Auth, data handling, and the constraints that come from holding health data.
21 posts.
Kudos can now be one of five preset reactions, with nothing typed and nothing to moderate. And coaches get one screen for everyone who shares their training with them, consent checked exactly as before.
The monthly backup email can now carry the export itself. It was held back for a privacy reason, then built behind a second opt-in with a plain warning. Here's the trade-off and how it's guarded.
The app, the API, both sites and the infrastructure notes are now public on GitHub under AGPL-3.0. What that took, and what was checked first.
A habit reminder now has Done and Snooze buttons. The service worker that handles them has no access token, by design, so each button carries a signed, single-purpose link instead.
The app's Permissions-Policy says camera=(). Barcode scanning shipped anyway, by reading a photo instead of a video stream, and the lookup sends the barcode and nothing else.
PaceStreak's insights compare your own days with a Welch t-test, not an AI. Why the bar for showing a pattern is deliberately high, and why the app tells you it's correlation.
Three real bugs found by using the OTP flow the way a person actually would: a stuck login, a false 'already registered' error, and a confirmation screen that didn't lead anywhere. Plus a status page that finally watches the whole stack.
Training sessions and habits render on the identical week grid, with the identical marker X. The product doesn't visually distinguish 'important' streaks from 'personal' ones, because that distinction is exactly what would make a habit legible to anyone glancing at the screen.
The whole-life leaderboard ranks one thing: weeks with anything logged, training or habit. It never sees what you logged, because ranking content instead of attendance is how a habit tracker turns into a place people perform for.
The API's hosting decision is made: a free-tier GCP VM, Neon and Upstash, zero-downtime rolling updates on a single-node Swarm - and why the VM pulls its own updates instead of GitHub Actions pushing them.
Turnstile went on signup, login, forgot-password, resend-verification and recover for one reason: those five endpoints can empty a free email quota or grind past a rate limit, and a CAPTCHA on the feed or the streak grid would only annoy people who never touch them.
PaceStreak's Content Security Policy allows nothing from other origins, so the new typeface had to ship with the app. Archivo's width axis turned out to be the whole reason to choose it.
Progress photos used to live only on the phone. Now they can be backed up to the account, opt-in, with the bytes checked, never cached, and deleted everywhere when backup is turned off.
PaceStreak added habits, including ones people are trying to break. That made one rule non-negotiable: a habit's name, amounts and slips never reach anyone else, not even as a badge name.
The public site described an idea; the product had moved on. The rebuild puts every claim in one data file sourced from the code, ships a streak simulator that runs the real rules, and keeps the site static with zero third-party requests.
Export as JSON, CSV or calendar; import it back; delete with a 30-day safety net; units that can't corrupt history; and moderation that never touches your training log.
Five features built in one pass: an injury pause that can't be abused, planned rest on the grid, a weekly recap, GPX/FIT/CSV import without third-party sync, a private calendar feed, and an official account nobody can imitate.
Follows with approval, a feed checked for visibility twice, crews that share exactly three things, coach access you control, age gates, and moderation that never touches your training log.
RS256 access tokens held only in memory, rotating refresh tokens with reuse detection, CSRF on cookie transport, TOTP with replay protection, and the gaps we have written down rather than hidden.
Designing habits you are trying to break: zero is a clean day, slips are counted honestly, and nothing is ever shown to anyone else.
Why the session cookie uses __Secure- rather than __Host-, why SameSite=Lax is enough, and the rule it forces on the whole domain.
PaceStreak is a habit and streak tracker for training and everything else worth doing regularly.