BeerSurprise is community driven; it lets you create a group where you and other group members can enter a list of suggested beers.
Say your group consists of 6 people and want to create a beer advent calendar of 24 beers, each member will have to add more than 4 unique beers (there is actually margin added).
After everyone has completed their personal list, the system will provide a set of 4 unique beers for each member one will have to buy (in 6-fold: one set for each member).
Wrap them up (mark and group them), put all the member's beers in 6 boxes (preferrably in the same marked order) and enjoy.
For first time users:

• Register a username and password and verify with "ok"; it will be stored in the browser for auto login next time
• Either login or refresh the page

To create a new group:

• Fill in a group name, click "add group" or open an invite link to join an existing group
• If you're the group creator: fill in the number of unique beers, i.e. 24 for a Christmas advent, or 8 for Hanukkah
  Best options are easy dividable numbers like 12

To fill a group with beers:

• Fill in a barcode (important) and an easy name/description;
  the barcode (hashed) will be used as comparison.
  If a beer has no barcode, make consensus on how to name the beer (i.e. all lower case, no interpunction, or something like "brewer - beername");
  make sure to use consistent spelling or the hashes won't match and you will end up with the same beer twice
• If you've entered enough beers (actual margin is "unique beers / number of persons + 25%"), the system will provide a set of beers to buy.
  For example: 3 people having 24 beers need 8(+25%) = 10 beers in their list.
  The system then will choose a set for you to buy
• If the system didn't provide a list yet, you have to mutually agree to add another beer to your list.
• Buy the beers (times the number of persons), wrap them and join them with the others to make unique sets (you may want to number your wraps)
• Cheers!

Note: you could mutually agree to choose something different, like wine, cheese, chocolate or gadgets.

In short: we don't want your data, but: We need some information of you and your group members to make a non-conflicting list of beers.

On our server (database):

• a hash of your username
• a salted hash of your password
• the weeknumber and year of your last login (for cleaning up stale accounts)
• a UUID of a group with references to the username hashes
• (indirectly) the number of group members
• an integer number of the number of different beers to select
• a hash of the barcodes of each of the beers you added

In your browser (localStorage):

• your username
• a salted hash of your password
• group UUIDs and their name
• hashes of the group members (the ones you've added)
• your beers per group UUID:
  • the barcode
  • the name (optional)
  • a description (optional)

We generate (server to client):

• list of beerhashes for a group UUID where you can derive your selected beers from, masked per user
• When the list is incomplete, a fault message: INSUFFICIENT_BEER, BEER_OVERLAP, ...
• the integer number of group (UUID) members

This website needs JavaScript to make sure no identifyable data is sent across the line; it's used to generate the hashes using the browser's SubtleCrypto digest method.

Please note the following:

• The EAN-8 code to hash conversion becomes a fairly small set (only 10 million combinations and a checksum digit). They are relatively easy to reverse / rainbow table if you know the hash.
• The password hash is salted with the username, which makes it harder to crack using rainbow tables.
• If your locally stored username and passwordhash leak; other people will have full control of the groups you are a member of.
• The camera is used to scan a barcode for ease of use and is optional (your browser will ask for permission).
• The barcode scanning is done by the operating system (using shape recognition), if available.
  It will fall back to a webassembly polyfill by undecaf available on github

• hash: a oneway "fingerprint" of a piece of text (or data) that cannot be reversed back to the original data
• UUID: a unique (random) identifier that doesn't reference to any name (or data; only locally)
• EAN: European Article Number: the defacto standard of identifying products.
• webassembly: A binary executable (running in a sandbox) that is built for optimal performance.
• polyfill: A piece of code that mimics the functionality of a browser standard when it is not available on your platform.
• sandbox: An isolated memory space within the browser.