For judges

Does the data come from the source's own servers?

Duolingo's own servers, read through an attested fetch the day the lesson is done: when the gift's page is opened after the lesson, or within the hour. A gift made on the second version of the contract is read the morning after its day ends. The reading is signed by Reclaim's attestor and Viky checks that signature, the address that signed it and the request it was about, before a day can count. Nobody types a number, and the person never touches the proof. When the gift is made on one course, the reading is anchored on that course's id, so experience won in another course is not in it.

Is the account theirs?

Proved once, before anything counts: either the funder names the Duolingo account when they offer the gift, or the person puts a short code in their Duolingo display name and Viky reads it there.

Who acted on the account?

Unknown, and it is the honest answer: the reading proves what that account did, never who did it. Somebody else with the password, or a script, would read the same. Duolingo describes no proctoring and verifies no identity.

What does the source do against cheating?

Duolingo's own rules forbid scripts written to cheat and forbid scraping, and its terms let it delete an account for it. It publishes no anti-cheat status a third party can read, so Viky has nothing to check against: this is the weakest of the conditions on that question, and it is said here rather than left to be found.

Does the data come from the source's own servers?

Codeforces' public API, `user.info`, read through an attested fetch when the person binds the account, when the climb starts and when its target is reached: the handle as the site spells it, the rating, the best rating ever, and once the last name where the binding code was put. Nothing else is matched. An account with no rated round yet has no rating and can bind nothing.

Is the account theirs?

The funder writes the handle; the person proves the account is theirs by putting Viky's code in the last name of their Codeforces profile before the first reading, or the funder's own naming stands. The identity kept is the handle, in lower case.

Who acted on the account?

Unknown: Codeforces records what the account submitted in its rated rounds. Whether the person behind the account solved is not read.

What does the source do against cheating?

Codeforces judges every submission itself, punishes plagiarism with a rating rollback and a public note, and makes a round unrated when it fails; its API is public and asks for no key (one request every two seconds). Its terms forbid commercial use of the website's material and any use that harms it; Viky looks at one account's line every hour while a gift is climbing on it, in the day's two passes, and once a minute while that gift's page is open, for an account its holder bound with Viky's code, naming itself. Written on the judges' page.

Does the data come from the source's own servers?

Two public records of the same badge, read through an attested fetch and read again at every reading: the Open Badges assertion, which says the day and carries the issuer's id and the badge class's id, and the badge's public page, which is the only place the holder's name is published. Three things come out of them and nothing else. The assertion also carries the holder's email address, hashed: Viky's server reads the whole assertion when it looks at the badge, and nothing here matches that address or keeps it.

Is the account theirs?

The funder names the person and chooses the certification, and both are hashed into the terms they sign, so a badge for another certification or in another name pays nothing. The certification is decided by the pair of ids Credly publishes rather than by a title, which can be edited or reused. Two people of the same name who earn the same certification inside the same days cannot be told apart by this, because the page has no field its holder can edit: that gap is written down rather than dressed up.

Who acted on the account?

Unknown: nothing describes how the work behind the badge was supervised, and it varies by issuer. What is different from a certificate a site prints for its own course is that the issuer is a third party who awards the badge, so nobody can award one to themselves.

What does the source do against cheating?

Credly hosts what issuers award and does not mark the work: a badge can be revoked by its issuer, and a holder can make it private again, and both stop the reading, because the two records are read again every time. Nothing published says a badge was earned under supervision.

Does the data come from the source's own servers?

The public record Accredible publishes for the credential (the JSON its page is drawn from), read through an attested fetch when the person shares its link, and again at every reading: the title, the issuer's website, the day of issue, whether it is private, expired or revoked, and the name on it. Its recipient's masked email is matched and never taken.

Is the account theirs?

The funder names the person and the credential by its title and its issuer's website, and all three are hashed into the terms they sign, so a credential with another title, from another issuer or in another name pays nothing. Two people of the same name with the same credential in the same window cannot be told apart.

Who acted on the account?

Unknown: what stands behind a credential varies by issuer, and Accredible describes none of it. What differs from a certificate a site prints for its own course is that an issuer, a third party, awards it.

