Concept v1 · as of 24 Sep 2026
No node holds all the data. Only your key puts it back together.
Status: researched, not built. Every statement on this page carries one of four stamps:
In plain words
The powerful want to make everything transparent: every step, every message, every heartbeat. That works because almost all data sits with a few large corporations. Whoever has those servers can look through anyone. Against that, we are building a network of many small nodes that belongs to the community.
The powerful are building a world in which every person is transparent. Every step, every message and every heartbeat ends up on servers they can look into. This is possible because almost everything runs through a few places: a handful of large corporations and their data centres. Whoever has those servers can look through anyone, and whoever gets access to them needs only a single door.
IGOULTRA still runs the same way today, on rented servers at large providers. We want to change that. A promise in a privacy policy does nothing against the transparent citizen. Only a different way of building helps: decentralisation and distance from the big structures. Your data sits encrypted on many small computers that people from the community put on a shelf at home. None of these computers can read what it stores. Neither can we.
“Nobody has all the data, there are only pieces everywhere, and only with the key can you retrieve your data. No bigger than a mini PC or a Raspberry Pi.”
In July 2026 we tested this in six parallel research tracks: storage, zero-knowledge, P2P transport, sync, node operation and anti-cheat. More than a hundred sources. The result: it can be built. The building blocks exist, they are openly licensed and they run on a computer that costs 170 euros.
In plain words
Your data sits encrypted and in pieces on many small computers from the community. None of them can read it. Our own server only knows where the pieces are, like a postman carrying sealed letters.
Try it
Your photo is encrypted and split into eight pieces. Each piece sits on a different node. Tap nodes to switch them off. Four pieces are enough to restore the file.
8/8 nodes onlineFile restored
Only your phone has the key. That is why only you see the photo.
The key in five shares
Your key is split with Shamir 3-of-5. Tap shares to collect them. Three restore it. Two reveal nothing.
0/5This still reveals nothing
Cheap community nodes hold only encrypted pieces, check proofs and each carry a game world of their own. All keys and all logic live on your phone. The central server shrinks to a blind coordinator: it knows which node is online and where a piece is stored. What the piece contains, it cannot find out, even with full access to its own database.
“Nobody has everything” comes from three mechanisms working together:
To be honest: the technology does not force this like a law of nature. It comes from design. In exchange, it can be built in 2026 and does not need new research first.
In plain words
The Ultra-Netz is built like a tower with six floors. At the bottom it makes sure devices find each other. Above that sit your account, your data, the worlds you share, and at the very top the proof that you played fair. Tap a floor to learn more.
Proof that you played fair, without showing who you are.
For developers
Signed receipts, Semaphore v4 with one nullifier per season, later zero-knowledge over the sum of XP.
Each node is the referee of its own world. Anyone can replay a game.
For developers
Each node is the server of its world. Deterministic engine (built), signed append-only logs.
Worlds, guilds and messages you share. Merging happens on your phones.
For developers
Loro for worlds, Jazz for guilds, our own Signal pattern for direct messages (built, awaiting live test).
Your data sits encrypted on your phone. The backup lives in eight pieces with the community.
For developers
Encrypted database plus Ultra-Shards: XChaCha20-Poly1305, Reed-Solomon RS(4,8), key split with Shamir 3-of-5.
Your account is a key on your phone. No password sits on a server.
For developers
A key pair following the Nostr standard is your account. Every device gets its own signed key.
Devices find each other by their key, even behind a router without its own address.
For developers
Iroh: connect by key instead of IP. About 90 % direct connections, the rest through our own relays, which decrypt nothing.
Iroh connects devices by their public key instead of an IP address. Version 1.0 came out on 15 June 2026 under the MIT and Apache licences. In production, a direct connection through routers succeeds in about 90 % of cases. The rest goes through relays that cannot decrypt the content and that we run ourselves.
This matters twice as much in Germany: many cable and fibre connections no longer have their own public IPv4 address. A home node there would otherwise be unreachable.
Three of the six research tracks recommended Iroh independently. In a measurement with 4.4 million attempts, libp2p only reaches about 70 %.
Your account is a key pair following the Nostr standard. The public half is your Ultra-ID, the private half stays on your device. No password sits on a server, and the account is not tied to any provider. Every device gets its own key, which your account confirms with a signature.
Your data sits on your phone in an encrypted database. The backup follows a pattern Hugo Krawczyk described in 1993:
Recovery works with a recovery phrase (12 or 24 words, BIP39), plus a passkey as the convenient route. If your phone falls into water, your progress is still there, and nobody can read it.
