Dead Drop: a hide-and-seek network for the real world

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

Dead Drop — a hide-and-seek network for the real world.

Here's the problem with most "touch grass" apps: they hand you AI-generated errands. Walk to the park. Photograph a tree. Check in. You're still playing single-player against an app, and the grass is just a backdrop.

Dead Drop flips it. Humans hide real objects for other humans. You stash a painted stone in a park, describe the vicinity (never the exact spot), and the AI writes a cryptic riddle for it. Hunters browse riddles, walk outside, find the thing, and photograph it. Then the AI does the one job it's actually good at here: referee. It compares the find photo against the hider's description and issues a verdict — match or no match. No couch-faking. Both sides score.

Every screen is designed to end with you going outside. No feeds. No infinite scroll. No notification spam. The reward is genuinely variable — you never know what's hidden until you find it, and as a hider you never know when someone finds yours. Finders become hiders; that's the loop.

It's for anyone who's ever wanted their neighborhood to feel a little more like an adventure.

Demo

Live app: https://dead-drop-eight.vercel.app/

(Narration generated with ElevenLabs. The video shows the full loop: login → hiding a drop with live AI riddle generation → the drop going live → hunting → photo verification → leaderboard.)

Code

Ranbir5ingh / dead-drop

Hide a small treasure outdoors. Hunt someone else's by riddle. An AI referee checks the photo.

Dead Drop

Humans hide real things for each other. AI only referees.

A hider stashes a small object outdoors, describes the vicinity, and the referee writes a riddle. A hunter reads the riddle, goes outside, and photographs the object. Vision verification decides the match. Both sides score. The exact spot is never published. The app never arranges a meeting.

This is a mobile-first PWA for the Hacktoberfest Week 1 "Touch Grass" DEV challenge.

Phone (mobile browser, nothing installed)
   │  HTTPS JSON
   ▼
Vercel  — Next.js UI, GSAP, camera
   │  NEXT_PUBLIC_API_URL
   ▼
Render  — NestJS API, the AI runtime
   ├── Supabase Postgres (Drizzle) — drops, finds, scores
   ├── Supabase Storage — drop-photos bucket
   └── Google AI Studio — Gemma, riddles + photo checks

The phone does not run a model. It calls the API. The API calls Gemma. Keys never reach the browser.

Honesty about photos

The hosted demo sends find-photos…

View on GitHub

How I Built It

The AI: Gemma as the referee, not the quest-giver.

• Riddle generation. Gemma takes the hider's vicinity description and writes a cryptic, solvable riddle — behind strict guardrails: never an address, coordinates, or exact spot name. A deterministic safety scan runs in code, and the AI never overrides it.
• Find verification. Gemma (vision) compares the hunter's photo against the hidden object's description and returns a strict match/no-match verdict with a confidence score. Uncertain → no match, always. This honesty is the product's trust core: scores only mean something because the referee can't be gamed.

Gemma runs two ways behind one provider interface: served through Google AI Studio (gemma-3-12b-instruct) in production, and via Ollama locally during development. Same adapter, env-switched.

The stack:

• Frontend: Next.js 16 + Tailwind + GSAP, mobile-first PWA (Vercel)
• Backend: NestJS API — the project's AI runtime (Render)
• Data: Supabase Postgres via Drizzle ORM; photos in Supabase Storage, uploaded server-side only
• Auth: email + Google/GitHub OAuth, httpOnly sessions

One honest note: the deployed demo sends find photos to Google's API so Gemma can referee them. The local Ollama path — where photos never leave the machine — is documented in the README as the privacy-preserving alternative. Open weights mean you get to choose.

Why Does Open Innovation Matter?

Because the referee has to be inspectable.

Dead Drop's entire value proposition is trust: a scoreboard that means something, riddles that are fair, verdicts that can't be gamed. If the referee were a closed black box, you'd have to take my word for it. With open weights, anyone can read the prompts, swap the model, run the whole AI layer locally, and verify the game is fair. That auditability isn't a nice-to-have — it is the product.

It also made the architecture possible on a hackathon budget: no per-seat AI pricing, no vendor lock-in, and a local inference path that runs with zero cloud spend. I built the thing I wanted to exist — and anyone can fork it and run their own city's dead-drop network tomorrow.

My Agent Session

Built with Cursor as the agentic IDE (Grok 4.7, high-effort planning mode) against a written master prompt: strict AI contracts, deterministic safety rules, and a provider-neutral AI adapter came straight out of that spec. No DevRelay session for this one.

Prize Categories

• Best Use of Gemma — Gemma writes every riddle and judges every find photo; the served-in-prod / local-via-Ollama setup shows genuine, load-bearing use of the open-weight model.
• Best Use of Render — the NestJS backend, the project's AI runtime, is deployed as a Render Web Service.
• Best Use of ElevenLabs — the demo video's narration was generated with ElevenLabs.