What kyaa does
Fan activity is valuable, but it is usually fragmented across content, community, LIVE, and commerce platforms. kyaa turns verified participation into a persistent fan record:
- Discover a favorite creator and an upcoming LIVE.
- Sign in with Google while an embedded EVM wallet is provisioned in the background.
- Verify fandom through a creator-specific quiz.
- Collect a soulbound Fan Passport and participation Stamps.
- Grow Fan Score through reservations, attendance, and surveys.
- Unlock benefits based on verified activity—not follower count.
The previews below show the earlier ByUs release; the current product is available at kyaa.io.
| Discover and participate | Verify and unlock |
|---|
| |
| |
Product architecture
kyaa is database-first. Supabase remains the operational source of truth for identity, activity, score, eligibility, claims, and mint state. GIWA provides the public ownership and verification layer for issued credentials.
flowchart LR
Fan["Fan"] --> Web["Next.js product<br/>and server-side BFF"]
Fan --> Privy["Privy<br/>Google sign-in + embedded wallet"]
Privy --> Web
Web --> DB["Supabase<br/>identity, activity, score,<br/>benefits, credentials, queues"]
DB --> Worker["One-shot workers"]
Worker --> IPFS["IPFS metadata"]
Worker --> GIWA["GIWA Sepolia<br/>Passport + Stamp"]
GIWA --> DB
Technology
| Layer | Implementation |
|---|
| Product | Next.js 16, React 19, TypeScript |
| Identity and wallet | Privy embedded EVM wallet |
| Data and queues | Supabase Postgres, RLS, RPCs, Edge Functions |
| Chain integration | Viem, GIWA Sepolia |
| Credentials | Soulbound ERC-721 Passport and ERC-1155 Stamp |
| Metadata | IPFS |
| Workers | One-shot TypeScript workers on AWS Lambda |
| Contracts | Solidity 0.8.28, Foundry, OpenZeppelin Contracts |
Fan Passport and Live Stamps
Fan Passport
Each Passport belongs to one fan in one creator context. It brings together:
- verified fan identity;
- Fan Score and level progress;
- Knowledge, Reservation, Attendance, and Survey Stamps;
- recent participation;
- available benefits;
- GIWA token and transaction proof after minting.
Live Stamps
| Activity | Credential | Fan Score |
|---|
| Pass fan verification | Knowledge Stamp | +1 |
| Reserve a LIVE | Reservation Stamp | +1 |
| Enter the LIVE Fan Code | Attendance Stamp | +3 |
| Complete the post-LIVE survey | Survey Stamp | +2 |
Both credential contracts are non-transferable. A fan can prove the record, but cannot sell or transfer it to another wallet.
Verified on GIWA Sepolia
The current deployment is on GIWA Sepolia testnet. kyaa does not put private fan profiles, quiz answers, activity logs, CRM data, or benefit fulfillment data on-chain. Existing ByUs contracts and issued credentials retain their original names and addresses.
Repository map
apps/web Production fan product, BFF, and operations UI
apps/worker Passport/Stamp minting and notification workers
contracts Soulbound credential contracts and Foundry tests
supabase/migrations Product domain, queues, owner projections, and invariants
supabase/functions Protected scheduler and queue-maintenance functions
infrastructure/aws Worker runtime infrastructure
scripts Build, security, media, deployment, and verification tools
apps/web is the production application.
Quick start
Requirements
- Node.js
24.13.1
- npm
11.18.0
- Maintainer-approved development values for Privy, Supabase, and GIWA
git clone https://github.com/kyaa-io/kyaa.git
cd kyaa
npm ci
cp apps/web/.env.example apps/web/.env.local
# Fill apps/web/.env.local with authorized development values.
npm run dev --workspace @byus/web
Open http://localhost:3000.
Quality checks
npm run test:web
npm run typecheck
npm run lint:web
npm run build
npm test --workspace @byus/worker
npm run typecheck --workspace @byus/worker
npm run build --workspace @byus/worker
cd contracts
forge test
The full environment model, worker lifecycle, and verification commands are documented in the kyaa Developer Documentation.
Security and privacy
- Protected product requests are verified by the server-side BFF.
- Browser roles do not receive direct access to private operational tables.
- Passport and Stamp metadata excludes email, nickname, real name, phone number, wallet recipient, and internal entity identifiers.
- Business state is committed before asynchronous minting.
- Mint jobs are leased, idempotent, and reconciled against receipts and contract events.
- Relayer, Supabase service-role, and IPFS credentials belong only in server or worker environments.
Please read SECURITY.md before reporting a vulnerability.
Documentation
License
The application source is publicly viewable for evaluation and collaboration. Copyright © 2026 SallyLab Inc. All rights reserved. See LICENSE.
