Architecture

The shape

One modular web application, not nine microservices. A solo founder with a fleet of AI coding agents can build and run it, and the module boundaries let each part split out later when load demands it. It runs on Cloudflare: Workers for the API, Durable Objects for chat and rooms, R2 for media, Queues for background jobs, Images for resizing and Realtime for voice. Postgres with vector search sits behind it, reached through Hyperdrive.

The site you are reading runs on the same platform. It is built the way we recommend.

Explore the system

Click any part to see what it does, what it runs on, what it costs and what it talks to. Or follow one of three requests step by step.

The three requests, step by step

A photo upload

A member adds a profile photo. Nothing is visible until it passes.

1. Member web app: The member picks a photo. The app uploads it straight to storage with a short-lived signed link.
2. API on Cloudflare Workers: The API records the upload and puts a job on the media queue. The photo sits in quarantine.
3. Media pipeline: The pipeline hash-checks the photo against known child-abuse material and runs an AI image classifier.
4. Moderation pipeline: The policy engine applies the written rules: publish, block, or send to a human if a hash matched or the case is uncertain.
5. Human review on demand: Only for hash matches and uncertain cases: an on-demand vendor reviewer views it. Confirmed child-abuse material is reported to the authorities.
6. Media pipeline: Approved photos are resized into the sizes the app needs and published behind the CDN.
7. Postgres with vector search: The profile now points at the published photo. A face reveal, if the member wants one, goes through the consent ledger.

A report against a member

A member reports someone for harassment in chat.

1. Member web app: The member taps report and picks a reason. They can block at the same time.
2. API on Cloudflare Workers: The API opens a case with the reported messages attached.
3. Moderation pipeline: Classifiers score the messages; the policy engine picks a step on the action ladder: warn, hide, end a call, cooldown, suspension or ban. Every step comes with a reason.
4. Discovery and recommendations: The reported member drops out of recommendations at once, pending the outcome.
5. Email, SMS and push: Both members get a statement of reasons. The reported member gets an appeal link.
6. Human review on demand: If they appeal, an on-demand vendor reviewer decides. The platform keeps no moderation staff.
7. Postgres with vector search: The outcome is logged for the monthly transparency numbers.

A voice speed-meet

A verified member joins a short round of voice meets in an interest cohort.

1. Member web app: The member joins a speed-meet for their interest cohort. Only verified members can.
2. Chat and rooms: A room coordinator pairs members for short rounds and runs the timers and prompts.
3. Voice rooms: Audio flows through Cloudflare's realtime media network in short rounds.
4. Moderation pipeline: Live voice moderation listens for abuse under a policy written for dating conversation. It ran in shadow mode first to measure false positives.
5. Chat and rooms: After each round both members vote privately. Only a mutual yes is shown to either of them.
6. Postgres with vector search: Mutual meet-again votes are stored as the signal that improves the next suggestions.

The moderation pipeline

Moderation runs on configured AI with graduated automatic actions. Four duties still need a human by law or for evidence, and each one is bought on demand, not staffed.

• Written rules and an action ladder. Warn, hide content, end the call, cooldown, temporary suspension, ban. Each step has a written trigger, a statement of reasons and an appeal link.
• Shadow mode first. Each classifier runs silently for two to four weeks on real traffic to measure false positives before it can act.
• Reported members drop out of recommendations at once. Recommending someone already reported is exactly the claim in a 2025 lawsuit against major dating apps.
• Humans where the law needs them. Appeals, uncertain cases and child-abuse hash matches go to a vendor's reviewers. Regulator requests go to the founder.

Verification and the consent ledger

Two ideas carry most of the trust.

• Keep results, not documents. A verification vendor checks liveness and ID and returns a pass and an age band. Peoplarium never stores ID images. The results sit in a separate store from the rest of the data.
• Consent as a record. Every face reveal, album opening and video call needs a request and an accept. Each grant and each revocation goes into an append-only ledger the member can read. AI records consent; it never grants it.

What changed from the first design

The first target architecture had nine services, an event bus, a self-hosted GPU pool and a separate chat stack. The current design keeps its best ideas, a single policy choke point, media quarantine and the separate store for verification results, and drops the rest.