This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass
What I Built
When I was younger, there was a particular kind of event experience that I've always remembered.
You heard about a party through someone. You didn't receive an address. Maybe you were given an invite. Maybe somebody sold you a ticket. What you got was a date, time and a map point.
You went there on the date of the event.
Sometimes there was another clue waiting for you. Sometimes there was a phone number, somebody standing there, a flyer, or another map location. Eventually the trail led you close enough to the actual event that the final location could be revealed.
The journey was part of the party.
That experience mostly disappeared once every event became a Facebook page, an Eventbrite listing, or a pin that you tap and immediately send to Google Maps and log on your calendar.
So for the Touch Grass challenge, I decided to recreate those kind of events.
Word of Mouth is a self-hosted platform for private events whose location you have to physically discover.
An organizer creates an event and enters its location, date, time and notes. Those details are encrypted, and the encryption key is split across QR codes or NFC tags that can be placed around a walkable area.
Guests receive unique single-use invitations. The invitation can reveal a ZIP code, themed clues, and enough information to start looking, but not the venue itself.
To discover the event, you have to leave the screen behind and go find the map points.
Find enough of them and your phone reconstructs the secret, decrypting the event details.
Then, when you arrive, the ticketing system uses a zero-knowledge proof for check-in rather than presenting a static ticket QR that can simply be screenshotted and shared.
The application is deliberately built so that the software gets you away from the screen.
Why I Wanted to Build It
This project started with a little bit of nostalgia.
I remember events where knowing where the party was happening wasn't automatic. There was mystery around them, there was a story. Information moved from person to person, and getting there was part of participating.
That's where the name Word of Mouth came from.
I wanted the modern version of that experience integrated with some level of event security and privacy.
QR codes are useful.
Phones are useful.
Maps are useful.
AI is useful.
But none of them have to be the experience itself.
They can simply be the thing that sends you back out into the physical world.
A event coordinator can decide how mysterious the event should be. One event might put every clue on the invitation and require only one map point. Another might scatter several clues across a neighborhood. The public ZIP code gives guests enough geographic context to know where they're heading without revealing the venue.
The software provides the ability to streamline flyer and invite creation.
The event organizer provides the party.
I Actually Took It Outside
The challenge page says to touch grass, so I did.
For testing, I created a fake event called Operation Pumpkin Ledger and planned a route around the mall.
Then I stopped staring at the development environment and actually walked it.
I followed the experience the way a guest would: move through the physical location, reach the map points, reveal the information, and see whether the concept still felt interesting once it escaped my laptop.
That test was important because this project only makes sense if the digital portion disappears into the background.
Walking the route confirmed something I suspected when I started building it:
the uncertainty is the fun part.
There's a noticeable difference between opening an event page and being told where to go versus knowing that the destination exists somewhere nearby and having to physically uncover it.
The anticipation builds as you uncover locations and unlock clues.
Demo
Here’s the full flow in under two minutes: create the event, let Gemma help plan the clues, generate artwork, print invitations, hunt for the location, and check in with a zero-knowledge proof.
The guest experience has three basic stages.
First, Find it. The invitation gives you the event theme, public area and clues, but keeps the actual venue sealed.
Then, Unlock it. QR codes or NFC tags contain shares of the encryption key. Once the guest collects enough shares, the event details decrypt locally.
Finally, Get in. At the venue, the guest uses a one-time zero-knowledge proof to demonstrate that they hold a valid pass.
Organizers also get tools for generating unique invitations, printing them in batches, creating themed artwork, placing map points, and running the door.
The repository README includes screenshots of the full journey.
Code
SkillfulHacking
/
word-of-mouth
Private events you can only find by walking to them. Self-hosted, local open-weight AI, zero-knowledge door check-in.
Word of Mouth
Private events you can only find by walking to them.
An organizer seals the when and where of an event. The key is split across a few QR codes and NFC tags hidden around a short walk, so a guest has to physically go and find them before the details appear. Guests come in through invites that people pass to each other (hence the name), and they get in the door with a zero-knowledge proof instead of a ticket QR that can be copied.
Everything runs on your own machine: a self-hosted web app, a local open-weight language model through Ollama, your own ComfyUI for pictures, and open map data. No accounts with anyone, no API keys.
Find it. A guest sees the event's theme and artwork, a ZIP code and clues. Nothing else.
