Skip to main content
Grass Pass

About

An open model, a real park and a pencil.

A one-page treasure hunt for a real park. Gemma 4, an open-weight model, writes clues from its map and recent wildlife sightings. Code checks each one. The finding happens on paper.

  • Gemma 4 · Apache-2.0
  • 6 real data sources
  • No ads, no analytics
  • MIT open source

What we measured

Measured, not promised.

Gemma 4 on 20 real parks, ages 6-10, 60 runs (53 passes), run 2026-10-10-3 (2026-10-10). Misses stay on the page. Full results

  • 98%of clues quote their source exactly

    Mettarget 85% or more

  • 0risky species printed (60 runs)

    Mettarget 0, always

  • $0.00107per pass for the clues (list price; up to $0.00111 if 4 timed-out calls were billed in full)

    Missedtarget $0.00100 or less

  • Grade 2.5reading level (median)

    Mettarget 3.5 or lower

  • 90.2%of passes complete

    Mettarget 90% or more

  • 9.5 stypical model wait, 25.3 s slow

    Missedtarget 10 s / 20 s

  • 1.6%of clues repeat across parks

    Mettarget 5% or lower

  • 2754unit tests passing, Oct 10, 2026

    Countedall green

In one look

Open model. Real data. Rules in code.

Open model

Gemma 4 writes the clues

gemma-4-31B-it on DigitalOcean serverless inference (US). One to three calls per pass for the clues, plus one for the trip tips.

  • Apache-2.0
  • Open weights
  • Runs on DigitalOcean
  • Anyone can download, run and build on the weights.
  • Our safety rules are in our code, not a vendor's.
  • Self-hosted on a laptop CPU: $0, but slow.
Real data

Six real sources, dated

  • OpenStreetMapNominatim search, parks and what's mappedODbL 1.0
  • iNaturalistWildlife people actually spotted nearbyNames + counts only
  • WikipediaA short summary of each speciesCC BY-SA
  • SerpApiGoogle Maps review counts for dogs or bikesCounts only, no review text
  • Open-MeteoThe forecast on each pass pageCC BY 4.0
  • National Weather ServiceOfficial weather alerts for US parksUS public domain

No data? We say "No data available" and why. We never pad the list.

Safety by code

  • 71 risky groups are never printed, checked before and after the model.
  • Every clue quotes its source word for word.
  • Code writes every number, date and safety line.

Privacy

  • No account or cookies needed to browse and print.
  • Your free pass sets one small signed cookie: the date and a count, no ID.
  • Sign-in is for more new passes, reports and ratings. We keep a scrambled ID, no name or email.
  • We never ask for info about your child.
  • Your location is rounded to about 1 km in your browser.
  • Your IP is kept only scrambled, for about a day.
  • Park facts and age band go to the model in the US.
Everything that leaves your device

Honest limits

  • Cost and slow calls missed the goal.
  • A few passes come out short.
  • Some clues are vague.
  • The read-it-as-a-7-year-old check is not done yet.
  • Find This Spot and Lucky Finds are not in the eval yet.
Every limit, with the numbers

The fine print

Details, one click away.

Why open: the full measured table

Gemma 4, Llama 4 and a no-AI template, side by side

In short: the real pass builder made passes for 20 real parks with each model, and we counted how often the clues were safe, true to the data, complete, easy to read, quick and cheap. Failures stay in (full results; the run cost $0.09). The last column is the goal we set before the test. Gemma's clues read at grade 2.5, the no-AI template's at 2.5.

