Specs & services

Was to run a second check, by a language model, on posts that looked like someone might be in crisis. It is not running: their terms permit keeping flagged messages for up to two years, and those posts are the most likely to be flagged. A person reads them instead. Distinct from our use of Claude to write software, listed further down.

Data: Nothing. No post or response is sent to them.

The automated safety check on posts and responses.

Data: The text of each post and comment, at the moment it is screened. The moderation endpoint keeps no copy — it is exempt from OpenAI's abuse-monitoring retention — and nothing is used for training.

Postgres database, authentication, and row-level security. Everything written here is stored there, and the automated safety check runs there too rather than on the machines that serve the site.

Data: Everything: posts, responses, accounts. Encrypted in transit and at rest.

Transactional email — confirmations, password resets, notifications, and the two getting-started emails — sent from server-side code with a project-scoped secret.

Data: Your email address, and nothing you have written. Our notifications deliberately carry no prayer, no response and no name — they say somebody responded, and you open the app to see who.

Our CRM — where we keep track of the people we're in touch with. The emails we send you are copied to it, so either of us can see what the other has written to you.

Data: Your email address and name, the emails we send you, and any reply you send to them. Never anything you post on the board — we do not put it there.

React 19 full-stack framework (SSR + server functions).

File-based routing and server-state cache.

UI runtime.

Build tool and dev server.

Typed codebase with strict type-checking.

Utility-first styling; Warm Sand design tokens.

Accessible UI primitives (dialog, form, toast, etc.).

Runtime schema validation for server-function inputs.

Translation. The app is built to be translated rather than retrofitted.

Serverless edge runtime for SSR and server functions.

Data: Every request to the site passes through it, including the pages you load while signed in. It runs our server code at the edge.

Build and hosting platform for the site and app. Listed again under AI tools — the same company in a second role, with different data attached to each.

Data: Source code, deployment configuration.

Domain registrar and DNS for prayergroup.live; mailbox for hello@prayergroup.live.

Data: Nothing about you. It manages the domain name only.

Analytics on our public pages only, and only for visitors who are not signed in — it never loads for a member, on any page (since 2026-10-01). Being retired at the end of 2026: we moved to PostHog in September and are running both until then to check one against the other. No ad features, no profiling.

Data: Pages visited, browser and device type, approximate location. IP addresses shortened before storage. Does not load at all if your browser sends a Global Privacy Control signal.

Product analytics, and session replay on the public marketing pages only. Session replay is never switched on where a prayer can be on screen — not on the board, not on a prayer, not on your account pages. Where it does run, every input and every piece of text is masked before the recording leaves your browser.

Data: Pages visited, browser and device type. Hosted in the EU. No cookie and no stored identifier, so we cannot follow you between visits.

AI pair-programmer used to draft code and copy under human review. Listed again under Backend & infrastructure, where it builds and hosts.

Data: Prompts and codebase context; no waitlist member data is sent.

General-purpose AI assistant for writing, ideation, and review.

AI software architect and pair-programmer — planning, implementation, and code review.

AI design assistant used to explore visual directions and design tokens.

General-purpose AI assistant for writing, research, and review.

Unit tests on load-bearing paths; runs before every deploy.

Scores how guessable a password is, to show you a strength meter. It runs in your browser and the password is never sent anywhere.

Checks a new password against a corpus of passwords known to have appeared in data breaches.

Data: The first five characters of a SHA-1 hash of the password, and nothing else. The password never leaves our server and neither does its full hash — this is k-anonymity, and it is how the service is designed to be used.

Runs every check on every change — the migrations, the type checker, the tests, the privacy test suite, the build — before anything ships.

Target conformance standard for the public site: 4.5:1 body-text contrast, keyboard-reachable interactive elements, one <main> landmark per page, visible focus rings, and honoring prefers-reduced-motion.

Automated accessibility scanner. Runs every Monday against the live site — the public pages in English and Spanish, and the member screens behind a real account — via pa11y-ci with both the axe and HTML_CodeSniffer engines.

Self-hosted Atkinson Hyperlegible Next, Source Serif 4, and IBM Plex Mono font files for the Hearth design system. Self-hosted matters here: no request reaches a font CDN, so no visitor IP leaves with one.