Make the work visible. Make the evidence clear.
Where someone walked, how they moved, which flyers they handled, and what customers scanned answer different questions. DoorDroppr’s trust direction brings those records together without pretending one signal proves everything.
- GPS presence and movement signals
- Flyer custody from hand-off to return
- Customer response as the final check
Partly available. Field capture and rule-based signals exist. A learned verification model is still in development.
Five records. Five different questions.
A phone travelling through a neighborhood does not prove that paper reached every doorstep. Each record below answers the question it was built for and stays quiet on the rest. Read down the fourth column and you will find no direct record at all.
| Record | Was a phone on this street? | Was it carried on foot? | How many flyers left the bundle? | Did paper reach the doors? | Did anyone respond? | Where it is weak |
|---|---|---|---|---|---|---|
| GPS trailPosition fixes logged during a shift | Direct record | Supports | Silent | Supports | Silent | Device permissions, signal quality and connectivity all shape the trail. |
| Motion windowsSteps, cadence and activity class in 8 second windows | Silent | Direct record | Silent | Silent | Silent | iOS can throttle the accelerometer in the background. Those windows are stored as missing. |
| Flyer custodyFlyers out at the bundle scan, minus flyers counted back | Silent | Silent | Direct record | Supports | Silent | The count-back is entered by the worker. It is not an independent witness. |
| QR scansEach scan logged by the redirect before the visitor lands | Silent | Silent | Silent | Supports | Direct record | Speaks only for flyers that somebody scanned. |
| Website eventsLeads, bookings and purchases reported by the pixel | Silent | Silent | Silent | Silent | Direct record | Depends on pixel setup, cookies, consent and the visitor's device. |
- Direct record. The data is a measurement of that exact thing.
- Supports. Consistent with it, never sufficient alone.
- Silent. Says nothing either way.
What this page will not claim.
- A trail shows presence.
GPS and gait can show that somebody walked a street. They cannot show that paper reached a door.
- A count is a claim.
The custody count closes the loop on flyers taken out and brought back. A scan cannot replace a count-back, and a count-back is not an eyewitness.
- Verified means no rule fired.
A shift counted as verified passed three rules. That is a narrower statement than every delivery happened.
- Door counts are estimates.
Coverage, recorded scans and attributed conversions stay as separate numbers. They are never collapsed into a guarantee.
Three rules run today. All three are advisory.
These are plain thresholds, not a trained model. They catch the cheapest way to fake a walk, which is driving the route with the app open. A rule that fires adds its name to the shift so a reviewer can see why.
1 Distance without footsteps
low_step_ratio- Reads
- Shift step count divided by GPS distance in metres
- Fires
- Below 0.4 steps per metre, once the shift is longer than 50 m
- Reference
- Walking logs about 1.3 steps per metre, roughly 1,300 per kilometre
0.401.6 steps/mRule firesWalking, about 1.3A shift with zero steps is evaluated too. A phone lying on a car seat is the clearest case, so it is not exempt.
2 The phone says it is in a vehicle
automotive_detected- Reads
- Share of motion windows classed automotive at confidence 0.6 or higher
- Fires
- Above 30% of the shift's windows
- Reference
- Activity class comes from the phone's own motion classifier
30%0%100% of windowsRule firesA short ride between streets stays under the line. A route driven end to end does not.
3 Sustained speed above walking
vehicle_speed- Reads
- 95th percentile of GPS speed across the shift's position fixes
- Fires
- Above 4.0 metres per second, which is 14.4 km/h
- Reference
- Door-to-door walking runs at about 2 to 5 km/h
4.008 m/sRule firesWalking, 0.6 to 1.4The 95th percentile ignores a few noisy fixes. It takes a real stretch of fast movement to cross it.
Try the rules on a shift
Sample inputs. Nothing here comes from a real shift.
auto_acceptNo rule fired. The shift is accepted without anyone looking.
- Steps per metre
- 1.30
- Rules fired
- None
- Label
genuine- Label source
trusted_identity- Label strength
- 0.5
- Effect on pay
- None. The verdict is advisory.
What a verdict means.
One row per shift. The server writes it whenever a shift starts, changes status, or gains distance or steps, and again when a scan arrives.
| Verdict | When it is set | What follows |
|---|---|---|
auto_accept | A normal shift where no rule fired. | Nothing. It counts as verified in the campaign summary. |
review | A normal shift where one or more rules fired. | A person opens it and sees which rules fired. |
candidate_reject | A test run recorded on purpose as driving, spoofing or replay. | Kept as a labelled negative example for later model work. |
unlabeled | The default before a shift has been evaluated. | Nothing yet. |
No verdict touches pay. Flagged shifts get a human look, and a reviewer sees the reasons instead of a bare flag.
