What Ten Strangers Hungry for Connection Did With 101 Days
The Acali experiment put ten strangers on a raft for 101 days and left them lifelong friends. What they became to each other is the part the retellings leave out, and it is what changed how this practice books and remembers its clients.
Four moments from the voyage
A 1973 raft experiment put ten strangers into an intimate container to test whether forced closeness produces violence. The group bonded, plotted a mutiny, and left one researcher holding the most sensitive record of eleven people's lives that anyone aboard would ever produce. The booking and messaging system I built for a consent-led intimacy practice had to solve the same problem backwards, starting from the rule that a session can never be joined to a person.
An anthropologist put ten strangers on a raft in 1973 to see whether forced intimacy produces violence. Eleven were aboard the Acali when it left Las Palmas that May, six women and five men including the researcher, Santiago Genovés Tarazaga, who was 49. The crossing took 101 days and ended in Cozumel, Mexico. The participants filled in 46 questionnaires, many repeated weekly, and Genovés alone generated 1,042 pages of notes from the answers. The questionnaires asked who they felt closest to, who annoyed them most, whom they wanted to sleep with, and which of the other people they would remove from the raft if they could.
On day 51 he lost patience with the pace of his own experiment and began reading the confidential answers aloud to the group that gave them. Those answers had been collected under an expectation of confidentiality, which made the act a breach rather than a provocation.
Although the voyage was designed to produce violence, nobody on the raft attacked anybody else. The crew discussed killing him, weighing a knife, a shove over the rail and a lethal injection that one participant described as "with all of us on the syringe" (BBC Mundo). They decided against it, and Genovés later wrote that he had realised the only person aboard who had shown aggression was himself, and he withdrew from the experiment he had designed, stopped the questionnaires and fell ill in a way his subjects did not believe.
Mary Gidley had left a husband who tried to kill her, and she said she felt safe and protected on the raft (Guardian). The questionnaires stopped when Genovés withdrew, and the crew closed ranks into what the footage describes as a support system. Ten people who owed each other nothing found that they could give each other something once nobody was forcing it.
I read that story in a video, and I am writing about it because of what I built next: the booking system, website chat and WhatsApp reply agent for a consent-led tantra massage and somatic practice that books by request. The practice is built for people who do not want to be identifiable as clients. Genovés's apparatus was the opposite kind of machine, and that contrast turned out to be the most useful specification document I had.
Where the popular retelling goes wrong
The video is The Acali Raft Experiment Might Restore Your Faith in Humanity, uploaded by the channel Horses on 4 January 2023: 13:25 of first-person narration over the expedition's 16mm footage, and loose with facts in ways that would matter if you repeated them.
Its auto-generated captions render the researcher's name as "Santiago terrazaga" and the raft as "the Alkali raft." The raft was the Acali, Nahuatl for "house on the water," and the researcher's maternal surname is Tarazaga.
The video says the university that sponsored the work severed ties and that Genovés was essentially fired, and no source I could find supports that. Long-time colleagues said the publicity was damaging the university, and critics questioned his double role as both scientist and participant, but he kept his career at UNAM and later helped conceive the 1986 Seville Statement on Violence. He died in 2013 at 89.
The video also quotes a consent document requiring participants to "give their souls bodies and Minds" to Genovés. That wording appears in the video and in articles derived from it, and in no reputable source. What the document actually did, per the encyclopedic account, was record voluntary participation and release the sponsors from liability in the event of death. Nine people signed it and the captain, Maria Björnstam, did not. Her boyfriend called it a slave contract and gave her an ultimatum, and she went anyway.
The group stayed friends, and the bond outlasted the voyage. BBC Mundo reported no discord among the crew and a bond that still holds decades later; the encyclopedic account records that they became a closely tied group of their own and that most of them regarded the voyage as a success. When the 2018 documentary reunited the survivors, some of them had not been in the same room for 43 years (Guardian), and the bond was intact. Every account agrees on the part that matters here: the hostility went to the person running the thing.
