How we build
Culture is what a team does when nobody is watching. Ours is written down, because the rules below are the ones we hold the product to.
The link is the grant
An invitation link is all a guest needs, so the code in it is treated like a key: it is never written to a log, never shown in a URL preview we control, and never searchable. Privacy is built into the structure, not added as a setting.
Nothing secret on your phone
Your phone holds what you can see and nothing that could be stolen from it: no signing keys, no card numbers, no ticket secrets. The server signs; the phone shows.
Offline is a state, not a failure
A venue's signal goes, and the app keeps working: your tickets, your guides and your countdown are on your phone, and whatever you change lands when you are back. Losing a message must cost latency, never correctness.
Every outcome is recorded
When the app or the server decides something — refuses a sign-in, skips a sync, rejects a scan — it says so somewhere a person can find. Silence is a defect: it is indistinguishable from the code never having run.
One rendering
The app looks the same on iPhone and Android, measured against one reference, screen by screen. A difference between the two is a bug, not a platform convention.
Deletion is real
Delete your account from inside the app and it goes: your profile, your sign-ins, your devices, your tickets, and the credential your sign-in provider issued for it. What must stay for other people's events to add up — a seat count, a ticket that was scanned — stays with your name removed.
Tests are not optional, and neither is saying so
A change ships with its tests, and a change that could not be verified says that it could not, and why. A row in a ledger that nobody has walked is not a pass.