DELULU

The product needs to know where you are to be useful. Another user does not. That single line is the constraint the whole system is built around, and it is enforced in five independent places rather than stated once in a document.

• Coordinates live in exactly two tables. The table peers actually read has no geometry column at all, so there is nothing there to leak.
• Consumer responses are assembled field by field rather than by spreading a database row, so a new column cannot silently reach a client.
• Distance becomes one of four wide bands before it becomes a response. The API never sees a metre value for another person, which is what makes trilateration impossible rather than merely discouraged.
• Remaining Findable time is rounded to five-minute steps, so polling repeatedly cannot read a precise clock.
• Row-level security in Postgres backs all of it, so a mistake in application code is not sufficient on its own.

Session expiry, consent, eligibility and the privacy projection are pure functions in their own package. The API applies them; the database enforces the ones that need a transaction or a unique index.

• Branded IDs and discriminated unions in the type layer, so a session ID cannot be passed where a user ID is expected.
• Zod schemas at both trust boundaries, validating what arrives and what leaves.
• 493 tests passing, the fast ones needing no Docker at all, which keeps the loop short enough to actually run them.
• Typecheck, lint, tests, the admin production build and the iOS bundle all clean in one command.

A monorepo with a shared domain, so the phone, the API, the console and the marketing site cannot disagree about what a Match is.

• An Expo and React Native consumer app, built for the App Store route rather than a wrapped website.
• A Hono API holding every operation that carries a safety rule, deliberately separate from the client.
• A Next.js operations and moderation console, which holds no privileged credentials of its own by design.
• A static marketing site, and a design package whose palette and type scale are enforced by tests rather than by convention.

• Chaperone: a human role built into the product and the console, not bolted on after launch.
• Avatars are exchanged only after mutual consent, so a photograph is not the thing a stranger sees first.
• Age assurance specified and recorded as a decision, with the provider left as an explicit open choice rather than a silent gap.
• Every architectural decision written up with what was rejected and why, so a future change that weakens one is visible as a change to something named.