Case study
Howdy
A small-circle social app — no feed, no follower counts.
Overview
A social app for one bounded community, built around small-circle, human-to-human interaction. Each person has a Ranch (profile) with a Fence of short Post Cards, private Whispers, peer-written Tributes and Marks — and deliberately no algorithmic feed, no influencer content and no follower counts.
Problem
Mainstream social apps optimise for reach and engagement: feeds, vanity metrics, streaks. Howdy goes the other way — tiny content limits (160-character Post Cards, 80-character replies), peer validation instead of popularity, and privacy rules that come first. Tracks (who visited your profile) are deduplicated, coarsely timed, short-lived and reciprocal: hide your own visits and your own Tracks freeze.
Architecture
A TypeScript modular monolith on Next.js. Each module (auth, profiles, relationships, fence, whispers, tracks, media, notifications, tributes, marks, town-halls) has domain, application and infrastructure layers, and the boundaries between them are enforced by ESLint. PostgreSQL through Drizzle is the only durable store; Redis handles rate limits and pub/sub. Realtime Whispers run on a separate WebSocket process that shares the same module code, and profile photos go to Cloudflare R2 over the S3 protocol. Authorization goes through a single central policy check, where a block overrides everything.
What shipped
Phases 0–10 are done: auth and sessions (Argon2id, hashed opaque session tokens, CSRF and strict-CSP hardening), profiles, relationships and blocking, the Fence with Post Card reactions, notifications, realtime Whispers, Tracks with Shadow Walk, profile photos, Tributes, Marks and Town Halls (communities). Also done: a legal foundation with versioned policies and acceptance tracking, plus unit, security and Playwright e2e suites with accessibility checks. Still ahead: expanded moderation and anti-abuse tooling, account deletion, and a lawyer’s review of the policies before a public launch.