The building blocks are audited: Privy's Shamir library was audited by Cure53 and Zellic. Our own work is distribution, health monitoring and repair, estimated at under 2,000 lines of core code. To start, Garage is enough as storage on each node. Garage is an S3 store written in Rust, built by a non-profit association and tested on Raspberry Pis.
Three cases, three tools:
An open problem for the whole industry: MLS for group chats works in a fixed order, while CRDTs depend on people editing offline at the same time. The two clash, and Matrix struggles with it too. So we separate them: MLS or the Signal pattern for chat, group keys for state. Keyhive from Ink & Switch could solve this cleanly from 2027 on, and we are watching it.
Twenty years of P2P games show that whatever worked always had a host. Minecraft is the best example. Games with no authority at all have stayed research.
So we make authority smaller and multiply it instead of abolishing it. Each community node is the server of its own world: chat, buildings, boss fights. Nodes never have to agree with each other on anything. Only the protocol, identity and reputation are shared.
IGOULTRA's game engine is already deterministic today (built): the same inputs always give the same result. Nodes keep signed, append-only logs. Anyone can replay a game. A dispute becomes decidable and stops being a question of trust.
Zero-knowledge comes in stages. Each stage is useful on its own.
A field trial with 2.1 million proofs on 1,420 phone models (FibRace, 2025) shows that zero-knowledge works on ordinary phones today.
In plain words
When you play alone, you play in private, and anyone who cheats only cheats themselves. In the world, the node is the referee. For the leaderboard you choose to show a little more. And because XP never turns into money, cheating hardly pays.
most of the usage
full, raw data never leaves the device
plausibility checks on the device only
Anyone who cheats here only cheats themselves.
the node is the referee
high, data only on the node you chose
strong
Game actions are deterministic. The node checks them and anyone can replay them. There is no conflict here.
optional
deliberately a bit less
device attestation, signed summary, spot checks
An informed trade. Anyone who does not want it plays without the leaderboard and loses nothing in the game.
The tension: privacy against anti-cheat. Decentralised, private and hard to cheat: all three at once does not work everywhere. Per way of playing, it does.
The oracle problem, named openly: Cryptography proves that the computation was correct. It never proves that the input is real, meaning whether you actually ran. A central provider cannot prove that either. Pokémon GO has been losing the fight against faked locations for ten years, with full control over all the data. So a central data collector has only a small advantage with fitness data. Keeping your raw data with you costs almost no security. That is the strongest argument for the Ultra-Netz.
What protects instead, in layers:
In plain words
A node is a mini PC the size of a book. It costs about 170 euros and uses around 2 euros of electricity a month. It only stores encrypted data and carries a world. It never gets to see passwords, payments or plaintext.
How to become a node
The budget of a node
What a node never does
Reference device: a mini PC with an Intel N150, 16 GB RAM and a 512 GB to 1 TB SSD. Price about 160 to 200 euros, electricity about 21 to 26 euros a year at 8 watts idle (as of July 2026, 37 ct/kWh). A Raspberry Pi 5 runs as the second platform, with ARM builds from day one. Since memory prices went up, both cost about the same. The N150 has two to three times the performance.
The software: a single container written in Rust. The budget: under 512 MB RAM, under 5 GB of storage per year, under 1 Mbit/s of sustained upload. Shipped through our own app store for Umbrel, plus CasaOS. Updates run automatically, staged and signed. The Tor fleet shows why this is mandatory: 13.5 % of volunteers never update. Old versions get dropped from the network.
How to become a node: Buy a mini PC, put umbrelOS on a USB stick, install the IGOULTRA node, enter your code. Done.
What a node never does: logins, payments, passing plaintext to the internet, moderation. It only stores and forwards encrypted data. The architecture fixes this, and an operator cannot switch it. Legally this resembles a Tor relay without an exit. Pure transmission and storage fall under the liability privilege of the Digital Services Act (Art. 4 to 6) and § 7 DDG.
No nodes without anchors: Below 20 to 30 active nodes, the distribution does not hold. So we start with 3 to 5 anchor nodes that we run ourselves, plus at least 10 community nodes. The anchors are only removed once 30 to 50 nodes are running that are provably online at least 90 % of the time. Decentralisation is a path you walk. There is no switch for it.
Independent down to the line: In normal operation, no large provider should stand between users and the network. Our entry points are small servers of our own that only carry encrypted traffic over WireGuard. The encryption ends only with us.
Why people do this: No token, no money. The model is Folding@home, which carries more than 100,000 volunteers on recognition alone. In the game that means: the architect rank, a monument for your node with live uptime, and a season leaderboard called “Bearers of the World”. We know the warnings: 95 % of Nostr relays lose money, and one in five Fediverse admins is burnt out. So a node must not cause any work beyond using electricity.