What does the source do against cheating?

The issuer awards and can revoke the credential, and Accredible publishes whether it is revoked or expired, which the reading checks. Accredible's terms (April 2026) are a contract with issuers and name no automated access; nothing about a reader is claimed.

Does the data come from the source's own servers?

The page of the person's own student portal, shown by them: they sign in there, in a verification tab, and what the page carried is proved by an attestor in a TEE where the university's provider is a classic one, or by the signature of Viky's pinned witness on the provider's own domain where it is an AI provider, with no enclave: one field, the enrolment the university's enrolment provider reads, matched against its pattern. Viky keeps that it said enrolled and the day, and nothing else; the password never reaches Viky. A university without an enrolment provider yet takes the gift, and the provider is built within two days; the first proof under a rule Reclaim's agent wrote is read by the operator before anything pays, and where the operator fixed the rule ahead, from a version Reclaim publishes, the first proof that fits it is paid at once and one that does not is held.

Is the account theirs?

The funder chooses the university from the list, and it is hashed into the terms they sign; a page shown from another university pays nothing. Who holds the portal's account is not proved: a shared student account is a shared student account.

Who acted on the account?

Unknown. Signing in to a portal is one person's act, and nothing says who sat in class.

What does the source do against cheating?

Each university polices its own enrolment: a portal says enrolled because the registrar recorded it. What a portal's terms say about a program reading its pages is not read portal by portal (the judges' page says so), and a portal that changes its page stops proving until its provider is built again.

A year's results are published at its end: a gift made during the year waits for them, and a page of an earlier year does not count.

Does the data come from the source's own servers?

The results page of the person's own student portal, shown by them: they sign in there, in a verification tab, and what the page carried is proved by an attestor in a TEE where the university's provider is a classic one, or by the signature of Viky's pinned witness on the provider's own domain where it is an AI provider, with no enclave: the one field that says passed, matched against the results provider's pattern, and the year's field where the page dates itself, so a page of another year pays nothing. Viky keeps that it said passed and the day, and nothing else; no grade is read and the password never reaches Viky. A university without a results provider yet takes the gift, and the provider is built within two days; the first proof under a rule Reclaim's agent wrote is read by the operator before anything pays, and where the operator fixed the rule ahead, from a version Reclaim publishes, the first proof that fits it is paid at once and one that does not is held.

Is the account theirs?

The funder chooses the university from the list, and it is hashed into the terms they sign under this condition's own name; a page shown from another university, or a proof of enrolment on the same one, pays nothing. Who holds the portal's account is not proved: a shared student account is a shared student account.

Who acted on the account?

Unknown. Signing in to a portal is one person's act, and nothing says who sat the exams.

What does the source do against cheating?

Each university polices its own exams and publishes the result on its own portal: the page says passed because the jury recorded it. What a portal's terms say about a program reading its pages is not read portal by portal (the judges' page says so), and a portal that changes its results page stops proving until its provider is built again.

A year's results are published at its end: a gift made during the year waits for them, and a page of an earlier year does not count.

Does the data come from the source's own servers?

The results page of the person's own student portal, shown by them: they sign in there, in a verification tab, and what the page carried is proved by an attestor in a TEE where the university's provider is a classic one, or by the signature of Viky's pinned witness on the provider's own domain where it is an AI provider, with no enclave: the one field that holds the grade, read on the scale the results provider declares (out of 20, a GPA out of 4, or out of N in a step; a scale of letters is declared and refused when the gift is made), and the year's field where the page dates itself, so a page of another year pays nothing. Viky keeps that the grade reached the target and the day, and nothing else: the grade itself is kept nowhere, except on the first proof ever shown from a university's page, which is held until a person at Viky has read it and erased when they decide. The password never reaches Viky. On a university whose results page is not read yet, the funder chooses the scale (out of 20, 4 or 100, or letters, ranked in one order), and the first proof the operator reviews pins the university's own: a gift made on another scale is refused, and nothing is paid.

Is the account theirs?

