The mind behind the savings
A rewards platform that pools cohort demand is, quietly, a data machine — so the question is what it is allowed to know and say. Eight capabilities with their honest states, and the three refusals welded underneath.
Three refusals, before any capability
A platform that knows what a cohort is about to buy earns that trust by what it refuses to do with it. These are architecture, not marketing copy.
Eight capabilities, honestly labelled
Private beta runs with pilot ministries and campuses; in build is engineered against real rails; in design is specified against data that exists; concept is a direction we name early.
The zero-knowledge eligibility token
The core trick of the whole platform: prove you belong to a segment without revealing who you are. Verification resolves to a signed yes/no that travels with the payment, so a merchant gets certainty about eligibility and zero information about identity — the posture that turns competitors' caution into a two-ministry beta.
Cohort demand forecasting
Per group, per week: what a cohort is about to buy, modelled as a demand index and a price-elasticity band — laptops spike before semester, fuel rebates land at month-end. Platforms see the shape of upcoming demand without ever seeing a person, so subsidies aim at real intent.
Differential-privacy release
Aggregates leave the vault only with a calibrated noise budget and a minimum cohort floor (k), because honest privacy work knows anonymisation alone fails — a single rare purchase can re-identify. The release mechanism is the product; the raw rows never move.
On-device offer resolution
The best deal for your group is chosen at the till from rules and prices pushed to the device — not by profiling you in a server. Your eligibility and the merchant's campaign meet at the transaction; nothing about you leaves it. Personalisation without a profile.
Elasticity-driven subsidy optimisation
Given a merchant's budget, the engine solves for the smallest discount that flips the most of the right cohort — spending where the marginal ringgit converts, not blanket-marking everyone. Less waste per campaign means a deeper real saving for the group that matters.
Campaign-readiness scoring
Before a platform funds a special-group campaign, it gets a projected ROI from live cohort demand and elasticity — a readiness score, not a guess. The deals that ship are the ones that convert, which is the only reason merchants keep the flywheel fed.
Anti-resale & leak defence
A segment price is worth nothing if it leaks outside the segment. Rotating QRs, per-member tiers that expire with eligibility, and velocity checks on resale patterns keep a staff or student subsidy from becoming a public arbitrage — which is what protects merchant budgets.
Savings intelligence, not surveillance
Round-ups, student spend controls and a cost-of-living ledger turn the platform into a quiet money coach for the two groups least served by retail banking. The nudges read only your own device-side totals — the counterweight to a discount engine is financial agency for the member.
Every capability traces to a real precedent — an identity-verification company, a student-discount network, or a privacy paper on why anonymisation is hard. The floor is on the Evidence page.
See the evidence floor→Ready to build something intelligent?
Let's engineer your next product — from idea to launch.