Meerkat, building a ZAPP (0xparc SDK): making privacy social

Thank you. Wow, this is very bright. Okay. Actually, very bright. Good morning.

I hope you had a wonderful morning. I'm Miriam from Meerkat, and I will be talking about how we went from zero to one after having our app at several hundred talks. And Meerkat is an events app. It fosters better audience engagement, and it's open source, and it's privacy-preserving, and the center of it is the Q&A. I'm going to just try to stand out a little bit off the light, but I don't think that's going to work.

Yeah. So I will dive a little bit into which product decisions we made and which helped us guide our product decisions in terms of being between privacy features and utility. And then secondly, I'll also be talking about the programmable cryptography elements that we are using, and we were using the ZeroXpark SDK. You're welcome to scan the QR code, or actually, please scan the QR code, and then you can experience the app as I'm going through the slides. This is the fully anonymous version.

As I'm going through the talk, you will see me talk about the ZooPass-gated version, but it will still be nice to follow along. Maybe some of you have been to DEF CON, and this is what it looked like, basically, at a large event. I would say raise your hand, but I really can't see anything. Yes, maybe some of you have been to conferences, and it was hard to ask a question, or the microphone got passed around. So yeah, Meerkat has these advantages that participants or attendees say that they feel safe and inclusive.

We have about two to three times higher engagement rates that we see that people ask questions, and it's also great for organizers. Organizers, imagine, spend a lot of budget on these events, and it makes sense for them to double down on the engagement at the live event itself, and the intensity, and using software that makes that engagement better. And for speakers, it's also great, because they know they get the questions read to them in a prioritized order, and not just randomly when the microphone gets passed around. And thirdly, it's a little bit of a multiplayer game. You also have the emcee that has something to do while they're talking, and the audience is doing something.

So this is very great also for talks, for the emcee attention spans. And sometimes it fosters engagement even after the talk on other social media platforms. Why do we need better event software? This is a slide from Richard from ZeroX Park, and so the software stack for events and crypto is based on so many in-real-life events, is still the same old one. So you sign up for a ticket, pay it, have your transaction there, you roll permissions in this system, then maybe you get an email confirmation, and then you're also in a Telegram group, and wouldn't it be nice if all this data was more streamlined, and the user just owns their transactions, rolls permissions once.

Why does it make sense to build a Q&A or live engagement app now? So when you look at life cycle theory of products, early, when the internet came out, it made sense to build something where you can win in the market by having a better product. And then as the market matures, you usually have to put in much more marketing dollars, like you saw maybe over the last 10, 15 years, where you got vouchers for ride-hailing apps, and so on. And then the market matures even more, and the technology moves on, and you can build a product for the market again by improving a core feature, such as what we're doing with the privacy-preserving part, or other angles. And I think this fits very nicely from where we are at, so for us as Meerkat, we have to both focus on making a better product, but also on distribution.

I'll go into that in a bit. And some of the technological advancements that make our app possible are 10 to 12 years ago, everything encryption-related, especially client-side proving was still more of a research pipe-dream. And these things, as you can see here, every week there's new advancements that are just very exciting and make it very accessible for web developers to work with these technologies. And then secondly, also in terms of AI, authentic systems, and CPU servers, or other things that just want to use data, it makes sense to build something that can work with these architectures as well. Okay, so for us, like I mentioned, we were building at the interface of privacy and utility, and when building a product, we had to scope away a lot of features, actually, and stayed a very long time with just the core product.

But over time, though, we are adding on more features that reflect our convictions and inspirations, and these were some of them. So we want this new internet to feel safe and inclusive for everyone. We believe that people should be able to reveal what they want to reveal when they want to reveal it. And we also think that live audience engagement has a lot to do with being playful, and my project partner and I, we have an interest in gaming and look a lot into autonomous worlds, which is the concept that came out of Xerox PARC after they built a game called Dark Forest. And, yeah, so a lot of how we approach products, actually, we use a lot of gaming language.