20 real parks, ages 6-10, 2026-10-10: the same park data and the same checks for every column
What we measuredGemma 4 31B (open, the default)60 runsLlama 4 Maverick (open, a slower alternative you can switch to)20 runsNo-AI template (our code, no model)20 runsTarget
Blocked (dangerous) species printedRisky things like snakes or poison ivy. Must be zero.0000, always
Clues quoting their source word for word, before any filterHow often the model quoted its real fact exactly.98% (541/552)94.4% (201/213)100% (141/141)85% or more
Complete passes (kept at least n-1 items)At most one find missing.90.2% (46/51)94.1% (16/17)17.6% (3/17)90% or more
Honest empty sectionsNo data? The pass says so instead of filling the gap.100%100%100%100%
Reading level (Flesch-Kincaid grade, median)3 means a 3rd grader can read them.2.52.52.53.5 or lower
Clues or hints naming their own answer, before the filterCode removes these before printing.3.3% (clue only 2.9%)12.7% (clue only 11.7%)1.4% (clue only 1.4%)5% or lower
Model time per call, p50 / p95a usual wait / a slow wait (1 in 20 is slower).9.5 s / 25.3 s20.6 s / 31.3 sno model call10 s / 20 s
Cost per pass (clue calls)At the provider's list price, for the clue calls only; the trip tips (added later) are one more short call.$0.00107$0.00188$0$0.00100 or less
Printed clues repeated across parksShares 5 words in a row with clues for at least 2 other parks.1.6% (6/383)2.3% (3/130)20.7% (19/92)5% or lower
Printed clues with a wrong countA count must match the map. In brackets: wrong counts code removed first.0 of 74 count clues (15 removed)0 of 12 count clues (5 removed)0 of 3 count clues (1 removed)0
LicenceThe terms for using the weights.Apache-2.0Llama 4 Community LicenceMIT (our code)

No closed model was compared: we chose open models only, and the closed models on our DigitalOcean account answered "403 Forbidden" on 2026-10-05. Switching models is one setting (MODEL_ID).

Run it yourself (measured, a separate small test): We ran the small Gemma 4 E2B (gemma4:e2b-it-qat, Apache-2.0) with Ollama on a Windows laptop CPU (Intel Core Ultra 7 155H, 32 GB RAM, no GPU), on 5 test parks, for $0. With a 70 s limit per model call (the most the app allows; the hosted site gives a first call 30-40 s), 0 of 5 passes were complete: 3 ran out of time and the other 2 came out short. Given more time (an eval-only setting), 4 of 5 were complete, 96.7% of clues quoted their source, reading grade 2.9, 0 risky species printed, at 59.3 s a typical call (hosted Gemma 4 31B: 9.5 s). The app now has a longer clock for a model on your own computer (LOCAL_MODEL_TIMEOUT_MS, off by default): in one browser try, a Celebration Park pass came out with 7 of 8 finds and its map in 96 s (2 model calls). The model used about 5-6 GB of RAM. Setup, every number and how to repeat it: self-host notes.

What did not pass yet (current limitations)

