Research-backed workflow. Prototype system. Simulated farm scenarios. Real testnet verification.
Count first.
Compare later.
Field inspections that conceal the pass threshold, preserve the original result and give buyers a record they can independently verify.
Sealed records prove what was submitted. They do not prove a count was true.
Count what you observe. The programme target is intentionally hidden.
One cohort, four irreversible steps
Revealing a shared threshold after the first audit would compromise every remaining one. So the reveal unit is the whole cohort, enforced by the server and by the registry contract.
- 1
Count
The auditor records what they observe on a phone. The pass threshold is never sent to their device.
- 2
Seal
The device signs the first submission. A salted commitment is anchored on an EVM testnet, so the original can't be quietly rewritten.
- 3
Close
Only when every assignment in the cohort is sealed or voided does the registry allow closure, and only then is the target disclosed.
- 4
Verify
A buyer or verifier checks the proof packet against the chain themselves, without a BlindCount account.
Why conceal the number
A 2026 randomized study of 407 cocoa farms in Côte d'Ivoire found that verifiers who could see the pass threshold amended failing counts far more often: about 25% excess manipulation, against about 11% when the threshold was concealed. We reproduced both figures from the authors' public data. BlindCount turns that intervention into enforced software.
See the reproduction- What a sealed record proves
- The exact payload, device signature and receipt time existed before the criterion was disclosed, and nobody has changed them since.
- What it cannot prove
- That the count is true, that a photo shows this farm, or that people did not collude outside the app. Reviewers still decide.