Work / Hyperlocal activity app / 2025
Looper
A social app for finding people nearby who want to do the same thing right now, with real-time discovery and chat.
The boundary
Stays inside
- Firebase auth session
- Server-side activity data
- Env config, EXPO_PUBLIC only where public
Allowed to cross
- Typed requests generated from the OpenAPI spec
- Chat messages through Firebase
The API contract is generated, not hand written.
Context
Location social apps live or die on trust: who sees where you are, and whether the app talks to the backend it thinks it does.
Idea
Generate the client types from the OpenAPI contract so every request is checked at compile time, and keep only deliberately public values in the bundle.
Craft
- Feature folders for auth, feed, activities, chat and profile.
- Typed fetch clients and React Query hooks over generated types.
- Firebase authentication screen as the first gate.
Threat model
| Asset | Threat | Control |
|---|---|---|
| Sessions | Unauthenticated access | Firebase auth gate before any feed |
| Config secrets | Shipping in the bundle | Only EXPO_PUBLIC values are client side |
| API drift | Client calling stale endpoints | Codegen from the spec |
Outcome
An MVP scaffold with auth merged and the contract-first client in place, built with the Looper team.