I very much think you ' re trying to solve the wrong problem , or possibly even a problem that doesn ' t exist . The technology and strategy worked behind What worked for nearly a decade . Ratio worked , the tracker worked , the data structures and UIs worked . There were some problems but they didn ' t bring it to an end . What brought it to an abrupt end was the threat to identifiable personal data . In particular , email addresses , IP addresses , and a list of snatched content . That combined is arguably enough to bring trouble to a user ' s door . If you were to do this again , that ' s the problem to solve . Specifically 1 Worst case scenario , can you design a system whereby you can selfdestruct this data and eliminate personal risk even if you have to lose all user accounts without burning down the whole library ? 2 Can you produce a system whereby it ' s never useful data in the first place ? e . g . passwordbased encryption of stored email addresses , but also a riskaverse approach to data in general . Why keep an account ' s snatch list for longer than necessary ? 3 What balance of user trust and anonymity are you willing to accept ? 4 Only then with all that achieved , how do you build a resilient hydralike system that can survive the total loss of one server in one jurisdiction ?