The instrument was the risk
Genovés instrumented the group rather than merely observing it: weekly questionnaires on sexual contact and masturbation, logged menstrual cycles, psychological testing before departure and for a week after arrival. Then he converted the private answers into a tool, reading them aloud to set people against each other, throwing a bucket of water at one participant and carrying reports of what others had said from person to person. POV Magazine's review of the documentary calls this what it is: consistent breaches of confidentiality, alongside a lack of informed consent. The same review notes, on his own account, that he had ongoing sexual interactions with at least one participant while running the study, a claim that rests on a single secondary source.
The published result was tepid: Genovés wrote that intimate relationships aboard did not significantly interfere with the group, and that friction "could neither be linked specifically to any postulated aggression instinct, nor to any particular biological stock." The sexual and privational engineering he designed produced none of what he wanted. What the raft had was a shared, finite, consequential goal, continuous contact, a hostile authority, and no exit. Muzafer Sherif's work on group formation and Gordon Allport's contact hypothesis describe conditions of this kind, including shared goals and cooperation, and a meta-analysis of 713 independent samples by Pettigrew and Tropp found that intergroup contact reliably reduces hostility. Applying that literature to eleven people on a raft is an inference, since the voyage had no control group, no baseline, and a sample of ten. Those conditions were met without any help from the questionnaires, which mainly produced a record of eleven people's inner lives and handed it to one man who then showed what an operator with that record can do.
What that means for an app that holds intimate things about people
For a studio where the appointment is the sensitive fact, the way the records are built is the safety surface, and the phrase people reach for in this space is already taken. Servury's Privacy is Marketing. Anonymity is Architecture. (December 2025) makes the point with the Mullvad warrant raid: a provider that cannot hand over what it does not have cannot be compelled to. This extends it into a domain where the constraint touches every screen.
A booking system for this business has a list of things it must be unable to do. It cannot join a session to a person. It cannot produce a searchable client table from the public side. It cannot let an analytics vendor infer that someone was looking at a practitioner page at 2am. It cannot have the operator's own name appear in a machine-readable graph about the brand, for reasons that have nothing to do with the clients.
That last constraint is where the two identities in this story nearly touch, and the whole system is built to keep them apart. The practice is anonymous by choice. The people who run it do not want to be the public face of a tantra business, and the app had to be built so that nothing a machine reads, nothing in a page's own markup, no analytics profile and no page template quietly invents the link that everyone else forgot to make. That constraint is enforced rather than promised: a rule over the part of the site that search engines and AI assistants read asserts that a specific list of strings and hosts, including the operator's own name and personal domain, must never appear there, in the working files or live.
What actually shipped
The system runs in two places. This site is 141 pages of static files, and the app behind it lives on a separate host: 75 routes the browser can call, sitting on 17 sets of records. Two courses are paid for through Stripe and stream through links that expire, and the addresses behind them never reach the browser. Every count comes from a single version of the code, which is private, so a reader cannot re-run them; treat the numbers as claims about that version rather than audited facts.
A deterministic gate runs before the model does. The WhatsApp reply agent's tool loop passes through a policy check that lives in code and runs before any AI looks at it, so its result does not depend on what an AI would decide.
Approval runs through the same door every time. Drafts are created for everything inbound. Approving one accepts an optional replacement, so a reviewer can edit and approve in a single action; rejecting closes it; and a queue lists what is waiting. The rotation counter that spreads practitioner referrals increments on approval rather than on draft creation, so an unsent draft cannot consume someone's turn.
Nothing is deleted, and sending has four brakes. Inbound passes three filters: a limit of 15 messages per 60 seconds per phone number, a check on length, link ratio and booking keywords, and lenient spam flags. A message that fails the intent gate still produces a pending draft with auto-reply disabled, so nothing is dropped. On the way out there are four independent anti-send checks, including a double-send guard on the approve route and a check for whether the owner has replied in the thread since, and nothing leaves the system unless the send mode is explicitly set to live. The live system reports its own send mode as live, which was a human decision rather than a default.
Booking runs on a link made for one person. The booking page needs an identifier and a token before it shows anything, so what a client receives is an offer link rather than a public list of availability. Slots render in the practice's own timezone, and choosing one is a request with a fallback to the practitioner's calendar.
The first approach, and why it lost
The original plan for practitioner profiles was the obvious one: an editor writes, an admin clicks publish. What shipped is a review path with real states, draft and review and published, with hidden and held alongside them, where an administrative hold blocks approval outright and every step is its own action rather than an edit to a single field. A field anyone can edit is not an audit trail, and in a business where a practitioner's public page is a promise about consent and limits, the transitions are the safety property.
