Hello,
This round started from testing on the phone and ended with a long sweep through security, privacy and accessibility. It also made the chat keep the limits you set, and made the library and the post sheet calmer.
Your data
- Settings has Your data: what Peltify holds about you in three lines, Download my data, and Delete account.
- Delete account removes every place your data lives, and tells you how the restore link brings it back.
Security
- One same-origin check in front of every route, failing closed.
- Billing shows only what Stripe confirmed. Each Stripe event is applied once, in order.
- Limits on guessing and sending that do not lock anyone else out.
- Posts, messages, pelts, cards and follows can only be changed by their owner.
- A stored cookie is not counted as a sign-in. Only the site's own yes is.
Accessibility and speed
- Sheets hold the Tab key, VoiceOver reaches every pick and record, and focus rings can be seen.
- A page's code is fetched when the page is opened, and a file the phone already has is not sent again.
Chat
- Search opens on "What are you after?". The crates are behind one door.
- A limit you state holds for the whole chat: a length, a decade, a language, a book's pages, a genre you refused.
- Reply on every work the chat brings up.
- Asking for "Seven" by David Fincher finds Se7en.
Rating and the popup
- Heard it or Seen it opens five big stars. After the stars come a few rows at most, then it closes.
- The whole popup pulls down to close.
- When you are deciding, two quiet links lead to where people say what they think of a work.
Library
- Your apps is one press on a phone.
- Up next is quieter. One shape for an item on both tabs.
- Rows with View all, and Recently heard.
- An artist's Popular songs and Discography are rows of the same kind.
- Want to is a crate at /library/want.
- Swipe between the tabs, and pull any library sheet down to close it.
Posts
- Making a post starts with search: one sheet, stars on each work, the words above.
- A work can be dropped between lines of words.
- Create is in the rail on every page on a computer.
Phone sign-in
- On a phone, Peltify's browser sign-in is offered only when the server says it can run it. A platform it cannot connect is not offered.
Not done yet
- The script security policy is sent in report-only mode. It is not enforced yet.
Written on 2026-10-14 from the build record (the commit history and build notes from 2026-10-11 to 2026-10-13), not on the date above.