Whitepaper v2.3
Lovelace — A Privacy-First Dating Ecosystem on Cardano
Document Version: 2.3
Release Date: March 2026
Official Website: posada.io/lovelace
Contact: info@posada.io
Executive Summary
Lovelace is a dating platform built on Cardano, designed to eliminate bots, scams, and data exploitation from online dating. We replace the extractive Web2 model with a privacy-enhanced ecosystem where identity verification happens on the user's device, incentives reward genuine interactions, and the architecture is designed to progressively decentralize as Cardano's infrastructure matures.
Our solution integrates Cardano's technology stack:
- Identus DID & Verifiable Credentials — Human-only, cryptographically verified identity. Live on iOS and Android.
- Halo2 Zero-Knowledge Proofs — Privacy-preserving age verification. Proof generation runs on-device; verification runs server-side. Live in production.
- Face Embedding Proof of Human — Designed to enforce one-person-one-account through facial geometry uniqueness checks. No photos stored in the identity verification system.
- $LILY Token — Utility backbone for rewards, premium features, and ecosystem participation. Aiken smart contracts on Cardano preprod with all current unit and preprod tests passing (26/26 + 5/5), prepared for external audit.
- Iagon Encrypted Decentralized Storage — User-owned profile data and chat history. Planned for integration after Lovelace production launch on Cardano mainnet.
- Hydra Head Channels — Instant micro-payments for gifts, tips, and rewards. Planned for integration after Lovelace production launch on Cardano mainnet.
- Midnight — On-chain privacy-preserving ZK verification. Planned for integration after Midnight reaches production readiness (post-Mohalu).
Lovelace is built by a solo founder-developer with AI-assisted development. An application for Orion funding ($90,000) has been submitted. The project is self-funded until external funding is secured.
1. The Problem: The Trust Crisis in Digital Dating
The current dating app market is dominated by platforms whose business models are fundamentally misaligned with user success:
- The Bot & Scam Epidemic: Fake profiles, romance scams, and catfishing are rampant. Traditional verification (phone, email, photo check) is easily bypassed.
- Data Exploitation: User data — photos, messages, preferences, behavioral patterns — is harvested, sold, and used for advertising and engagement manipulation.
- Perverse Incentives: Platforms are financially incentivized to keep users single, swiping, and paying. Their revenue model requires users to stay, not succeed.
- Barriers to Web3 Adoption: Existing blockchain social apps require users to understand wallets, seed phrases, and cryptocurrency before signing up — a massive friction barrier for mainstream users.
Lovelace addresses these failures at their core.
2. Our Solution: Privacy-Enhanced Dating with Aligned Incentives
- Human-Only Environment: Identus DIDs and Verifiable Credentials create a reusable, portable identity layer. Halo2 ZK proofs verify age without accessing documents. Face embedding uniqueness checks enforce one-person-one-account.
- Minimized Data Collection: We avoid storing raw ID documents, dates of birth, and biometric photos. Verification data is processed on-device wherever possible. Data that does reach our server (such as face embeddings, chat messages, and profile information) is stored on secured infrastructure with encryption in transit. As the architecture matures, sensitive data will migrate to Iagon decentralized encrypted storage where we hold no decryption keys.
- Frictionless Web3 Onboarding: Users experience a familiar sign-up. Behind the scenes, the system creates a Cardano wallet and Identus DID automatically. Crypto complexity is abstracted away. Fiat on-ramp via PIX (Transak/MoonPay) converts BRL to ADA/stablecoins merchant-side — users pay in their local currency and never need to acquire or manage cryptocurrency directly.
- Incentives for Positive Behavior: The $LILY token rewards users for verification, quality interactions, referrals, and reporting bad actors.
- Multi-Dimensional Matching: No single axis dominates. Users define their own filter priorities across gender, religion, country, language, sexual orientation, culture, age range, and distance. Custom user-created tags extend beyond the defaults.