Like, we don't say product-market fit so much, but more, okay, we have to get the core loop right, and that's what we try to get into the app. There's a few more. And then in terms of distribution, where are we at? So these are just some examples. We were lucky to have been present at DEF CON or last year.

Those are the hosted versions of the app, and then we also did some integrations because we have an open API at Switzerland, for example, that automatically lets you create Q&A events. And in another way, the Ethereum Foundation, for example, ran their own instance of our software because they had much more sensitive data. Another fun integration was, for example, FileWorth, oh, this was from ProtoCorp BERT. Yeah, this is, for example, the Switzerland integration where you have a session and you can right away create a Meerkat link, and these are screenshots from the integration with FileWorth. So if you've been to DEF CON, you can still review all the talks, including all the questions that the audience asked in the DEF CON app, but also in FileWorth.

So the data is already, the collective intelligence from these questions is already propagating. Yeah, to sum this first part up, yeah, we really had to focus on just the core until we really felt we've tested it enough. It kept pushing us into going into testing mode and testing early, even when the product didn't feel right at all, and then because we wanted to make sure that our app can rival with the dominant apps in terms of UX, and then later again expand. And then the same goes for the privacy features where there are some compromises, but it's important to start somewhere, it was for us, and then keeping the larger vision in mind and adding this back in. About the tech, so this is what the app is built in, it's a note app and it's fully open source, and I'm going to explain a little bit about the privacy tech.

So it's using SuPath, which is a credentials manager, and that's what, it's called a VF, yeah, that's just where the name comes from. And then this is using the VAPI, which is the software package that lets you connect to the data in SuPath, and then there's these three words, we also had to wrap our head around it, yeah, POD, PCD, and GPC, and POD is just the data format that the provable data comes in, PCD is when the data is proven on a GPC, and the GPC is the general purpose circuit, and that's a, yeah, pre-compiled cryptographic circuit that facilitates zero knowledge proof in the POD format. Okay, so where in the app exactly are we using these technologies? This is three features we had at DEF CON, so one is for identity, the second one is for ownership, and the third one is peer-to-peer. For the identity, you have to log into SuPath and prove your ticket in order to be able to ask a question, vote, and react to the talk, and so this is using the ticket proving and also the VAPI, and it generates and consumes the POD, and this is what it, yeah, looks like in the sequence diagram, so the web app creates a connection to the app connector, the app connector is this pop-up that comes up, and once that connection is established and syncs to SuPath, yeah, then the web app requests the ticket proof from the app connector, it's the drop-down where you select your ticket, and the app connector generates the proof and sends it to our backend where it gets verified, and once the verification is done, the access credentials will be returned to the web app, and the user is authenticated and can interact with the, can start adding questions.

You might wonder where the proof even comes from, I'll explain that in a second. One quick reality check about this is that you see the additional pop-ups, so UX-wise, that's medium ideal, and also some setups don't work still. This is at least when we used it in a big scale for the 12,000 participants at DEF CON. Yeah, and the proving time, especially at conferences, sometimes the Wi-Fi is bad, it can take a few seconds, and then users drop off when it loads longer than two, three seconds. And something we also realized is identity wallets sound really nice, especially if you do it for one event, you have your ticket in the correct wallet, or credentials holder, and then as soon as you go to more conferences, you have multiple SuPath accounts, and it starts becoming hard to use, and we have to help people, what these identity wallets were built with in mind.

And then another thing with the privacy, so the ticket proof itself gets into your SuPath by being signed from Podbox, which is from Xerox PARC, and that is being fed with email addresses, so it's not end-to-end private in this setup. The second part where we generate a pod that is not consumed, so in the ticket proof, the pod is generated and consumed as a secret proof, and here it only lands in your SuPath, is one, an attendance card, which just has some information about the talk you attended, and then a second thing is your summary pod, which rewards your engagement. If you added a lot of good questions, and other people uploaded your questions, that means you added high-quality questions for the whole audience, and that's kind of summed up. And then if you open your SuPath, you see a list of all these little data nuggets that you collected, and that got generated. How does this—yeah, so if you zoom into one of these pods of the different kinds, then this looks like on the front, and on the back side of the POD, you would see the pod chasing with all the attributes that can be proven by a downstream app.