Unlock it. Find enough hidden codes and the details decrypt on the
Word of Mouth is GPL-3.0-or-later and is designed to run on your own machine.
The application is built with Next.js, TypeScript and SQLite, with Ollama providing local model inference, OpenStreetMap providing candidate locations, ComfyUI providing optional event artwork, and Semaphore/snarkjs providing the zero-knowledge check-in flow.
The project currently has more than 200 automated tests, including tests that generate real proofs and browser tests that render printed invitations, decode their QR codes from the resulting pixels, and verify their physical print dimensions.
That last test came from finding a real bug: an invite could technically contain a decodable QR code while still printing too small to be something I would trust in the real world.
That is exactly the kind of problem you only find when the project is intended to leave the screen.
How I Built It
The AI component solves a narrowly defined problem rather than running the entire application.
When an organizer creates an event, Gemma runs locally through Ollama and helps plan suitable map points and write themed clues.
The model is not allowed to hallucinate arbitrary locations.
The application queries OpenStreetMap first and gives Gemma a finite set of real candidate locations. Gemma selects among those candidates and writes clue text. Ordinary deterministic code then checks its choices for distance, walking limits, accidental leakage of the venue, and references to scenery that doesn't exist.
That division of responsibility became an important design principle:
let the model do the fuzzy creative work; let code enforce reality.
Gemma is also used to turn an organizer's short description of a mood into an image-generation prompt. That prompt can be handed to a local ComfyUI instance to create event artwork.
Nothing about the model is tied to a hosted API.
The whole AI path can run locally.
Why Does Open Innovation Matter?
For this project, local open-weight AI isn't just a philosophical preference. It changes what the application can safely do.
The model receives information related to a private event.
A commercial API could technically generate the same clue text, but doing so would mean sending event context to somebody else's server.
That feels completely backwards for a system whose entire purpose is controlling who knows where an event is.
Running Gemma locally means the organizer can keep that data on hardware they control.
It also means Word of Mouth isn't dependent on an API account, API key, usage quota, pricing model, or one company's decision to keep a particular model available.
If Gemma works well, use Gemma.
If another open model becomes better for a particular organizer's hardware, the application architecture allows it to be changed.
That is one of the things I like most about open-weight models: the model becomes a component rather than a dependency on a business relationship.
OpenStreetMap matters for the same reason. ComfyUI matters for the same reason. The cryptographic libraries matter for the same reason.
The interesting part of this project is that the entire stack can belong to the person running the event.
Security and Privacy
There are a few details I didn't want to hand-wave away just because this started as a fun event project.
Event details are encrypted with AES-256-GCM.
The key is divided with Shamir secret sharing, so an organizer can configure how many physical codes are required to reconstruct it.
Shares are carried in URL fragments, which browsers do not transmit to the server.
Once an event has been created, the server stores the encrypted details rather than retaining the key.
At the door, Semaphore-based zero-knowledge proofs allow a guest to prove membership in the guest set without presenting a reusable ticket QR.
There are limitations, and the application documents them. A phone or account can still be handed to somebody else. Very small groups are not meaningfully anonymous. A lost phone means a lost pass. The code has not undergone a professional security audit.
I would rather document those boundaries than pretend cryptography makes the system magical.
What Surprised Me
I expected the cryptography to be the most interesting technical part of this project.
It was interesting.
But what I ended up enjoying most was the interaction between software and physical design.
How large does a QR code actually need to be once it comes off the screen and lands on paper?
How far apart should clues be before the hunt becomes annoying instead of interesting?
How much geographic information can an invitation reveal without ruining the mystery?
How do you ask an AI model to be creative without letting it invent a landmark that isn't there?
Those questions don't really exist until the application is expected to interact with streets, buildings, paper, phones and people.
That is what made this challenge fun.
My Agent Session
I used Claude extensively as a development agent while building the project. The public Git history credits the Claude-assisted commits, and all of the resulting source code, tests, architecture and documentation are available in the repository.
I chose not to publish the private prompt/chat transcript for this submission.
Prize Categories
Best Use of Gemma
Gemma is used locally through Ollama for map-point selection and themed clue generation, and for generating prompts for optional event artwork.
The local model is particularly important here because private event context does not need to be sent to a hosted AI provider.
Top comments (0)