Every miss, with the numbers
  • Speed: the typical call met the goal, the slow ones missed it (9.5 s typical, 25.3 s slow). Target 10 s / 20 s. The typical call took 9.47 s; first calls alone took 11 s. DigitalOcean answered at 44.8 answer tokens a second (39.5 in the run before, 2026-10-06-9, when the typical call took 9.9 s). A first call gets up to 40 s: 3 first calls hit that limit, the whole retry answered for 2 of them (1 complete), and 1 test run was lost (its retry timed out too) (0 in the run before). Llama 4 Maverick completes more passes (94.1%) but takes about twice as long (20.6 s typical), costs more ($0.00188 a pass) and names its own answer in 12.7% of its clues before the checks, so Gemma stays the default.
  • Some passes still come out short: 4 of 51 (90.2% complete; goal 90%: met). 90.2% in the run before. 1 test run made no pass: both of its model calls timed out. The 4 short passes are on 2 parks: 3 because the park's wildlife data has little to see (every call answered, the refills found too few good clues), 1 after its first call timed out. A short pass says how many finds are missing. A pass makes 1 to 3 model calls for the clues, plus 1 for the trip tips.
  • Cost missed the goal: Gemma $0.00107 a pass. Target $0.00100; $0.00108 in the run before (2026-10-06-9). Only 4 calls timed out this time, so the miss is the real price of the answered calls: $0.00104 a pass even if those were free. Most of it is the prompt (2,936 prompt tokens on a first call, 2,844 before). Each timed-out call is priced at its prompt size, up to $0.00111 if 4 timed-out calls were billed in full. These numbers are for ages 6-10. Longer passes cost more in their small checks: a 10-13 pass $0.00145 and a 13+ pass $0.00162, both over the goal. All of these count the clue calls only, measured before trip tips existed (Oct 7); the trip tips add one more short call per pass.
  • Some clues are still vague: 13 of 123 Wild Finds. Our checks flag Wikipedia words and bare facts ("Check for a small bird that is yellow."). They go first when a spare can replace them, so 13 printed; 11 of 119 in the run before, counted with the same checks. The checks still miss some, like "Spot a vine with flowers that are not white."
  • Some clues repeat across parks: 1.6% (goal 5% or lower: met). 6 of 383 printed clues share 5 words in a row with clues on 2 or more other parks (4.1% in the run before). The top one is "point to the still water" (3 parks). A clue that listens for water: 15 of 53 passes (14 of 54 before).
  • Answers that name themselves: Gemma passes (3.3% of its clues or hints, before the checks; target 5%), Llama 4 Maverick does not (12.7%). Code removes every one.
  • An earlier glitch: 3 of 56 Gemma answers had the next field stuck onto every quote. Code now cuts it off; not seen since.
  • Not in this test: Find This Spot (no map data was recorded for the 20 test parks) and Lucky Finds (the test parks have no recorded Google Maps review counts, and the free SerpApi searches are kept for the live site).
  • Kid check not done yet. Reading 10 clues as a 7-year-old would is planned for Sunday, Oct 11, on Kevin's park walk; still pending.
  • Lucky Finds run on a free plan. SerpApi's free plan allows 250 searches a month; a new park uses up to 4. Grass Pass stops at 25 searches a day and 200 a month and keeps counts 30 days. A count is a "maybe": visitors wrote about it, it may not be there today.
  • Example passes are chosen. The example passes are real Gemma passes, but we keep complete ones as examples, so they show a good day, not a typical one. A new pass can come out short; it says how many finds are missing.
  • Sparse data happens. 3 of 17 North Texas test parks had no research-grade sightings in 14 days; their passes say so.
  • Self-hosting works, but slowly on a laptop. We ran the small Gemma 4 E2B (gemma4:e2b-it-qat, Apache-2.0) with Ollama on a Windows laptop CPU (Intel Core Ultra 7 155H, 32 GB RAM, no GPU), on 5 test parks, for $0. With a 70 s limit per model call (the most the app allows; the hosted site gives a first call 30-40 s), 0 of 5 passes were complete: 3 ran out of time and the other 2 came out short. Given more time (an eval-only setting), 4 of 5 were complete, 96.7% of clues quoted their source, reading grade 2.9, 0 risky species printed, at 59.3 s a typical call (hosted Gemma 4 31B: 9.5 s). The app now has a longer clock for a model on your own computer (LOCAL_MODEL_TIMEOUT_MS, off by default): in one browser try, a Celebration Park pass came out with 7 of 8 finds and its map in 96 s (2 model calls). The model used about 5-6 GB of RAM.

Privacy: what leaves your device

What, where and why
Everything that leaves your device, where it goes and why
WhatWhere it goesWhy
The place you type (for example "Allen TX")Our server (never in the web address), then OpenStreetMap's Nominatim. Cached 30 days by the text, not by who typed it.To find the town or park.
"Use my location"Rounded in your browser to about 1 km, then our server, then OpenStreetMap's Overpass.To list parks near you.
The map area of your search resultsYour browser asks the OpenFreeMap tile server (tiles.openfreemap.org) for the streets of that area, so like any website it sees your IP address. No account, no cookies. OpenFreeMap says its normal access logs keep no IP address and are deleted after 7 days; error logs and logs kept after misuse can hold IP addresses, for up to 30 days. Cloudflare delivers the tiles under its own privacy policy. Details: openfreemap.org/privacy.To draw the street map behind the park pins.
The park you pick (a public place)Our server, then OpenStreetMap, iNaturalist and SerpApi (name and map position only). The pass page, and making a pass, send only the park's position, rounded to about 1 km, to Open-Meteo and (US parks) the National Weather Service.For the park map, sightings, monarch counts and review counts, the weather card and the trip tips.
The age band (for example 6-10)Our server, then the model on DigitalOcean, in the prompt.To set how many finds and how easy the words are.
Your IP addressOur server. Our storage (Upstash Redis) keeps only a keyed hash, never the address itself, in rate-limit counters that expire within a day.To stop abuse and keep the model budget fair.
Every request (IP address, web address, time)Our hosting provider's request logs (Vercel), kept about 1 hour. They never show what you typed or where you are.Running the website.
Signing in with GitHub or Google or with "Try as a judge" (grown-ups only)GitHub or Google send your public profile (account number, name, picture link; for GitHub any public email). We store only a scrambled ID made from the number; the rest is dropped at once, except your first name, which stays in your own encrypted cookie. Sign-in lasts 7 days; the judge demo sign-in stops working after 1 day.To count your 5 new passes a day, your reports and your ratings.
Your free pass (no sign-in)One cookie in your own browser, set only when you use a free pass: today's date (Dallas time) and how many free passes you used, signed so it can't be changed. No ID. It expires at midnight Dallas time. Our server keeps no copy.To count your 1 free new pass a day.
Your pass ratings (1 to 5 stars and tags, no text; signed-in grown-ups)Our storage: your latest rating per pass and its day, under an ID made for that park only. Deleted after 90 days. Never shown publicly; only the site owner sees the totals.To learn which passes work for kids.
Your reports (Found it, Didn't find it, Not safe)Our storage: your latest report per find and its day, under an ID made for that park only. Deleted after 90 days.To learn what is findable and catch anything unsafe.
The finished pass (park, age band, finds, clues, times)Saved in our storage (Upstash Redis) for 30 days, so the link and print page work.Nothing in it is about you or your child.

