Shipped a "claim ticket" pattern today to solve cross-device data loss — here's how it works

Relaunching UluP Spaces on Product Hunt this Tuesday, but today turned into one of those days where I just kept finding things to fix instead of resting before launch.
The one I'm most proud of: solving the "second device" problem. UluP Spaces lets you use it with zero signup — you're anonymous by default, work is saved, everything just works. Great for reducing friction. Terrible if you start on your phone, forget you never made an account, then open your laptop and see... nothing.
The naive fix is "just merge everything automatically when they log in." But that's dangerous — what if someone accesses a different existing account and their anonymous session's projects just silently vanish, or worse, silently get attached to an account that isn't theirs?
What I ended up building: a single-use "claim ticket." While still anonymous, the client requests a ticket (server verifies you're genuinely anonymous, generates a random UUID, stores it). That ticket survives the login redirect via localStorage. After the real login completes, the client presents the ticket back to the server, which verifies it's unexpired, unused, and the caller is now a real account — only then does it transfer project ownership, and it locks the row so it can't be redeemed twice.
Small pattern, but it closes a real security gap: nobody can transfer projects that aren't theirs just by guessing an ID, and the user gets an explicit choice (keep them / leave them) instead of silent magic or silent loss.
Also shipped today: a daily cleanup job for genuinely abandoned anonymous accounts (never touches anyone with real activity), fixed a notification permission prompt after someone on Reddit correctly called it "a clear spam signal" for firing on page load, and a real design pass — swapped monospace-everywhere for a proper sans-serif, redesigned a cramped modal, rebuilt project cards, added cover photos.
Still solo, still bootstrapped. Curious if anyone else here has hit the same anonymous-session-across-devices problem — did you solve it differently?
ulupspaces.com