You could create this in a singular list that everyone has contribute rights to, however, you set the item level permissions in the Advanced Settings of the list as such:
This will allow users to do CRUD against their own data. If they happen to get to the list, they can only manipulate their own data, so it doesn't really solve your problem.
If you roll your own REST service in Azure, you could make it a little more robust, but the same issues might come up. If someone starts sniffing the traffic, they could inflate their data by reposting to your service, but it'd be something you have more control over on your service endpoint.