KATHA

The starting page for the project should look like this.

Inspiration

Every place we love holds moments nobody wrote down: the park bench where someone made a hard decision, the bus stop where a newcomer finally felt at home, the hospital waiting room where a family got good news. Thousands of people have felt something in the same spots we pass every day, and we'll never know what.

Meanwhile, the apps we use daily pull us away from where we're standing. Feeds reward whoever posts the most and the loudest, and a post "from" somewhere could have been written anywhere. We wanted the opposite: an app that rewards showing up, and that lets strangers who were in the same place at different times leave something for each other.

Katha means "story." We built a memory for places.

What it does

Katha lets anyone leave stories, voice notes and chain letters that can only be created while you are physically at a place, and they stay pinned there. Stories can be read from anywhere. Voice notes (up to 45 seconds) and chain letters only unlock when you are standing at the place.

Each place has one chain letter. You can only add to it by answering the latest letter, so strangers hold a slow conversation across days, months or years.

Every post carries a context stamp, like "Late night, 54°F, drizzle, feeling homesick." Instead of likes there is "Felt this too," and there are no follower counts.

Meta's Muse models caption voice notes, suggest feelings, sum up the mood around you, write a gentle opener for direct messages, and paint a watercolor postcard of each memory. The postcard is painted by AI and never made from your real photo.

Moderation stops harassment but never blocks someone for struggling. A person who may be in crisis sees support resources instead of a rejection.

How we built it

The frontend is React and Vite with Tailwind CSS and Leaflet maps on OpenStreetMap, in a warm, dark "lantern" design. An Express API holds the private keys, checks GPS, moderates text and writes to the database. Supabase provides Postgres, authentication, storage and realtime notifications, protected by row-level security. The AI features use Meta's Muse Spark, Muse Voice Transcribe and Muse Image models. Everything runs in two Docker containers, with GitHub Actions for CI, deployed on Render over HTTPS.

To check that you are really there, the server measures the distance between your GPS reading and the place using the Haversine formula, and accepts a post only if you are inside the place's radius. Readings less accurate than 100 meters are rejected, because they can't tell whether you are inside a 50 meter place.

Our ranking is built to lift quiet voices instead of popular ones. Each post gets a freshness score that fades over about two weeks, plus a full point if fewer than five people have heard it. "Felt this too" adds at most a small bonus, and posts you have already opened move down. Being heard matters more than being liked.

Challenges we ran into

GPS can't be fully trusted. Browser location can't be cryptographically verified, so we never call it tamper-proof. Every location check runs on the server, accuracy limits filter out bad readings, and clients can't write location-locked content directly.

Keeping locked content locked. Voice notes and chain letters can't be read straight from the database. The API returns them only after the GPS check, with audio links that expire after about five minutes.

Race conditions in chain letters. Two people could answer the same letter at the same moment. Each new letter must name the letter it answers. If someone got there first, the app asks you to read the new letter before replying.

Privacy rules on the server. The API writes with elevated database privileges that skip the normal security rules, so we had to apply user blocks and privacy filters ourselves.

AI can't be a single point of failure. Every AI feature has a fallback, and our crisis check runs on rules we wrote ourselves, so support resources never depend on an outside service. User text is also kept separate from our instructions to the model, to guard against prompt injection.

Slow image generation. A watercolor takes about 30 seconds, so we paint it in the background after the post is saved. Posting never waits on it.

Audio and HTTPS. Transcription needed clean audio, so we wrote our own 16 kHz WAV recorder. Geolocation and the microphone only work over HTTPS, which shaped how we deployed.

A mid-hackathon pivot. We started with a nearby-events app, then realized the stronger idea was memories tied to places. We migrated the old data instead of throwing it away.

What we learned

Designing for presence changes everything: what gets ranked, what gets locked, even how the error messages read. Safety is a design problem, not just a filter, and treating struggle differently from harm took real care. We learned practical geospatial math, how GPS accuracy behaves in the real world, how to build AI features that fail gracefully, and how to ship a two-container app with database security rules, realtime updates and CI/CD.

What's next

Curated places for cities, museums, parks and memorials, local events in context stamps, support for more languages, and stronger signals that someone is really at a place, such as nearby Wi-Fi or Bluetooth beacons.