The funder chooses the university from the list and sets the grade on its own scale; the university is hashed into the terms they sign under this condition's own name, so a page shown from another university pays nothing, and Viky compares the grade shown with the target in the same hundredths: what the contract receives is the target, as the verdict, never the grade. Who holds the portal's account is not proved: a shared student account is a shared student account.

Who acted on the account?

Unknown. Signing in to a portal is one person's act, and nothing says who sat the exams.

What does the source do against cheating?

Each university polices its own exams and publishes the grade on its own portal: the page carries what the jury recorded. What a portal's terms say about a program reading its pages is not read portal by portal (the judges' page says so), and a portal that changes its results page stops proving until its provider is built again.

Does the data come from the source's own servers?

The page ETS shows to the account holder once they have signed in, read in a Reclaim verification the person opens from their gift's page: one request to ETS's own servers, attested by a witness in a TEE, and two fields, the total score and the booking it belongs to. No name, no test date, no photograph. ETS's own terms on that reading were not read for this line, and that question stands.

Is the account theirs?

The link is the account the person signs in to, in their own browser, and the gift's own recipient, which the contract checks. No name is typed by the funder and none is read from the page: the subject the funder signs is the same for every gift on this condition, and that is written down rather than dressed up.

Who acted on the account?

Unknown to Viky: the proof says which ETS account was signed in to, not who sat the test. ETS's own pages on identity checks and proctoring were not read for this line, so nothing is claimed about them here.

What does the source do against cheating?

Not read: what ETS does about a score it cancels, and whether a cancelled score leaves the account page, are ETS's rules and were not read for this line. The only thing Viky reads is what the page shows on the day it is shown.

Does the data come from the source's own servers?

The page of the certificate its taker chose to make public, read through an attested fetch that takes three fields and no more: the score, the day of the test, and the name printed on it. The same answer also carries a date of birth and a photograph: Viky's server reads the whole answer when it looks at the link, and keeps neither. The link is read again at every reading, so a certificate taken private again or past its two years stops paying, and says which. That reading is made by a program, which is the act Duolingo's terms ask to be asked about first, and that question has not been asked.

Is the account theirs?

The funder types the name the person will sit the test under, and it is hashed into the terms they sign. A certificate in another name pays nothing. Two people with the same name cannot be told apart by this, because the page has no field its holder can edit: that gap is written down rather than dressed up.

Who acted on the account?

Known, and this is the only condition where it is: Duolingo records the session, checks a valid identity document, and has qualified examiners review it before a score is released.

What does the source do against cheating?

Duolingo may invalidate a result after it has been certified and notify everyone who received it, and it says so in its own terms. A certificate can also be taken private again by its holder, and expires two years after the test. All three are visible in the reading Viky already makes.

Does the data come from the source's own servers?

The public page edX publishes for the certificate, read through an attested fetch when the person shares its link, and again at every reading: the organisation and the course's number, its printed name, the track, the holder's name, the day of issue and the certificate's own id. Nothing else is matched. A certificate edX withdraws answers 404 and stops paying.

Is the account theirs?

The funder names the person and the course, and both are hashed into the terms they sign, so a certificate for another course or in another name pays nothing. Two people of the same name who finish the same course inside the same window cannot be told apart, as on Coursera.

Who acted on the account?

Unknown: edX verifies the learner's identity for the verified track and describes no supervision of each assignment.

What does the source do against cheating?

edX issues the certificate on a passing grade in the verified track, after an identity check, and publishes a page per certificate. Its terms (11.6, updated 3 Nov 2025) forbid accessing the service through robots or crawlers other than edX's own, which Viky's one reading per shared certificate is: written on the judges' page, the risk assumed as for Duolingo and Coursera.

Does the data come from the source's own servers?

The public page MITx Online publishes for the certificate, read through an attested fetch when the person shares its link, and again at every reading: the course or program's title, the holder's name, the day of issue and the certificate's own id. Nothing else is matched. A certificate that is revoked answers 404 and stops paying.

Is the account theirs?

The funder names the person and the course by its title, and both are hashed into the terms they sign, so a certificate for another course or in another name pays nothing. Two people of the same name who finish the same course inside the same window cannot be told apart, as on edX.

Who acted on the account?