No names, no photos, no analytics; nothing about the child is asked for. Browsing and printing set no cookie. Using a free pass sets one small signed cookie (the date and a count, no ID), and a grown-up who signs in gets a sign-in cookie. We only keep a scrambled ID to count your new passes, reports and ratings. No email, no name. Your browser keeps only your light or dark choice and the last age band.

The model runs on DigitalOcean servers in the US, so park facts and the age band leave your device.

Our logs record which source or model ran, timing, outcome and pass id; never the prompt, your IP or what you typed.

Accounts and visitor reports

1 free pass a day; sign in for 5. Judges: Try as a judge.

Anyone can search, open examples and shared links, and print. A NEW pass is a real model call. Without signing in you get 1 free new pass a day (counted by one small signed cookie, and at most 3 signed-out new passes a day per internet connection). After that a grown-up signs in with GitHub or Google (judges: "Try as a judge"): 5 new passes a day each, reset at midnight Dallas time. No password is stored.

Judges: "Try as a judge" is one click, no sign-up. All judges together can make 60 new passes a day with it, at most 3 from one internet connection.

Signed-in grown-ups can report each find (Found it, Didn't find it, Not safe). A find is left off new passes for that park when at least 3 different signed-in visitors didn't find it in the last 30 days and they are more than 60% of those who reported on it, or at once when 2 say it is not safe (we then review it). Each visitor counts once per find. Judge demo reports are only logged, never counted. Reports are deleted after 90 days.

Signed-in grown-ups can also rate a pass: 1 to 5 stars and tags (Too easy, Too hard, Kids loved it, Something was missing, Not safe), no text. One rating per account per pass (the newest counts), deleted after 90 days. Judge demo ratings are only logged, never counted. The totals are never shown publicly.

Data sources and their licences

How far, how recent, what we keep
  • OpenStreetMap (ODbL 1.0): © OpenStreetMap contributors, via Nominatim and public Overpass servers: parks within the distance you pick (1 to 10 miles) and what is mapped inside them. Code draws the Find This Spot map from it.
  • iNaturalist (Names + counts only): iNaturalist observers. Wild Finds: research-grade species photographed within 1.5 km in the last 14 days. From September 15 to November 15, the October box adds monarch counts within 25 km (last 14 days, next to the same days last year) and milkweed within 1.5 km. Names and counts only, no photos.
  • Wikipedia (CC BY-SA): Species summaries, via the iNaturalist API. The model must quote these words exactly.
  • SerpApi (Counts only, no review text): Lucky Finds: Google Maps review counts via SerpApi, from the last 2 years (dogs, bikes, ducks, skateboards; at least 3). We count mentions in Google Maps reviews via SerpApi; review text is never shown or sent to the AI. SerpApi gets only the park's name and position.

Weather on the pass page (the card's words are written by code):

  • Open-Meteo (CC BY 4.0): Weather data by Open-Meteo.com: today's (after 6 PM, tomorrow's) forecast for the park's position, rounded to about 1 km. Code writes the weather card's words. When a pass is made, a few code-written facts from it (high and low, rain chance, UV, sunset, alert names) also go to the model for the trip tips. Cached 30 minutes; if it doesn't answer within 8 s the card says "No weather data available" and why.
  • National Weather Service (US public domain): Active alerts for the park's position from api.weather.gov (US parks only). We show the 2 most severe, who sent them and when they end, and link to weather.gov; we never write our own instructions for an alert.