3. Technical Architecture
Current Architecture (Beta)
+-------------------------------------------------------------+
| User Layer (Flutter Mobile) |
| - iOS (Codemagic CI/CD, TestFlight) |
| - Android (Codemagic CI/CD, Shorebird OTA patches) |
+----------------------------+--------------------------------+
| HTTPS / WSS
+----------------------------v--------------------------------+
| Application & Backend Layer |
| - Node.js / Express, PostgreSQL, Hetzner VPS |
| - Matchmaking Engine |
| - 26-Reward Engine (7 trigger categories) |
| - KYC: ML Kit MRZ scan + selfie + ZK proof + Identus DID |
| - Real-time chat (WebSocket, TLS encrypted in transit) |
| - Sentry crash reporting (technical data only, PII scrubbed)|
+----+------------+-------------------------------------------+
| |
+----v-----+ +---v------+
| Identus | | Halo2 |
| DID/VC | | ZK Proofs|
| [LIVE] | | [LIVE] |
+----------+ +----------+
| |
+------+-----+
|
+------v----------+
| Cardano |
| Layer 1 |
| (Preprod) |
+------------------+
Target Architecture (Post-Mainnet Launch)
+-------------------------------------------------------------+
| User Layer (Flutter Mobile) |
+----------------------------+--------------------------------+
| HTTPS / WSS
+----------------------------v--------------------------------+
| Application & Backend Layer |
+----+------------+-------------+-------------+---------------+
| | | |
+----v-----+ +---v------+ +---v--------+ +--v--------+
| Identus | | Midnight | | Iagon | | Hydra |
| DID/VC | | ZK Proofs| | Encrypted | | Head |
| | | | | Storage | | Channels |
+----------+ +----------+ +------------+ +-----------+
| | | |
+------+-----+--------------+--------------+
|
+------v----------+
| Cardano |
| Mainnet |
+------------------+
Layer descriptions:
- Cardano Layer 1: Secure settlement layer for $LILY token transactions, reward distributions, and Hydra channel state.
- Identus (LIVE): Decentralized identity. DID creation on-device, DIDComm connections, verifiable credential issuance. Operational on both iOS and Android. Infrastructure: Cloud Agent (Docker), PRISM Node, DIDComm Mediator.
- Halo2 ZK Proofs (LIVE): Age verification. Document scan and date of birth extraction happen on-device. Proof generation runs on-device. Server receives the proof rather than the date of birth or document contents. The Halo2 circuit is the first candidate for open-sourcing under the posada-io GitHub organization.
- Midnight (after Midnight mainnet): On-chain privacy-preserving proofs. Currently on testnet, deploying to mainnet. Lovelace will migrate ZK verification to Midnight when the network reaches production readiness (post-Mohalu, Q2 2026+). Until then, Halo2 server-side verification operates independently.
- Iagon (after Lovelace production launch on Cardano mainnet): Decentralized encrypted storage for user-owned profile data and chat history. Will replace current Hetzner VPS storage for sensitive user data. The design intent is for users to hold their own decryption keys.
- Hydra (after Lovelace production launch on Cardano mainnet): Layer 2 head channels for instant micro-payments — gifts, tips, and rewards within the app.
- Sentry (LIVE): Crash reporting. Captures technical error data only — stack traces, device info, screen navigation breadcrumbs. User ID is attached for debugging but no personal content (messages, profile data, photos) is transmitted. PII scrubbing is applied.
- Application Layer: Flutter mobile app (23+ screens), Node.js backend, PostgreSQL database, 18-language i18n system.
4. Identity & Proof of Human
4.1 Identus Decentralized Identity (Live)
The full Identus DID chain is connected and operational on iOS and Android:
- User completes KYC (document scan + selfie match via on-device ML Kit)
- Device creates a DID locally via the Identus Edge Agent SDK
- DID is registered with the backend
- Backend creates a DIDComm connection via the Identus Cloud Agent
- Device accepts the connection — DIDComm channel established
- Backend verifies age via ZK proof and issues a verifiable age credential over the connection
- Credential stored on-device, credential ID recorded server-side
If any Identus step fails, the user still passes KYC via the ZK proof alone. Identus is additive — it does not gate access.
4.2 Zero-Knowledge Age Verification (Live)
The KYC verification flow has distinct on-device and server-side stages:
On-device (runs without network connectivity):
- ML Kit MRZ reader scans the identity document (passport, ID card, or driver's license)
- Date of birth is extracted from the MRZ data
- A Halo2 zero-knowledge proof is generated proving age ≥ 18
- The raw date of birth is immediately discarded from device memory
Server-side (requires network connectivity):
- The proof (not the date of birth) is transmitted to the server
- The server verifies the mathematical proof
- The user is marked as age-verified
Users can verify the on-device nature of the scan and proof generation by enabling airplane mode — document scanning and proof generation complete without network access. Final server verification occurs when connectivity is restored.
