How it stays reliable and safe

Back

How it stays reliable and safe · Local delivery, live on the map

11 · Built for the real world

The hard parts, handled

Real-time location, a strict order state machine, payments and AI with guardrails.

32One state machine, no double taps

placed

→

accepted_by_store

→

driver_assigned

→

driver_at_pickup

→

picked_up

→

driver_nearby

→

delivered

cancelled_by_customercancelled_by_storeno_driver_founddelivery_failed

Double tap? No double charge.

Transitions run through one server function, transition_order_state. A repeat call is ignored.

Picked up

1 transition recorded · retry ignored

order_events

from	to	actor	at
driver_at_pickup	picked_up	driver · Marcus D.	6:42:08 PM
picked_up	driver_nearby	system · 0.3 mi	6:48:12 PM
driver_nearby	delivered	driver · Marcus D.	6:51:30 PM

Every order follows one server-enforced state machine, with clear side states.

Transitions are idempotent and timestamped. Retries never double-advance.

33Phones go native, web simulates

Capability	Android / iOS	Web
Customer ordering, tracking	Full	Full
Driver location	Real GPS, foreground + background	Simulated along real routes
Notifications	Push (Firebase Cloud Messaging)	Live in-app updates
Proof-of-delivery photo	Camera	File picker or pre-made image
Voice ordering	Device speech-to-text	Web Speech in Chrome and Edge
Dispatcher console	-	Full

On web, 8-12 simulated drivers use the same APIs and state machine as real ones

Android and iOS use real GPS, push and camera. Web simulates the field side the same way.

Order on web and a simulated driver accepts in 10-20 seconds, then runs the full trip.

34Safe by default

No secret keys in the app

Only publishable keys, restricted by domain or app ID. AI, payments and routing run server-side.

Row-level security

Customers see their own orders. Drivers see only offered or assigned jobs. Dispatch sees all.

AI caps on the server

Ordering 40/day, support 40/day, photo checks 2 per delivery, dispatch summaries 30/day.

Every AI call logged

User, feature, model and tokens, in ai_usage.

Location kept 7 days

Location pings are deleted after a week. Showcase data resets nightly.

Invented brands only

Fictional stores, menus and images. Public drop points, never private homes.

No secret keys, row-level security, server-side AI caps and short data retention.

Under the hood

0:00

Turn your phone sideways for a bigger view.