Trip tips ("How to make this a great trip", on screen only): written once per pass by the same open model, from facts code writes first: that day's forecast and alerts, the park's mapped fountains, restrooms, shelters, water and paths, and the few sightings worth planning for (poison ivy, ticks, fire ants, mosquitoes, venomous snakes, stinging insects). Code drops any tip not based on one of those facts, or that says to touch, pick, feed, wade, leave the path or take medicine. If the model doesn't answer within 10 seconds, the page shows a short code-written list from the same facts and says so. One more model call per pass.

Never on a pass (71 groups)

Removed before and after the model
  • recluse spiders (venomous bite)
  • widow spiders (venomous bite)
  • copperheads and cottonmouths (venomous snake)
  • rattlesnakes (venomous snake)
  • massasaugas (venomous snake)
  • coralsnakes (venomous snake)
  • fire ants (red imported fire ant, tropical fire ant) (painful stings, mounds)
  • poison ivy, oak and sumac (rash on touch)
  • pokeweeds (poisonous berries)
  • southern flannel moth (asp caterpillar) (stinging caterpillar)
  • devil's trumpets (jimsonweed) (poisonous plant)
  • hornets, paper wasps and yellowjackets (stings)
  • Texas bull nettle (stinging hairs)
  • giant centipedes (venomous bite)
  • scorpions (striped bark scorpion, devil scorpions) (venomous sting)
  • nettles (stinging hairs)
  • nightshades (horsenettle, buffalo-bur) (poisonous berries, spines)
  • snakeroots (white snakeroot) (poisonous plant)
  • water hemlocks (deadly if eaten)
  • poison hemlock (deadly if eaten)
  • wild parsnip (sap burns skin in sunlight)
  • hogweeds and cow parsnip (sap burns skin in sunlight)
  • chinaberry (poisonous berries)
  • oleander (poisonous in all parts)
  • castor bean (deadly seeds)
  • yews (poisonous seeds and leaves)
  • Texas mountain laurel (poisonous seeds)
  • lantanas (poisonous berries)
  • jack-in-the-pulpits (berries and roots burn the mouth)
  • amanitas (death cap, destroying angel, fly agaric) (deadly mushrooms)
  • galerinas (funeral bell) (deadly mushrooms)
  • green-spored parasol (poisonous mushroom often found on lawns)
  • spurges (snow-on-the-prairie, snow-on-the-mountain, spotted spurge) (milky sap irritates skin and eyes)
  • tarantulas (itchy hairs and a painful bite)
  • thread-waisted wasps (mud daubers) (stings)
  • square-headed and sand wasps (organ-pipe mud dauber, cicada killer) (stings)
  • spider wasps (tarantula hawks) and velvet ants (very painful stings)
  • scoliid wasps (stings)
  • tiphiid flower wasps (stings)
  • thynnid flower wasps (five-banded thynnid) (stings)
  • blister beetles (body fluid blisters skin)
  • Carolina jessamine (every part is poisonous)
  • coral bean, coral trees (poisonous seeds)
  • trumpet creeper (cow itch vine) (sap causes skin rash)
  • nandina (heavenly bamboo) (poisonous berries)
  • privets (poisonous berries)
  • buckeyes (poisonous nuts)
  • black locust (poisonous seeds and bark)
  • noseburns (stinging hairs)
  • velvet bean (itchy hairs on the pods)
  • dumbcanes (sap burns the mouth)
  • caladiums (sap burns the mouth)
  • Virginia creeper (poisonous berries)
  • Carolina snailseed (poisonous berries)
  • American mistletoe (poisonous berries)
  • wisterias (poisonous seeds and pods)
  • buttercups (sap blisters skin and mouth)
  • jack-o'-lantern mushrooms (poisonous mushroom that looks like a chanterelle)
  • flannel moths (puss caterpillars) (stinging caterpillars)
  • slug caterpillar moths (saddleback, hag moth) (stinging caterpillars)
  • io moths (stinging caterpillars)
  • buck moths (stinging caterpillars)
  • cane toad (poisonous skin)
  • assassin bugs (wheel bug, kissing bugs) (very painful bite; kissing bugs carry Chagas disease)
  • harvester ants (red harvester ant) (very painful venomous sting)
  • ticks (lone star tick, American dog tick) (bites that spread disease)
  • Chinese tallow (poisonous sap, leaves and berries)
  • pigeonberry (rougeplant) (poisonous berries)
  • tree-of-heaven (sap irritates skin)
  • soapberries (western soapberry) (poisonous berries)
  • Mexican buckeye (poisonous seeds)

