One choke point
The API is the single place where permissions are decided: verification level, blocks, consent and region rules. Adding a rule is a configuration change, not a rewrite.
Region rules
Verification can be switched off per region. At launch it is off in Quebec until the province's biometric filing is done.
What it talks to
- Member web app: The installable web app members use to verify, build a profile, find hubs and plans, chat, join voice speed-meets and use the safety tools.
- Chat and rooms: Keeps live state for one-to-one and group chats, plan rooms and the voice speed-meet queue: who is in, whose turn, how long is left.
- Media pipeline: Takes every uploaded photo through quarantine, a child-abuse hash check and an AI image check before it can be seen, then resizes and publishes it.
- Postgres with vector search: Stores profiles, hubs, plans, pulses and moderation outcomes, plus the embeddings used to find people and plans that fit.
- Consent ledger: An append-only record of every face reveal, album opening and video grant, and every revocation. Members can read their own.
- Verification results store: Holds verification results, not documents: pass or fail, an age band and the badge state. Kept apart from everything else.
- AI planner: Turns "something low-key Thursday near Main Street" into a draft plan with a few public places and times. The member edits it and posts it as the host.
- Discovery and recommendations: Finds hubs, people and open seats that fit a member, and excludes anyone who has been reported, pending review.
- Mirror and onboarding: Gets a member to a first suggestion in about three minutes, then asks one question a day and shows what the system believes about them for them to confirm, correct or delete.
- Translation and scam flags: Translates chat for free and flags money requests, crypto pitches and pressure to move off the platform.
- Moderation pipeline: Classifies messages, photos, voice and reports, applies written rules through an action ladder, sends reasons and routes appeals.
- Email, SMS and push: Sends notifications, statements of reasons and trusted-contact messages when a member shares a plan.
- Web billing: Charges for Plus from Phase 2, monthly or yearly, with cancel-anytime and refunds on monthly plans.
Designed for
- Every read of a profile, photo or plan goes through the same permission check
- Least-privilege keys for each vendor
- An external security test before public launch, because AI agents wrote most of the code
Where it appears in a request
- A photo upload: The API records the upload and puts a job on the media queue. The photo sits in quarantine.
- A report against a member: The API opens a case with the reported messages attached.