The code also carries its own failures, as comments and as the names of the tests that guard them. There is a test that keeps the website chat and the WhatsApp agent saying the same client-facing things, and it exists because those two drifted apart once and shipped that way; the test's own comment says so. A pipeline that filtered test output through another command reported success on failing suites, because the shell reports the status of the last command in a pipe and never the tests. And 285 automated browser runs in 12 days ate 88 percent of the project's build minutes before browser tests moved to a nightly schedule.
Where identity still re-enters
A claim of total anonymity in this system would be false, and one screenshot of the approval queue would end it. Three places require a person to be identifiable, and all three are operational rather than public: the phone number that a WhatsApp conversation carries, which a human then reads; the payment processor that takes a name and a card, with the entitlement granted by a signature-verified webhook on the raw request body; and the support, abuse-handling and refund work that normally requires knowing who you are talking to. Those three cannot be designed away, and a product description that omits them is inaccurate.
What is architectural rather than promised is narrower and testable: the public marketing surfaces accumulate no client identity, analytics run cookieless with person profiles off, the website chat keeps session-only memory, the booking path is a tokenised offer rather than a browsable client list, and the structured-data graph is gated against the operator's identity.
What the evidence says about the cost
Anonymity in a service like this is usually framed as a tax on engagement, so the relevant study is the one that tested it. Arnold and colleagues, in 404: Personal data not found (Internet Interventions, 2026), randomised 452 adults with heightened social anxiety to an eight-week self-help programme delivered either platform-anonymously or through accounts. Both versions improved substantially, and the account-based version was not superior: between-version effect size at post-treatment was 0.09, with a 95 percent confidence interval of minus 0.17 to 0.35. The authors' own caveats matter: the trial was powered for superiority and had no non-active control, so formal equivalence remains unestablished. And their most awkward finding deserves the same airtime: most participants preferred the account-based version.
The reason to design for anonymity anyway is the record of what happens when wellness data meets advertising. The FTC's 2021 action against Flo Health concerned fertility-tracking data shared with Facebook and Google after privacy promises. In July 2026 the FTC, Utah and California sued Hims & Hers over sharing sensitive condition data with advertising platforms while claiming privacy. And the regulatory net under most of this is thinner than clients assume, in the FTC's own words: many companies collecting health information, including fitness trackers and diet apps, "aren't covered by HIPAA. Not at all." The framework that does apply is the Health Breach Notification Rule and the FTC Act, after the FTC withdrew its 2021 health-app policy statement in September 2026.
No survey or paper I could find studies client expectations for tantra, bodywork or intimacy practices specifically. The 1,000-patient AMA and Savvy Cooperative survey is the closest proxy: more than 92 percent said health data should not be available for purchase, and only 20 percent knew which companies had access to their data. Reasoning from adjacent verticals to this one is an analogy, and I am labelling it as one.
What this build cannot claim
There is no published response-time promise in the code or on the site, so none appears here. The slot-first marketplace exists as a design document and was never shipped; the offer link is what customers get. The zero-trace rule reads what the page tells machines, and the checker skips links that point off the site, so the claim that ties are enforced holds for what a machine reads off the site and should not be stretched to cover every anchor a future contributor adds. The status page currently reports its own release number as unknown. The reviews file is empty, and the generator will not let a placeholder into it, so nothing here rests on collected ratings.
The raft's own limit is the honest end of the comparison. Genovés wanted a container that would manufacture conflict and it produced cohesion against him, which is a finding about how badly his instrument was built rather than a lesson about engineered intimacy. The people in the film were the ones who survived and chose to be filmed, which is the only outcome data that exists. And the raft's active ingredient was inescapability: no motor, no way back, no books, a deliberately public toilet. A visitor can close the tab at any point, and the raft gave nobody an equivalent exit.
The remaining claim here is smaller than the story that opened this article, and it is the one I would defend. An app can decide, in code, what its operator is able to know, and make that decision visible enough that a client can check it. Genovés held 1,042 pages about ten people and used them as a weapon inside a week of losing his temper. The equivalent risk here is three named surfaces, and most of the work was keeping every other surface off that list.
