How it works
Patina turns the history in accounts you already own into a number somebody else can check. This page is the whole of it: what gets read, what survives, what the number means, and where it stops being true.
If you are building against it rather than being scored by it, the developer docs are the other half.
Connecting
Connecting runs through Vana Desktop, an app that opens a browser window on your own machine and asks you to sign in to the account you are connecting. That sign-in happens locally. Patina never sees a password, never holds a token, and cannot sign in as you afterwards.
What comes back goes to your own Personal Server on Vana, and Patina pays a small fee to read the parts you approved, once. You can revoke that access at any time, and deleting your Patina profile takes everything we derived from it with it.
The old version of Patina read public pages from a username you typed, which meant anybody could type anybody's. This one cannot be done on somebody else's behalf, which is the whole reason it now needs a computer.
The number
Everything here is expensive in time rather than in money. Follower counts are the most purchasable number on the internet, so they are worth about two points out of a hundred, and we would rather say that than pretend otherwise.
The last three are gated behind the first three. Somebody can open six accounts, upload a thousand things and buy three thousand followers in an afternoon, so volume and breadth only count to the extent that real elapsed time sits underneath them. There is a floor, though: a nineteen-year-old with a genuine three-year account is not a fraud and is never scored as one.
Every source
Every one of these is requested for its dates. The content that arrives attached is not wanted, is not scored, and is thrown away before anything is written down. The second line under each is the one that matters.
Timestamps themselves are rounded to the month before they are stored. Knowing you saved twelve tracks in March 2019 tells us what we need; knowing the exact minute tells us things that are none of our business.
Years of commits, pull requests and the people who responded to them.
History
Every pull request and issue you have opened, and when.
The dates. Never the titles or the text you wrote.
Contributions
Your contribution graph, day by day, for the last four years.
How many contributions fell in each month.
Profile
Followers, organisations you belong to, and achievement badges.
The counts.
Repositories
The list of repositories on your profile.
How many there are.
When other people chose to connect to you, going back years.
Your connections list has other people's names in it. We read only the date each connection was made, and their names are discarded before anything is saved.
Connections
The date each of your connections was made.
Only those dates. Never names, headlines or profile links.
Experience
The date ranges on your roles.
The earliest year. Never employers, job titles or descriptions.
Education
The years on your education history.
The earliest year. Never schools, degrees or grades.
Profile
Your connection count.
The number.
A decade of saved tracks, each one stamped with the day you saved it.
Saved tracks
When each track in your library was saved.
How many you saved each month. Never the songs, artists or albums.
Playlists
When tracks were added to your playlists.
Those dates, and how many playlists you have.
Profile
Your follower count.
The number.
How far back your posts go, and how steadily they came.
Instagram sends the username of everyone who liked each post. We do not read that list at all, and it is thrown away before anything is saved.
Posts
The date each of your posts was taken.
Only the dates. Never captions, images, likes, or who liked them.
Profile
Your follower and post counts.
The numbers.
Often the oldest account a person still has, plus friendships with dates on them.
Your friends list has other people's names in it. We read only how long each friendship has existed, and the names are discarded before anything is saved.
Profile
The day your Steam account was created.
That date.
Friends
How far back each friendship goes.
Only those dates. Never names, avatars or profile links.
Games
How many games you own and when you last played them.
The count and the dates. Never which games.
The day your account was opened.
Profile
Your join date, video count and subscriber count. Google also sends your email address.
The join date and the counts. Your email is never read or stored.
A long, dull, unmistakably human paper trail.
Orders
The date of each order.
How many orders fell in each month. Never what you bought or what it cost.
How far back your rides go.
Trips
The date of each trip.
The dates. Never pickup or dropoff addresses, fares, or cities.
Another independent record of ordinary weeks.
Orders
The date of each order.
The dates. Never restaurants, items or addresses.
Orders across many merchants, from one connection.
Orders
The date of each order.
The dates. Never merchants, items or totals.
Before it is shareable
You do not need to own ten different websites to get a page and a badge. Connect one account that proves a real date and you have one. Everybody has a different number of accounts, and a rule that only rewarded people who happened to have a lot of them would be measuring the wrong thing.
Connecting more still helps, and it should: a second unrelated account agreeing with the first is genuinely much harder to arrange than one on its own, and the score says so. But it costs points rather than the whole credential. Somebody with two accounts and a real decade behind them scores in the seventies, and that number is theirs to share.
The one thing that cannot be signed is a profile where nothing carries a date at all. A Patina badge is a statement about how far back you go, and with no date there is nothing to put in it. That case is marked provisional, and should be read as no evidence either way, never as a warning about the person.
Where it stops
Patina reports how much history it can see behind accounts you own. That is evidence, and good evidence, but it is not a certificate that you are human. If an app needs to know you are exactly one living person right now, Patina is the wrong tool and says so.
Young accounts score low. So do private ones, and quiet ones, and anybody who has only ever used two services. None of that is suspicious and none of it is a judgement about you. A low score means we cannot see much, not that there is nothing there.
They can. What that does is turn a free attack into an expensive one whose price climbs with every year and every extra platform. It does not make it impossible, and anybody telling you their sybil check is impossible to beat is selling something.
Vana Desktop asks you to sign in on your own machine, which proves whoever is at that machine holds the credentials. A bought account comes with its password. This moves the bar a long way up from typing a username, and it is still not the same word as owning it.