Trust boundary
Lullad privacy and anti-fraud, by design
Rewarded attention creates two risks at once: over-collection and fraud. The safest design minimizes client data first, then verifies the small event surface that remains.
What the client sends
A client needs an account-scoped device credential, an ad request, and a signed event token with dwell time. A click passes through a Lullad redirect so the server can verify it before sending the browser to the advertiser.
What stays out of the loop
The CLI uses lifecycle hooks and the extension looks for generating controls or short status labels. Neither needs conversation content to decide whether an agent is busy.
- Prompt and response text.
- Terminal output and repository files.
- Conversation-derived targeting categories.
- Cross-site advertising fingerprints.
- User identity disclosed to advertisers.
Fraud controls protect both sides of the market
Signed tokens and unique event IDs block replay. Minimum dwell rejects impossible exposure claims. Shared database rate limits work across server instances. Atomic daily counters prevent concurrent requests from crossing reward caps, and campaign reservations prevent budget oversell.
Referrals reward use, not account creation
A referral begins pending. Both bonuses unlock only after the invitee earns the configured threshold from verified ad activity. The two ledger entries and completed state commit in one transaction; if either side hits a cap, neither gets a partial payout.