4.3 Face Embedding Uniqueness (Live)
We designed one-person-one-account enforcement using facial geometry uniqueness checks:
- During KYC, ML Kit (configured for on-device processing only — no data transmitted to Google) extracts facial contour points and landmarks from the selfie
- A normalized geometric feature vector (~280 dimensions) is computed on-device
- The vector is sent to the backend and compared against all existing users via cosine similarity
- If similarity exceeds the threshold, the account is rejected as a duplicate
- The selfie photo used during KYC verification is not stored by the anti-duplicate system — only the mathematical vector is retained
- The vector is not designed to be reversible and cannot be practically reconstructed into a facial image
- Deleted from active systems when the account is deleted; purged from backups within 30 days
This is a probabilistic biometric matching system. It significantly raises the barrier to multi-account abuse but, like all biometric systems, operates within a confidence threshold rather than absolute certainty.
Legal classification: The face embedding is biometric-derived data under GDPR (Article 9) and LGPD (Article 11). It is collected only with explicit user consent during the verification process and treated with the corresponding level of protection.
Note on profile photos: Lovelace is a dating app. Users upload profile photos as part of normal use. These photos are stored on the backend for display to other users. The "no photo stored" commitment applies specifically to the identity verification and anti-duplicate system — not to voluntary profile content.
5. Current Data Architecture — Honest Assessment
Lovelace is a privacy-enhanced dating app with progressive decentralization. Today's live architecture is:
What runs on-device (never reaches our server):
- Identity document images
- Date of birth (extracted, used for proof, immediately discarded)
- Facial comparison between ID photo and selfie (ML Kit, on-device)
- DID private keys (Identus Edge Agent, device keystore)
- Verifiable credentials (stored on-device)
What our server holds today:
- Email address, display name, optional profile preferences
- Face embedding vector (biometric-derived data — mathematical, not a photo)
- Chat messages (encrypted in transit via TLS, stored in PostgreSQL)
- DID public identifier and credential ID references
- Profile photos (user-uploaded for the dating service)
- Crash reports (Sentry — technical data only)
- $LILY reward balances (simulated in database during beta)
What changes post-mainnet:
- Profile data and chat messages migrate to Iagon decentralized encrypted storage (user holds decryption keys, we cannot access content)
- Payments move to Hydra L2 (on-chain, no server intermediary)
- ZK verification moves to Midnight (on-chain, no server intermediary)
We minimize what we store and avoid storing raw identity documents or dates of birth. We do not sell, share, or monetize user data. If this ever changes, users will be notified in advance and explicit consent will be required. The architecture is designed so that each integration milestone reduces what our server holds, moving toward a model where we cannot access sensitive user content even if compelled.
6. $LILY Token Economics
6.1 Token Utility (Designed)
- In-App Rewards: Earned for positive actions (verification, referrals, quality interactions)
- Social Payments: Used for sending gifts between users
- Premium Access: Unlocks enhanced features and higher membership tiers
- Governance (Future): Token holders may govern treasury allocations and feature priorities
6.2 Current Status
Token utility logic is fully designed, smart contracts are tested, and reward accounting is implemented in the backend. During beta, all $LILY balances are simulated in the database. No real tokens move until the $LILY token is minted on Cardano mainnet and listed on DEX. Beta reward balances will transfer to users' mainnet wallets at launch.
6.3 Tokenomics
| Parameter | Value |
|---|---|
| Total Supply | 100,000,000 $LILY (fixed, no inflation) |
| Initial Circulation | 10,000,000 (10%) — beta reward pool |
| Treasury Reserve | 90,000,000 (90%) — locked, released by in-app action |
| Burn Mechanism | 20% of $LILY spent in-app is burned |
| Treasury Flow | 80% of spent $LILY returns to treasury |
| Policy ID (Preview) | 23ef4c204a8c9ed4169b39088a1b2af4c68a45bf3de5d4a290d09dc3 |
| Standard | CIP-0113 Programmable Token — transfers require soulbound Verified Human proof token on both sender and receiver |
| Smart Contracts | CIP-0113 Layer 3 validators: issuance logic, transfer logic, admin logic, blacklist, proof token. 24/24 tests passing. Registered on Preview testnet registry. |
| DEX Listings | Minswap + SundaeSwap (in-app swap widget planned) |
The gift Lily (🌸) = $1 USD worth of $LILY tokens. The token price will float freely on the DEX — the app dynamically calculates the $LILY amount per reward. Amounts display as "$X in Lily" to abstract token mechanics from non-crypto users.
6.4 Reward Engine
26 reward types across 7 trigger categories. 6 categories active in beta, remainder gated on feature completion.