Any other species whose own description says it is poisonous, toxic, venomous, stings or burns the skin is left off too, and a clue that uses one of those words is removed.

Every Wild Find carries a fixed "look, don't touch" line written by code.

Thank you

Credits and licences

Hero illustration generated with v0 by Vercel (AI), not a photo. It shows no real child or park.

All credits and licences

Data, model, design, fonts, code
  • Park names, places and features: © OpenStreetMap contributors, ODbL 1.0, through Nominatim and public Overpass API servers.
  • Wildlife sightings and monarch counts: iNaturalist observers (names and counts only, no photos).
  • Species summaries: Wikipedia (CC BY-SA), through the iNaturalist API.
  • Weather on the pass page: Weather data by Open-Meteo.com (CC BY 4.0); official US alerts from the National Weather Service (api.weather.gov, US public domain).
  • Lucky Finds: Google Maps review counts via SerpApi (counts and months only, never review text or names).
  • Clues and trip tips: Gemma 4 (gemma-4-31B-it), Apache-2.0, on DigitalOcean serverless inference.
  • Eval comparison: Llama 4 Maverick (Llama 4 Community Licence), on DigitalOcean serverless inference. It answers visitors only if MODEL_ID is switched to it; passes then show "Built with Llama".
  • Site design (v3, Oct 6, 2026): designed by Kevin in v0 by Vercel and ported by hand. Oct 7, 2026 redesign (the home page sections and How it works diagram, the footer landscape, the Find This Spot map and the pass wizard with its animation): built by AI coding agents (Claude Code) at Kevin's direction; the footer art is code-drawn SVG, no stock art. Oct 8, 2026 (the weather card, the trip tips section, the phone layout and the sign-in page): also built by AI coding agents (Claude Code) at Kevin's direction. Oct 8-9, 2026 (the full-screen hero, "What's a pass?" (its layout and its copy), the redesigned "The problem" section, map v2, sign-in v2, the wide layout, pass limits and feedback, and the new How it works page): built, and partly written, by AI coding agents (Claude Code) at Kevin's direction. Kevin's own words: the home hero headline and paragraphs, "Why Find a pinecone fails" and its paragraphs, the nav labels, the button labels "Make a free pass" and "Create your pass now", the footer's closing line, and the idea for the hero offer line. Logo sprout and all icons: Lucide (ISC).
  • Site copy: Gemma 4 redrafted 184 blocks of this site's text; 90 of its drafts shipped (15 with small edits; 78 are still on the site after later redesigns) after a code check and a review by an AI coding agent (Claude Code). Every block, old and new: docs/COPY-BY-GEMMA.md. Kevin's own lines are his.
  • Hero illustration generated with v0 by Vercel (AI), not a photo. It shows no real child or park.
  • Printed pass logo: the original banner was made by Kevin with Google Gemini; the logo and scene are a traced, hand-cleaned SVG redraw of it. App icons and share images: the v3 logo, drawn as SVG by our own script.
  • Fonts: Bricolage Grotesque and DM Sans (site), Fredoka and Nunito (printed pass), all SIL OFL 1.1, served from this site.
  • Search results map (Oct 10, 2026, built by an AI coding agent (Claude Code) at Kevin's direction): MapLibre GL JS (BSD-3-Clause) with OpenFreeMap street tiles (© OpenMapTiles, data from © OpenStreetMap contributors).
  • App code: MIT. A few generic building blocks (model client, rate limits, request guards, in-flight de-duplication) were adapted from the same author's unpublished practice project, written on Oct 2, 2026, before the contest entry period. Everything specific to Grass Pass was written from Oct 5, 2026.

Source code: open source (MIT)

Grass Pass on GitHubMake a pass