Unknown: MITx Online issues a certificate on a passing grade in the paid track; its terms describe identity-verified proctoring for some courses only, and the page does not say which.

What does the source do against cheating?

MITx Online issues the certificate at its own discretion, under its own name, and can revoke it (a revoked certificate's page answers 404). Its terms forbid scraping or downloading its content in bulk and allow personal, noncommercial use of site content, which Viky's one reading per shared certificate sits beside: written on the judges' page, the risk assumed as for edX.

Does the data come from the source's own servers?

The public page of the certificate, read through an attested fetch when the person shares its link, and read again at every reading: four things come out of it and nothing else, the name on it, the course, the certificate's own code and the day it was granted. That reading is made by a program, which is the act Coursera's terms ask to be asked about first, and that question has not been asked.

Is the account theirs?

The funder names the person and the course, and both are hashed into the terms they sign, so a certificate for another course or in another name pays nothing. Two people of the same name who finish the same course inside the same days cannot be told apart by this, because the page has no field its holder can edit: that gap is written down rather than dressed up.

Who acted on the account?

Unknown: Coursera describes no supervision of each assignment.

What does the source do against cheating?

Coursera verifies identity once per account, with an official document and a selfie, and says some programmes require it while others only check a name. Nothing published says a certificate was earned under supervision.

Does the data come from the source's own servers?

Chess.com's public API, read through an attested fetch when the climb starts and when its target is reached, and checked the same way as Duolingo. The rating read is the one Chess.com publishes for that cadence, with its own reliability figure beside it.

Is the account theirs?

The funder names the Chess.com account when they offer the gift, and that naming is the whole tie: no code is asked, so whoever opens the link is paid when that account gets there.

Who acted on the account?

Unknown here too: the rating belongs to the account. What is different is that Chess.com hunts exactly that, and says so publicly.

What does the source do against cheating?

Chess.com polices engine use, outside help, account sharing and arranged results itself, publishes the sanction in the same API Viky reads (`status: closed:fair_play_violations`), and Viky refuses a closed account at every reading, so a gift is never paid on an account its own source has closed.

Does the data come from the source's own servers?

Chess.com's public API, the same page as the rating, read through an attested fetch and checked the same way. What is read is `tactics.highest`, the best puzzle rating that account ever reached: it never goes down, so nothing the person does after beating their record can take the gift away from them.

Is the account theirs?

The funder names the Chess.com account when they offer the gift, and that naming is the whole tie: no code is asked, so whoever opens the link is paid when that account gets there.

Who acted on the account?

Unknown, and less watched here than in a game: a puzzle is solved alone against a clock, with no opponent and no game anybody can examine afterwards. The reading proves what that account reached, never who was at the keyboard.

What does the source do against cheating?

Chess.com closes an account for a Fair Play violation and publishes it in the same API Viky reads (`status: closed:fair_play_violations`), and Viky refuses a closed account at every reading. What it does not publish is anything about puzzles: read on 20 Sep 2026, neither its Fair Play policy nor its help centre article on Fair Play mentions the puzzle rating, and what they forbid is written about play. So nothing tells us this number is policed the way a rating is, and this condition is the weaker of the two on that question.

Does the data come from the source's own servers?

The person's own list of results on the World Cube Association's public API, read through an attested fetch when the person asks after the competition, and again at every reading: the row of that competition, that event and the round of their best single, with the name and the times as the WCA prints them. Nothing else is matched. An attempt that is a DNF has no time there and pays nothing.

Is the account theirs?

Three ties: the person's name, written by the funder at creation and hashed into the terms they sign, never published; the competitors list of the competition, public, on which the person has to be registered in the event before the first day (that stands in for a bib); and the WCA's own results, which have to carry that name with a result in that event. The name is compared with no case, no accents and no order.

Who acted on the account?

The WCA's judges: every attempt at a WCA competition is timed and checked by a judge, the examiner of that attempt, under the WCA Regulations, at a table in the venue.

What does the source do against cheating?

The WCA governs the competition under its Regulations and can invalidate results and review incidents; its results are published for everybody and, by its privacy statement, are not personal data. Its API is public and asks for no key; its export may be re-published with a notice that the results are the WCA's. Written on the judges' page.