6.5 Treasury Management
- Treasury will be managed via a 3-of-3 multisig wallet on Cardano. Signers: Founder/CEO, and a licensed Brazilian accountant (required by Brazilian corporate law as an independent third-party signatory). The multisig wallet will be created upon company formation in Brazil.
- Maximum 20% treasury exposure to any single liquidity pool
- On-chain transactions, publicly verifiable
7. Product — What's Live
As of March 2026:
| Component | Status |
|---|---|
| Flutter mobile app (iOS + Android) | 23+ screens, light premium UI |
| Identus DID (iOS + Android) | Full chain operational |
| Halo2 ZK age proof | Live — proof generation on-device, verification server-side |
| Face embedding uniqueness | Live |
| KYC (MRZ scan + selfie + ZK + DID) | Live |
| Real-time chat + gifts | Live |
| 26-reward engine | 6 categories active, rewards simulated in database |
| 18-language i18n | Live, server-push |
| Sentry crash reporting | Live, technical data only |
| Shorebird OTA (Android) | Live |
| Codemagic CI/CD (iOS + Android) | Live |
| 100 Elite tester licenses | Live, in-app claim |
| Version check + forced update | Live |
| Ambassador/affiliate referral | Live |
| Tester stats dashboard | Live |
| $LILY token on mainnet | Not yet — contracts on preprod |
| PIX fiat on-ramp | Not yet — Transak/MoonPay planned |
| Iagon decentralized storage | Not yet — planned post-mainnet launch |
| Hydra micro-payments | Not yet — planned post-mainnet launch |
| Midnight ZK on-chain | Not yet — planned post-Midnight mainnet |
8. Membership Tiers
Membership will be paid in ADA or stablecoins via the business wallet. The PIX fiat on-ramp (Transak/MoonPay) handles currency conversion merchant-side — users pay in BRL and never need to acquire or manage cryptocurrency. The converted ADA/stablecoins are credited to their in-app wallet automatically. $LILY wallets handle token transactions only (gifts, rewards, affiliate earnings).
| Tier | Monthly | Annual (15% off) | Distance | Key Features |
|---|---|---|---|---|
| Free | $0 | — | 5 km | Basic profile, local discovery |
| Starter | $4 | $40.80 | 25 km | Verified profile, affiliate program |
| Connect | $7 | $71.40 | 55 km | Priority matching, ambassador eligible |
| Premium | $12 | $122.40 | 200 km | ZK-verified, event access |
| Elite | $24 | $244.80 | Global | VIP perks, full feature access |
9. Matching System
Lovelace does not use a single primary axis for matching. All dimensions are equal — the user decides what matters to them:
- Gender — Man, Woman, Non-binary, Other (free text)
- Age range — Min/max preference
- Sexual orientation — Informational, displayed on profile
- Religion — Select from common options or free text
- Country — Detected from location or set manually
- Language — Must-share toggle for communication compatibility
- Culture — Free-text field for cultural identity
- Distance — Gated by membership tier
- Custom tags — User-created labels (e.g., "Vegan", "Dog person", "Gamer")
Matching is bidirectional — you only see people whose preferences also include you.
10. Go-to-Market Strategy
Target Markets
- São Paulo, Brazil — Primary launch market. PIX fiat on-ramp for frictionless payments. 212 million population, 175 million smartphones.
- Rio de Janeiro — Second city expansion
- Buenos Aires, Argentina — Regional expansion
- Seoul, Hong Kong — Asia-Pacific beachheads
- Europe — Post-mainnet growth phase
Target Users
- Privacy-conscious daters tired of data exploitation
- Cardano community members (early adopters, stress-testers)
- LGBTQ+ users seeking privacy-preserving platforms
- Young professionals (20s-30s) in urban markets
Growth Model
- Ambassador/affiliate referral program with $LILY rewards
- Beta testers receive Elite Lifelong membership
- Organic growth via privacy differentiation
11. Roadmap
| Phase | Status | Key Deliverables |
|---|---|---|
| Phase 1: Core Infrastructure | Mostly complete | Aiken smart contracts, Identus DID (iOS+Android), Halo2 ZK, KYC, face embedding, i18n, Sentry, CI/CD, license system |
| Phase 1 remaining | In progress | PIX on-ramp, $LILY minting, smart contract audit, matching/filter system |
| Phase 2: MVP & São Paulo | Next | City-specific launch, full reward engine, $LILY DEX listing |
| Phase 3: Scaling | After Lovelace production launch | Rio + Buenos Aires, Byron social network, Shelley messaging, Hydra payments, Iagon storage migration, 10k-30k MAU |
| Phase 4: Full V1 | After Midnight mainnet | Midnight ZK on-chain verification, video chat (WebRTC), 50k-100k MAU |
| Phase 5: Global | Long-term | Europe + Asia expansion, Leios consensus benefits (higher throughput reduces transaction costs for high-volume reward distributions), 100k-300k MAU |
12. Funding
Lovelace is currently self-funded by the founder. Revenue flows via Posada Bot (posada.io). An application for Orion funding ($90,000) has been submitted.
