They are based on the pubkey of the user, but yeah there is nothing final about this. I threw it together in 30 mins