Build
TruChat: anonymous real-time chat platform
An anonymous, account-free chat platform with a ten-game real-time arcade and an earn-only rewards economy. The bet: remove every step between wanting to talk to someone and talking to them, and keep the safety rails an anonymous product needs.
- AI
- Development
- Product
- Personal build
- Commits shipped
- 633
- API routes
- 87
- SQL migrations
- 119
- Arcade games
- 10
The challenge
Most chat products force a trade-off between trust and friction. Demanding identity up front kills casual use; offering anonymity with no safety rails kills trust. The product needed instant, no-signup conversation alongside server-enforced safety and a monetization model that could not be gamed by simply paying for status.
My contribution
- Set the safety and monetization philosophy: Google-only auth, a one-way non-purchasable points economy, and contact-info sharing blocked server-side rather than moderated after the fact
- Directed the build across five connected systems: 1-on-1 and random chat, rooms, a ten-game arcade, the TruPoints economy, and a full moderation and admin stack
- Retired the original puzzle platform in favour of a purpose-built arcade, and ran a Material Design 3 redesign plus a mobile pass that reclaimed 108px of chrome
- Directed dedicated audit passes across accessibility and mobile UX that replaced guessed estimates with verified, code-level findings
- Prioritized and reviewed all 633 commits, holding the i18n rollout back from a shortcut that would have cost the marketing pages their server-rendered SEO
Results
- 427
i18n keys at full parity across 6 languages on core product surfaces
- 165
Postgres row-level-security policies enforced universally across the schema
- 22
SEO-driven public pages built as an organic-discovery surface distinct from the app
- 5
connected product systems shipped: chat, rooms, arcade, economy and moderation
AI collaboration
Claude Code was used as an agentic pair-programmer rather than a one-shot code generator: reading the existing codebase, proposing implementations, running the project's own test and lint tooling, and iterating against feedback. Product direction, architecture calls and final review stayed with me.
What I did
- Product scope, safety posture and the anti-pay-to-win monetization stance
- The decision to retire the original puzzle platform and build a purpose-built arcade
- Prioritizing security and accessibility hardening passes between feature pushes
- Holding the public marketing pages back from client-side translation to protect their SEO rendering
- Review and merge of every change before it shipped
What AI executed
- Implementing API routes, SQL migrations and UI components to spec
- Writing and extending the test suite across arcade anti-cheat, authorization and i18n parity
- Large mechanical passes such as i18n string extraction across hundreds of call sites
- Directed audit sweeps that reported actual findings from the live codebase, including one that corrected an inflated estimate of roughly 170 unlabelled buttons down to a verified 5 across all 279 buttons
Work completed
- Chat core: direct, random and roomsShipped
Three-column Material Design 3 shell, plus a mobile pass reclaiming 108px of chrome.
- Ten-game arcadeShipped
Energy system, per-game leaderboards and anti-cheat run validation.
- TruPoints economyShipped
Earn-only by design, with a redemption catalog and admin adjustment tooling.
- Security hardeningShipped
Universal RLS, header hardening, dependency CVE patching and env fail-fast.
- i18n across chat, rooms, arcade and rewardsShipped
427 keys at full parity across six languages.
- i18n across premium and admin consoleIn Progress
Still English-only; scoped as the next translation pass.
- Localized public marketing pagesPlanned
Waiting on locale routing so server-rendered SEO survives the rollout.
- Friends UI, gift storefront, notification centerPlanned
Backend groundwork exists; the front-end surfaces are not yet built.
- Admin 2FA and staging environmentPlanned
Flagged as operational hardening for the next phase.
Challenges and solutions
An anonymous, account-free product is inherently harder to keep safe, and moderation alone always arrives after the harm.
Solved architecturally: contact-info sharing is rejected server-side with a 422 rather than flagged after the fact, so the unsafe action never completes.
Premium status needed to feel earned rather than bought, without abandoning monetization entirely.
Removed the payment processor outright and rebuilt Premium access around the points economy: a deliberate, harder-to-reverse product bet.
Wiring the public marketing pages to client-side translation would have shipped six languages quickly, but stripped those pages of the server-rendered output their organic search traffic depends on.
Held the rollout rather than taking the fast, damaging shortcut, and scoped proper locale routing so the marketing surface can be translated without losing its SEO rendering.
Chat on mobile lost too much vertical space to app chrome, leaving too little room for the conversation itself on the devices most people actually used.
Ran a mobile UX overhaul that reclaimed 108px of chrome and rebuilt the shell around Material Design 3, so the message list gets the screen instead of the interface.
Technical implementation
Frontend
- Next.js 16 (App Router)
- React 19
- TypeScript 5
- Serwist PWA
Backend
- 87 API routes
- Dedicated lib layer for business logic
- Zod schemas at every API boundary
Data and auth
- Supabase (Postgres)
- 165 row-level-security policies
- Google OAuth
- CLI-managed migrations
Platform
- Upstash Redis rate limiting
- Vercel with scheduled cron
- Sentry across client, server and edge
Safety
- Server-side contact-info blocking
- DOMPurify sanitization
- HMAC-signed cookies with constant-time comparison
Testing
- Vitest
- Testing Library
- Anti-cheat, authorization and i18n parity suites
Live project
Available now
Want something like this built?
I scope, design and build products end to end, with AI coding assistants writing code under my direction. Tell me what you're building.