How we count
The whole bet is one number. If the number is soft, the bet is worthless. So here is exactly what it means, what it doesn't, and how my brother can check it.
THE DEFINITION
A player is a device that finished at least one full game (win, loss or the turn cap), validated by the rules below. Counted per game, for the lifetime of the game.
Unique devices, not people. Your phone and your laptop are two players. Two people sharing one tablet are one.
THE FOUR NUMBERS
| PLAYERS | Devices that finished ≥ 1 validated game (win, loss or the 30-turn cap). Lifetime, per game. This is the number that has to reach 1,000. |
|---|---|
| ONLINE | Devices with the game open right now. Each one checks in every 30 seconds while the tab is visible; it drops out after 90 seconds of silence. |
| TODAY | Players who finished a validated game today. Days are UTC calendar days, the same clock as the daily map. |
| RETURNING | Players who finished validated rounds on at least two different days. |
The bar on the home page shows the leading game. The bet is per game: one game has to get there on its own, I can't add games up.
WHAT DOES NOT COUNT
- Opening the page, watching the menu, starting a game and quitting. Only a finished game counts. Re-opening a game you already finished doesn't count again.
- Games faster than the minimum believable time, or longer than the maximum. For Brother vs Gary: under 6 seconds or over 90 minutes of play.
- A finish with no matching start, or the same round finished twice.
- A round that claims more play time than actually passed on our server's clock.
- Anything a browser sends from another website (the API refuses foreign origins). A script can fake that header, so this only stops casual abuse, see below.
- Devices that opted out, or whose browser sends Global Privacy Control. Those send nothing at all.
ANTI-BOT RULES
- Start → finish pairing. Every round gets a random round id at start. The finish has to quote it, with the same map seed.
- Server clock. The server notes when the round started. If you report a 10-minute game 30 seconds after starting it, it's rejected.
- Plausible bounds. Each game has a minimum and maximum round time. Outside that: rejected.
- One finish per round. Replaying the same finish does nothing.
- Rate limits. Per device: at most 20 starts and 20 finishes a minute, one heartbeat per 20 seconds.
- Checksum. Each finish carries a checksum over its fields. Honest note: in v1 this is not a secret signature. The formula is in the public JavaScript, so it only stops sloppy replays and typos. The rules above do the real work. Server-signed round tokens are on the list for v2.
None of this stops someone determined, with a script and many fake device ids. Nothing on the open web does without accounts, and I don't want accounts. If the numbers ever look pumped, the brother calls it out, and so can you.
THE BROTHER AUDITS
My brother doesn't trust me. Fair. So the counter is built so he doesn't have to:
- Every number on this site comes from one public endpoint:
/v1/stats(per game:/v1/stats/hex). Same JSON for everyone, no login. - The rules on this page are the rules in the code. If they change, this page changes the same day.
- If anyone finds a hole, it gets fixed in public, and if fake players got in, the count goes down.
loading /v1/stats…
PRIVACY, SHORT VERSION
No cookies, no ads, no third-party trackers, no accounts. The game stores a random id on your device. Our server only keeps a salted hash of it, never your IP address. The id is replaced after 13 months. Full details in the privacy notice.