The problem
Every ranking of restaurants answers a different question from the one diners ask. Inspectors publish their own judgement. Algorithms publish an average of other people’s. Awards publish the shortlist that applied. Underneath all of them sits the same unsolved problem: there is no way to know that the person whose opinion you are reading exists, ate there, and only counted once.
What it is
The People’s Top 20 is an annual restaurant election. One verified person selects up to ten restaurants a year in a country, all ten weighted equally, each with a confirmation that they dined there in the last twelve months. Cuisine ballots run separately at three picks each and never feed the national count. Ballots stay editable until the annual cutoff, then freeze for an audit period before the year’s Top 20 is published and archived permanently. Kuwait is the first market, the UAE and Saudi Arabia the next.
Why it was hard
- The whole product rests on one claim: one real person, one ballot. Every serious version of that claim is a privacy problem, because the obvious way to prove a person is to keep a copy of their identity document, and the obvious way is the wrong one.
- Listing the restaurants of a country is a licensing question long before it is an engineering one. The richest sources of place data are the ones you are least allowed to copy.
- Vote limits have to hold under a double submission, so they are enforced by conditional inserts against partial unique indexes rather than by counting rows and then writing one.
- The unit of ranking is a physical branch, in a country, with a name that may be written in two scripts. Branch, brand, country, language and currency belong in the schema on the first day, not after the second market asks for them.
Proving a person without keeping their passport
Verification is performed by a specialist provider. What comes back to the platform is a result, not a document: verified, over eighteen, a provider reference that is unique to that person, the date, and the country fields the methodology actually needs. No front or back of a civil ID, no passport scan and no face image is downloaded or stored here, and when someone changes their document they reverify through the provider instead of the platform keeping an archive of the old one. That is data minimisation as an architecture rather than a paragraph in a policy page, and it is the difference between a breach that leaks a vote and a breach that leaks a nation’s identity documents.
It also has to be said plainly that identity is only the first layer. A verified human can still be recruited by a restaurant they have never eaten in. So the attestation is a separate layer, and verified visits, tied to a booking or a receipt, are the layer after that.
Where the restaurant records come from
The platform keeps its own canonical record for every restaurant and merges sources into it, rather than treating somebody else’s database as its own. Openly licensed place data provides the seed, under licences that permit it, with attribution and share-alike obligations handled where they apply. Mapping providers whose terms prohibit storing their content are used for search and maps within those terms and are never bulk-copied into the database. Every row carries the source it came from and the date it was last refreshed, which is what makes a correction possible and a claim by the restaurant meaningful.
What money is not allowed to buy
Payment never affects eligibility, votes, placement or rank. Restaurants may claim a profile, advertise, or buy analytics about themselves, and none of it moves a position. Sponsorship is labelled and sits outside the ranking structurally, not visually. No compensation of any kind may be offered for a vote, and a restaurant may ask its customers to take part but never vote on their behalf. Those refusals are the product. A ranking that can be paid for is a directory with a trophy on it.
What it demonstrates
Three of the decisions that decide whether this works are the kind a company usually postpones: how identity is held, what the licence on your data actually permits, and what the platform is structurally forbidden from selling. All three are cheap now and impossible later, which is the argument I spend most of my consulting time making. Here it is made with my own name on the result.
Where it is now
Live at tpt20.com, with a working demonstration of the ballot and the standings so the mechanism can be examined before anyone is asked to trust it. Voting has not opened, no ranking has been published, and no award date has been announced.