progress gets measured.
If the app counted connection time, the system would be trivially gameable. You could patch the client, fake the clock or replay a request. Trusting the client for rewards is a well-known anti-pattern in game development.
So connection minutes are counted by Colitu's servers, not by the apps. The VPN server already knows a tunnel is up, so it's the natural source of truth. The client only displays what the server has already decided.
This also gives us cross-platform consistency for free. The passport lives in the account, not on the device. Connect from your phone in the morning and your laptop at night, and the progress lands in the same passport. The feature ships on Android, iOS, Windows and Linux at the same time.
Design rule #2: store totals, never sessions
This is where a VPN differs from every other gamified app.
A typical engagement system logs events like user X connected to server Y at 14:02 for 37 minutes. That's exactly the kind of record a privacy-focused VPN should never create, even with good intentions.
So the passport keeps only aggregate counters. There's no per-minute record and no per-session log. Conceptually, the stored state looks more like this:
passport
├── stamps: { country → tier, pieces }
├── today: { pieces_earned: 0..2 }
└── profile: { nickname, collector_no, title, cover }
and not like this:
connections: [ { country, start, end, duration }, ... ] ← we don't keep this
The difference is that totals tell you how far someone has progressed. They don't tell you when or how they used the VPN. You can't rebuild a timeline from "Germany: Silver, 7 pieces."
When you delete your account, the passport is deleted with it. There's no separate archive and no "anonymized" copy.
Design rule #3: no dark patterns
Gamification has a bad reputation, and it's mostly earned. Loot boxes, streak anxiety and pay-to-win make the experience worse for users. We wrote down what we would not build before we wrote any code.
No randomness you can pay for. There are no loot boxes and no random paid rewards. Every reward is deterministic: you know exactly what you'll get and when.
No streak punishment. Skip a day, a week or a month and you lose nothing. There are no penalties and no broken streaks. Progress simply waits for you. We think a VPN should never make you feel guilty for not using it.
No paywall on collecting. The free plan can collect every stamp. Paid plans only change the passport cover color. That's a cosmetic difference, not a progression advantage.
These rules shaped the architecture as much as the UX. For example, a daily cap of 2 pieces plus no streak penalties means the system needs very little state. There's no streak counter, no "last active" timestamp to punish and no decay job.
Social without a social graph
We wanted people to be able to compare passports, but we didn't want to build a friend list, follower system or leaderboard. Each of those adds a social graph that has to be stored and protected.
So comparison works in person, via QR code. Your app shows a QR code that encodes a summary of your passport. A friend scans it, and the app shows the two passports side by side.
No friend relationship is stored. There's no lookup by username and no public profile. The comparison happens at the moment of the scan, between two people standing next to each other.
The visual language
Each stamp is a small illustration of a landmark: Helsinki Cathedral for Finland, the Brandenburg Gate for Germany and so on. Each one is rendered in the material of its tier. Bronze, silver and gold are metallic finishes, and diamond turns the whole stamp into faceted crystal. Collection seals use a more classic, engraved, banknote-style treatment.
The goal was for the passport to feel like an object worth keeping, not like a badge system attached to a settings screen.
What we learned
A few takeaways for anyone adding engagement mechanics to a privacy-sensitive product:
- Decide what you won't store before you decide what to show. Our data model came from the privacy constraint, not the other way around.
- Server-side counting solves cheating and sync at once. If the server is already the source of truth, use it.
- Daily caps beat open-ended grinding. They respect users' time and keep the system cheap to run.
- Removing punishment removes state. No streaks meant less data, less code and less anxiety.
- Social features don't require a social graph. A QR code exchanged in person can replace a whole friend system.
Try it
Colitu Passport is live on Android, iOS, Windows and Linux. Connect to a country, wait five minutes and you'll have your first stamp.
We'd love to hear how others approach gamification in privacy-focused products. What would you add, and what would you never build?
Top comments (0)