In plain words
No blockchain and no token. Projects that tied game points to money broke apart because of cheating. We only use what is open, audited and buildable without a chain.
In plain words
Seven questions are not decided yet. Our recommendation is next to each one. Tell us where we are wrong.
XP, loot and in-game currency can never be exchanged for real money or tokens. An economy inside the game, yes. Cashing out, no.
Our recommendation
make it a rule. This one rule takes care of most of the anti-cheat work.
Anyone who wants on the leaderboard gives a device attestation, a signed summary and agrees to a spot check when they rank high or stand out.
Our recommendation
accept as is. Anyone who does not want this plays without the leaderboard.
Phases 1 and 2 depend on 3 to 5 anchors that we run ourselves. They are removed once there are 30 to 50 stable community nodes.
Our recommendation
accept. Without anchors, someone loses their data when too few nodes are running.
A recovery phrase as the root, key shares on nodes with Shamir 3-of-5, a passkey for convenience.
Our recommendation
accept. The backup exists, and nobody can read it.
Running a node is part of the architect rank. Recognition on the Folding@home model, no token.
Our recommendation
accept, on the condition that a node needs no maintenance. Uptime claims need their own fraud checks.
An N150 mini PC as the official device, Raspberry Pi 5 as the second platform.
Our recommendation
accept.
A: an encrypted backup on community nodes. B: the key identity first.
Our recommendation
A. It proves the core fastest, “your data as pieces, only your key puts them back together”, and it does not change the login in the app.
Every decision has an issue in the open repo. That is where it gets decided, with date and reasoning.
We also plan a test environment on our own hardware before any of this touches the real app.
In plain words
No technology proves that you really ran. Who exchanges data with whom stays visible, even when the content is hidden. And the whole thing is a plan for years. We write this down so you know what you are getting into.
The oracle problem. No technology proves that a sensor reading is real. Anti-cheat stays a model of layers.
Metadata. Nodes see no content. Relays still see who exchanges how much with whom, and when. No system in the stack hides that.
The Iroh bridge to React Native. Swift and Kotlin bindings exist, an Expo module does not. This is our largest single technical risk, and we test it first, before we commit.
Young projects. Jazz and Loro have small teams, and Jazz has no audit. Iroh is backed by a venture-funded company. We keep the data formats swappable and run the relays ourselves.
No forward secrecy in CRDT groups. Anyone who leaves a guild can still read its old history. That is why direct messages stay with the Signal pattern.
Too few nodes. Nodes go offline, and repair costs bandwidth. Storj measured that repair can affect up to 35 % of the data in a month.
Our own ZK circuits. The most dangerous spot in the stack. Until May 2026, Zcash had a bug in the Orchard circuit that went unnoticed for four years despite audits. We use standard circuits, keep our own tiny and have them reviewed externally.
The effort. This is a programme that runs for years. Every phase has to be useful on its own. Infrastructure without a game people love dies. That is why the game comes first.
In plain words
The game engine and the encryption for messages are built. First comes an encrypted backup on community nodes: phone gone, progress still there. Then identity, worlds on nodes, and at the end a server that is blind.
Where we are today
Add device attestation on submission. Write down the rule: anything private is ciphertext, anything public is a voluntary, signed receipt. The game engine gets version stamps and test vectors.
Node v0 as a container. The encrypted backup is the first feature you can feel: phone gone, progress still there. The app store for Umbrel takes shape.
The key pair as Ultra-ID next to today's login. Semaphore for anonymous season entries. Spot checks for the leaderboard.
Nodes carry guild rooms and architect worlds. Loro and Jazz. The Iroh module for the app. Your progress on several devices.
The central server only knows the directory, the health of the nodes and the minimum version. Privileged actions need several keys (FROST), so that not even the operator can act alone. “Zcash for XP” gets evaluated.
In plain words
We are looking for people for Rust, cryptography, apps, security and node operation. And everyone who has a small computer to spare. Read the concept, pick a question and build with us.
We are looking for people who have built something like this before, or who really want to:
the node daemon, relays, Reed-Solomon in the native module.
the Iroh bridge. The first spike.
Semaphore, Circom or Noir, the design of “Zcash for XP”. And a critical eye on everything else here.
Loro, Jazz, Evolu, Keyhive.
Umbrel, CasaOS, updates, monitoring, repair.
People who attack our threat model.
Plausibility checks on sensor data, leaderboards that cannot be bought.
You have a mini PC or a Raspberry Pi and want to be part of it from phase 1.
Read the concept in the open repo. Pick a decision or a question and write your opinion in the issue. If you propose something bigger, write an RFC. Or come to the Discord and say hello.
Every larger change to the concept goes through a public RFC. Decisions are made in the open, with a date and a reason.
The transparent citizen ends here.