Roomful.
Events and in-room networking where a declined request is never visible to the sender
“Networking apps make rejection visible. Roomful makes it impossible to see.”
If a declined request can be inferred — from a missing card, a timestamp, an API response — people stop sending them. The privacy guarantee has to hold against someone poking at the API, not just someone using the UI.
Enforce it in the database. Every one of the 68 tables runs under row-level security, and dedicated tests assert what each role can and can't see. The client never receives a field that would reveal a decline.
The choices that mattered, with the reasoning at the time.
- Privacy in RLS, tested
RLS policies are the source of truth, with tests per policy, so a UI change can't accidentally leak a decline.
decision · 01 - Built with an agent workflow
I built Roomful with Shipyard, my own kit for orchestrated agent builds: ticket boards, adversarial review and red-proven fixes. 381 commits in 17 days.
decision · 02
Live since 5 September 2026: 62 pages, 29 API routes, 87 migrations, about 1,900 web and 500 mobile tests. Source is private.
- tables under RLS
- 68 / 68
- migrations
- 87
- built in
- 17 days