Initial Capital Requirements
| Item | Amount |
|---|---|
| Smart Contract Audit | $5,000–10,000 |
| Development Hardware | $3,000 |
| 6-Month Operational Runway | $23,000 |
| Total Initial Capital | $31,000–36,000 |
Year 1 Operating Budget (Post-Funding)
| Category | Amount | Purpose |
|---|---|---|
| Liquidity Pool | $30,000 | Initial $LILY/ADA and $LILY/USDM pools |
| Infrastructure | $100,000 | Hosting, Iagon migration, affiliate programs, AI customer service |
| Total | $130,000 |
The gap between initial capital ($31–36k) and Year 1 operating budget ($130k) is expected to be bridged by: Orion funding ($90k if approved), $LILY token sale proceeds from initial DEX offering, subscription revenue from paid membership tiers, and Posada Bot revenue. If external funding is not secured, the project will operate within founder funding and scale more gradually.
13. Competitive Positioning
| Feature | Web2 Apps | Emerging Web3 | Lovelace |
|---|---|---|---|
| Human Verification | Basic photo check | Early DID trials | Identus DID + Halo2 ZK + face embedding |
| Data Storage | Company servers, sold to third parties | Varies | Centralized during beta, migrating to Iagon user-owned storage |
| Payments | Centralized, slow | On-chain, UX friction | PIX fiat-first, Hydra post-mainnet |
| Onboarding | Simple but data-heavy | Crypto knowledge required | Auto-wallet, PIX, zero crypto knowledge |
| Privacy | GDPR-compliant only | Pseudonymous | ZK proofs (no DOB stored), on-device verification, face math not photos |
| OTA Updates | App store only | App store only | App Store + Shorebird patches |
14. Strategic Value to Cardano
- Mainstream User On-boarding: Fiat-first PIX flow brings non-crypto Brazilians into Cardano wallets automatically
- Real Network Usage: Dating activity, gifts, and rewards generate sustained transaction volume
- Ecosystem Showcase: Single consumer product demonstrating Identus and Halo2 ZK (live), with Hydra, Midnight, Iagon, and Leios integrations planned
- Sustainable Token Model: $LILY designed for utility and deflationary pressure, not speculation
- Geographic Beachhead: São Paulo → Rio → Buenos Aires → Seoul → Hong Kong mirrors Cardano's growth regions
15. Risk Assessment
| Risk | Mitigation |
|---|---|
| Midnight mainnet delays | Halo2 ZK runs independently. Migration to Midnight is additive, not blocking. |
| Iagon integration complexity | Current architecture is functional. Iagon migration is an improvement, not a prerequisite. |
| User acquisition in competitive market | Privacy differentiation + PIX on-ramp + referral rewards. Dense geographic launches. |
| Regulatory (KYC/AML for token apps) | ZK age verification, licensed fiat ramp providers, LGPD/GDPR compliance by design |
| Token liquidity | Active treasury management, 20% pool exposure cap, deflationary burn mechanism |
| Single developer risk | Comprehensive documentation, AI-assisted development (Claude Code), modular architecture. |
| Face embedding evasion | Threshold is tunable. Combined with DID uniqueness and document verification, multi-layer defense. No single system is absolute. |
16. Team
- Alain "Diesel" Da Silva Lohals — Founder and CEO. Product vision, full-stack development, go-to-market, and operations.
- AI-Assisted Development: Claude Code for accelerated development across Flutter, Node.js, Aiken, and infrastructure. AI-assisted development significantly reduces the need for a traditional core team in the early stages.
- Brazilian Accountant (post-company formation): Required by Brazilian corporate law. Will serve as independent third-party multisig signatory.
Disclaimer
This whitepaper outlines the current vision, technology, and plan for Lovelace. It is for informational purposes only and does not constitute a financial offering or guarantee of future performance. The roadmap is subject to change based on development, market, and regulatory conditions. Technology integrations marked as "planned" or "post-mainnet" are dependent on third-party infrastructure readiness and may be delayed or modified.
© 2026 Posada.io / Lovelace — Built on Cardano