Does the data come from the source's own servers?

The Google Health API's own daily roll-up of active minutes (`dailyRollUp` on `active-minutes`, the successor of the Fitbit Web API), read each morning through an attested fetch with the person's own key handed to the fetch as a secret the attestor never sees: the reading is signed by Reclaim's attestor, and Viky checks that signature and the request it was about, its body included. Only minutes recorded by Google's and Fitbit's own wearables are asked for, not minutes logged by hand; what is read is the moderate and vigorous minutes of the day; what is signed for the contract is the verdict alone, so the chain and the journal hold a yes or a no and never a number of the person's. The roll-up is judged and dropped: no proof of it is stored.

Is the account theirs?

The person connects their own Google account once, on Google's own page, in their own browser, after the consent screen says in Viky's words what the funder will be told and what they will never see. The pseudonym of that account's Google Health user id is bound at the first reading, and a key Google stops honouring ends the reading until the person connects again; disconnect and erase is theirs at any time, and gives the key back to Google first.

Who acted on the account?

Unknown: the roll-up says what the account's tracker recorded, never who wore it. Google describes no check of who moves.

What does the source do against cheating?

Google polices nothing about who moves, beyond leaving out intervals a wearable was not worn. Its Google Health API Developer Terms and its Developer and User Data Policy (both of 24 Mar 2026, read 23 Sep 2026) frame what Viky does: use limited to the feature the person asked for, a transfer to a third party only to provide it and with their consent, the disclosure shown immediately before the consent, deletion honoured on request, no human reading the data; the consent screen, the verdict-only reading and the erase button are those, and the judges' page says so.

Does the data come from the source's own servers?

Strava's own API, the list of the day's activities, read each morning through an attested fetch with the person's own key handed to the fetch as a secret the attestor never sees: the reading is signed by Reclaim's attestor and Viky adds the distances, judges the day and drops the list, its routes and its times with it. What reaches the contract is the verdict, never a number of the person's.

Is the account theirs?

The person connects their own Strava account once, on Strava's own page, in their own browser, after the consent screen says in Viky's words what the funder will be told and what they will never see; Strava sends back what they allowed, and without the activities nothing is kept. The pseudonym of that account's athlete id is bound on the chain by the first reading, so another account cannot count for this gift, and the contract checks the recipient.

Who acted on the account?

Unknown: the list says what the account recorded, never who carried the phone or the watch, and an activity can be entered by hand. Strava describes no check of who moves.

What does the source do against cheating?

Strava polices nothing about who moves; it flags some activities as suspect on its own site and that flag is not read here. Its API Agreement (read 23 Sep 2026) frames what Viky does with Strava Data: used to serve the person who authorised it and nobody else, neither aggregated across people nor shown to others, deleted when they ask. The verdict-only reading, the consent screen and the erase button that gives the key back first are those three; the funder's daily yes or no is the one bit that leaves.

Does the data come from the source's own servers?

The runner's own page on the timing company's results site, read through an attested fetch when the person asks after the race, and again at every reading: the name and the bib in its title, and the official time. Nothing else is matched. A runner who did not finish has no time there and pays nothing; a bib nobody wore answers an empty page.

Is the account theirs?

Three ties: the runner's name, written by the funder at creation and hashed into the terms they sign, never published; the bib, entered by the person on the gift's page before the day of the race (the field closes at 00:00 that day, where the race is run); and the timing company's line for that bib, which has to carry that bib, that name and a finish time. The name is compared with no case, no accents and no order. Two runners of the same name in the same race with bibs entered before the day of the race cannot be told apart.

Who acted on the account?

Unknown: the timing company records who crossed the line wearing the bib. Whether the person wore their own bib is not read.

What does the source do against cheating?

The timing company chips the bib and publishes the results for the organiser; a runner can ask the federation to be removed from them. Klikego's terms (CGU of 26 Jun 2026, and its legal notice) claim the site's content and its database, forbid reproduction without written consent, and count the use of robots among the reasons to close a member's account: Viky reads one runner's page per gift, when the person asks, and keeps three fields; written on the judges' page, the risk assumed as for edX.