Today
The browser saves on this device with localStorage.
Refreshing does not erase the checklist.
The simple version
After setup
The same save also goes to a private cloud record. Another family device with the link can load it.
PRESS SAVE → BROWSER SAVES FIRST → CLOUD TRIES SECOND
cloud
down? The local device keeps working.
cloud back?
The next load tries again.
The private family link
sidequest…#house=LONG-RANDOM-KEYThe key stays after # so it is not sent in page requests
The server turns the key into a scrambled record name. It does not store the key itself and cannot list family keys.
Safe to save
Checklist boxes, scene number, completed clues, small game settings.
Never save
Names, photos, recordings, door codes, passwords, or device-control secrets.
Put the link in a family password manager or send it directly between trusted devices. If the link is lost, access to that cloud record is lost too.
When two devices save
01
Each save carries a revision
The server accepts a save only when it was based on the newest copy.
REV 7 → SAVE → REV 8An old REV 6 save gets 409 instead of erasing new
progress
02
Merge checkmarks with OR
For "once checked, stays checked," combine both lists so a check on either device wins.
✓ □ ✓ + □ ✓ ✓ = ✓ ✓ ✓Do not use this rule for Reset
Check
Two devices can finish different steps without losing either.
Reset rule
Load the newest revision, then save one explicit cleared list.
Grown-up technical setup
Connect Neon on Vercel
- Open the Vercel project. Add Neon Postgres from Marketplace storage and choose the Free plan.
- Connect it to Sidequest and enable the needed environments.
-
Add sensitive variable
SIDEQUEST_STATE_PEPPER. Generate at least 32 random bytes withopenssl rand -base64 48. -
Confirm that Vercel added
DATABASE_URL. The endpoint creates its small tables on first use. - Redeploy.
Server only
DATABASE_URL and
SIDEQUEST_STATE_PEPPER never go into browser
JavaScript or the repository.
Built-in guardrails
- Same-origin POST requests. No public CORS.
- 32-byte random family keys and HMAC-SHA256 record names.
- Atomic compare-and-set writes.
- 12 KiB maximum state, bounded nesting, values, keys, and strings.
- 120 API operations per ten-minute IP window.
- Five-second database timeout and no-store responses.
- No accounts, email, names, tracking, recordings, or control secrets.