Where a label comes from.
A future model must never be the source of its own training labels. Only independent sources count, and each carries a strength.
| Source | Strength | Meaning |
|---|---|---|
trusted_identity | 0.5 | A normal shift by a known beta member, with no scans yet. |
qr_anchored | 0.6 to 1.0 | The same shift once a scan lands on that walker's codes. 0.5 plus 0.1 per scan, capped at 1.0. |
constructed | 1.0 | A run the team recorded deliberately as a drive, spoof or replay. |
human_review | Set by a person | A reviewer's decision on a flagged shift. |
Label strength by scans on the walker's codes
What the phone records about movement.
Development collects consented movement windows from real walks so the team can study the stop, turn, dwell and resume pattern around a drop. Failure cases matter as much as clean walks, including driving, noisy location fixes, interrupted shifts and incomplete routes.
- Accelerometer rate
- About 50 HzThe lowest rate that still carries the shape of a footstep.
- Window length
- 8 secondsLong enough to estimate cadence and stride rhythm.
- Where features are computed
- On the phoneThe raw accelerometer stream is never uploaded.
- Consent
- Required firstNo motion capture starts without explicit consent in the app.
- Steps in the background
- Read from pedometer history on iOSThe count keeps filling while the phone is locked in a pocket.
- Thin sensor coverage
- Under half the expected samplesGait fields are stored empty with a reason, so a throttled sensor never reads as a calm walk.
Stored per window
step_countcadence_hzactivity_classactivity_confaccel_dom_freq_hzaccel_harmonic_ratioautocorr_peakautocorr_lag_sspeed_mean_mpsspeed_p95_mpsheading_entropystop_ratesteps_per_m
Thirteen features plus the window's start and end time. steps_per_m is the hardest one to fake, because a pedometer and a GPS receiver have to agree.
Where things stand. Plainly.
The longer-term verification system depends on labelled examples from real fieldwork, not on an impressive confidence number. The learned model and live marketplace payments remain separate workstreams.
In the product 6
- Motion windows captured on the phone during a shiftWith consent, as engineered features.
- Three advisory rules run on every shiftStep ratio, automotive share and sustained speed.
- A verdict with its reasons stored per shiftWritten by the server only. The app cannot set it.
- Label source and strength tracked beside each verdictSo a future model never trains on its own guesses.
- Per-campaign roll-up of accepted, review and flagged shiftsFeeds the proof receipt in the app.
- Custody ledger for marketplace jobsFlyers out, flyers counted back, delivered as the difference. The marketplace itself is not live.
Not built 5
- A learned model that scores a deliveryThe score column exists and stays empty until a model does.
- Mock-location and GPS spoofing rulesDescribed in the research. No rule checks for them yet.
- Sidewalk versus road-centreline geometryNeeds map matching, which is deferred.
- Detecting a walk-by with no dropThe hardest case from motion alone. It looks like walking because it is walking.
- Any automatic decision about payNot built and not planned for the rules. Live marketplace payments are a separate workstream.
- A
Phase A. Rule guardrails Partly built
Hard rules on the cheapest and most damning signals. Three run today. Every shift they evaluate also becomes a labelled row for later.
- B
Phase B. First learned model Not built
Gradient-boosted trees on the windowed features, trained on real walks plus deliberately recorded drive and spoof runs, then calibrated so the score means something. Planned as a score with two thresholds and a human in the middle band.
- C
Phase C. Hardening Not built
Replay defences and audited retraining against a frozen, human-checked set. This is ongoing work with no finish line, since people who cheat adapt.
Straight answers.
Response is the last check. See how scans and bookings join a campaign on the results page.
How results are measuredDoes DoorDroppr prove a flyer reached a specific door?
No. GPS, motion and custody each have limits, and none alone proves a flyer reached a specific door. The product shows each record separately so you can judge them together.
Is a model scoring walkers today?
No. The platform captures motion features and runs three rule-based checks. The learned delivery-verification model is a development direction and has not been built.
Can a flag hold back someone's pay?
No. Every verdict is advisory triage. A flag sends the shift to a person with the reasons attached. Nothing in the rules withholds pay.
Why does a QR scan matter so much here?
A scan is engagement the flyer produced, recorded by a system the walker does not control. Scans on a walker's codes from the start of a shift until a day after it ends raise the strength of that shift's label.
What happens to the motion data?
The phone turns the accelerometer stream into a short list of features per 8 second window and uploads those features. Capture only runs during a shift and only after consent.
Show the work, and be straight about it.
Give your customers and your crew a record you can stand behind.
- Join the list
- Get your invite by email
- Walk your first street