Okay, what does this look like? Yeah, the web app requests the attendance pod from the back end. It gets inserted into the app connector, gets linked to the SuPath server, at which point it shows up in the user's SuPath account. Once that link is complete, yeah, it successfully is in the SuPath account. And a quick look at the JSON itself.

What's important here is that each one has to have an owner. This prevents pods being sent between people just randomly exchanged, so it has to be owned by one person. They can't just forward it. This one is also signed, and then this part with your public key. And then I guess the middle part, from tracks to SuPath title, is the attributes that you can give the pod, and you can make it look however you want to.

All right, and then the last one is peer-to-peer, so speaker feedback. This actually lands in both the speakers and the attendees' SuPath, and this is where the attendee writes some feedback, and the speaker has a page where they collect it. In both parts, in order to click sign with the public key from the SuPath account, SuPath identity, the app connector opens as well as for connecting. So for the attendee, again, it requests from the app connector to sign the pod. It wants to give us feedback to the speaker.

Same stream gets inserted into, again, syncs with the SuPath server, sent to our back end, and once it's stored on our back end, then the speaker can come and pretty much do the same thing. Here's another example. It's relearning, so to do all of this, you have to have an identity connected to your app. In this case, we're using the SuPath identity, but it could be anything that works with it. Secondly, now you see we have a list of proofs that somebody can call on, and it's important to keep this downstream consumption of the pods in mind when building an app with it.

The third thing we noticed, at least at that time in November, client-side proving still needed some adjustment improvements. I'll skip to this part. I'll skip this also. What's next for us is... Actually, maybe this was...

This was actually a talk at the Web3 Privacy Hub yesterday upstairs, where they were talking about, okay, maybe this ties in with our experience. Maybe humans don't need one identity account that holds everything, but rather other kinds of temporary representations of your identity. At least that's also what we saw, how people use the SuPath. Okay, so for us, these are some future ideas we want to build in threads so that people can also answer audience questions, knowledge and trust graphs, such as circles, maybe even, if you're using that. I guess we have an open-source repo, so you're more than welcome to get in touch with us if you want to build on Meerkat or any of the pods.

Equally, if you're interested in using the app at an event, feel free to get in touch with us. I think I'm going to end it here and move to the questions, if there are any, to showcase that way as well. Okay, cool. Thanks for switching. What was a pivotal moment?

Maybe for explaining. Usually, if there is an MC, somebody would have an admin role and mark the questions as selected for answering, as I'm doing now, and then they can check it off. This is where the multiplayer game aspect comes in. What was a pivotal moment for getting product market fit? Yeah, product market fit.

I'd say we have some, but probably the most rewarding aspect was the surprise effect when we were at DEF CON and how many people then tweeted nice things and were really left interacting with the app. We talked to some of our top users who contributed, I don't know, 40, 50, 100 questions. Why they loved it, I think that was really rewarding and pivotal for us, and then also the support in the Ethereum ecosystem from the DEF CON team was really amazing when we brought the VIP and from TheraX Park as well. So probably those two things. Other people believing in it and giving good feedback on the usage itself that we could not have predicted.

Is this a startup, a non-profit? That's a really good question. So we started at the East Berlin Hackathon last year with the goal in mind we want to do something that lasts and has a real value. So at the East Berlin Hackathon we created a different product and then pivoted to this one. We did receive small grant funding from TheraX Park and currently it's, I guess, what you call in Germany a GBA.

It's two people working on it. I hope this answers the question. Okay, love that I don't need to sign into another application to interact. Yes, so the version you're currently using is the fully anonymous version. It's tied to your phone with a KWT token, so that's a little bit of a tricky thing.

But it's very lightweight and thank you for the feedback. Will you integrate more authentication methods? Feel free to find me after the talk because the time just ran out. Thank you so much for listening and I hope you enjoy the rest of DEF CON 2025.