Vanish Play: private video guessing game

_context

Vanish Play is a mobile and web app in early development. The idea is to turn a video you own into a shareable guessing game: pick a person or object in the clip, hide it behind a moving mask, then play a question, a countdown, and the reveal. Work started in July 2026. What exists today is the first half, covering sign-in, an adult gate, the creator flow for choosing a clip, a time range, a target and a rights declaration, and a resumable upload path, plus a Python harness for measuring masking quality before committing to a model. It runs locally against in-memory stores, and the masking and export pipeline the product is named for is planned rather than built.

_contribution

I design and build the whole thing solo: the Expo app that serves web and native from one codebase, the API and the shared schema package both sides validate against, the encryption that keeps the creator's answer secret, the resumable direct-to-storage upload path, and a Python harness for measuring masking quality and cost before committing to a model.

_what-I-built

• A universal Expo app serving web and native from one codebase: sign-in, an adult gate, and a five-step creator flow for choosing a clip, a time range, a target and a rights declaration.
• A TypeScript API with a shared schema package as the single source of truth for every request and response, plus origin and CSRF checks on every route.
• A resumable upload path where parts go straight to object storage and the API exchanges only control messages, handling cancel, resume after an app restart, and a single completion under concurrent requests.
• A Python measurement harness with a fixed video timeline, quality metrics, a cost ledger and spend gates, built so ordinary development cannot reach a paid model by accident.

_what-it-demonstrates

• Safety rules enforced where they cannot be forgotten: the 24-hour deletion deadline and the rights declaration are both database constraints, so a record that contradicts itself or outlives its deadline cannot be written at all.
• Untrusted media handled defensively: uploaded bytes are hash-verified before any tool runs, inspection uses a fixed command allowlist with hard timeouts and bounded output, and failures return one of a fixed set of reason codes instead of raw tool output.
• An evidence harness that reported an honest non-result: the model comparison depended on a video corpus that was never available, so the signed record says the evaluation stopped with zero model runs and zero spend rather than reporting numbers nobody measured.