Inspiration
Every "meet people" app forces the same bargain: to talk to anyone, you have to put yourself on the market. Dating is the front door, swiping is the only verb, and the moment you install it, strangers are rating your face.
We wanted the opposite default. Buzz Bee Social starts as a normal social app a feed, stories, chats, rooms and dating is a switch you flip yourself, or never touch at all. Instead of an infinite deck, meeting someone happens at a scheduled, time-boxed event where everyone shows up at once, which is much closer to how people actually meet offline.
What it does
- A social app that works without dating. Posts, stories, 1:1 chat with voice notes, stickers and images, follows, profile views, and WebRTC voice and video calls with native incoming-call UI.
- The Hive one anonymous room shared by everyone. Messages carry only a claimed alias, never a user ID; the alias-to-account join lives in owner-readable documents, so no user can map a message back to a profile. Messages expire on a 7-day TTL, and a "Queen Bee" moderator can post, curate reactions, ban, and privately pair two bees.
- Dating Mode, off by default. Turning it on is a server-owned callable that requires gender, who you want to date, and a confirmed face photo. Turning it off removes you from discovery and deletes pending Sparks in both directions without touching your posts, matches, or account.
- Sparks stay private. A Spark is never revealed to the other person. A private chat only opens when both people Spark each other.
- Hive Speed Dating, nightly at 20:00 SAST. Five rounds of a five-minute chat plus a one-minute transition, with text, stickers, emoji and voice. Pair messages are ephemeral, names and usernames are hidden during a date, and the round clock is server-authoritative with a latency grace window so a choice tapped on the buzzer still counts.
- Safety built into the data model, not bolted on. Bidirectional blocks that never reveal either identity, in-app reporting, screenshot blocking on Android, server-side photo provenance locking, and published Child Safety Standards with a zero-tolerance CSAE/CSAM policy.
How we built it
- Client: one Flutter codebase (134 Dart files) shipping to Android, iOS, and the web as an installable PWA with an app-shell cache and boot splash.
- Backend: Firebase Authentication with Google Sign-In, Cloud Firestore, Cloud Storage, Cloud Functions v2, Cloud Messaging, Remote Config, and App Check. Security rules are the real authorisation layer and are covered by emulator tests.
- Edge: Cloudflare Pages hosts the PWA behind
buzzbee.nexaryo.co.za, a Pages Worker transparently proxies/__/auth/*so authentication runs on our own domain, Cloudflare R2 stores post media, and Cloudflare TURN credentials are minted by a rate-limited callable for WebRTC. - Media: a private Cloud Run service renders uploaded video, scales to zero, and is invokable only by the Firebase runtime service accounts. Face detection uses ML Kit natively and MediaPipe on the web.
- Tests: 18 Node test suites for the callables, triggers and Firestore rules, plus 12 Flutter test files.
Challenges we ran into
- Anonymity that survives an adversary, not just the UI. Hiding names in the interface is easy; making the anonymity hold at the database layer meant a create-once alias claim to block impersonation and message documents that never carry a user ID at all.
- A fair clock across five rounds. Speed dating breaks if two phones disagree about when a round ended. The schedule is derived server-side from a date key, and a five-second resolution grace window absorbs network delay and clock skew so a buzzer-beater choice is not rejected by the rules.
- Making Flutter behave inside an iOS PWA. Safari's per-tab memory budget crashed on-device face inference during posting, the canvas image pipeline needed explicit Storage CORS for every origin, and installed-PWA sign-in had to move to a redirect flow on a branded auth domain.
- Consent that is reversible. "Turn dating off" had to be a real, atomic server operation that cleans up pending Sparks in both directions while preserving everything the user built socially.
Accomplishments that we're proud of
- Dating is genuinely optional the app is complete and useful with the switch off, which is the thing every competitor claims and none of them do.
- A shared anonymous room whose privacy guarantees are enforced by security rules and document shape, with moderation that still works.
- A nightly, server-authoritative live event running on a serverless stack that costs nothing while idle.
- One codebase live on Android, iOS, and as an installable PWA, shipping at version 1.1.0.
What we learned
- Defaults are the product. Making dating opt-in changed the schema, the rules, the notifications, and the tone of the app far more than it changed the UI.
- If a privacy promise is not expressible in your security rules, it is not a promise it is a hope.
- Time-boxed, scheduled interaction produces far better conversations than an infinite deck, and it makes the moderation surface finite too.
- Flutter web is production-viable, but the PWA is a distinct platform with its own memory, CORS, and authentication constraints.
What's next for Buzz Bee Social
- Re-enable the on-device face gate on the web once inference fits inside Safari's memory budget.
- Themed and regional Hive events, and multiple concurrent rooms.
- Richer Queen Bee tooling and partially automated moderation triage.
- Expanding the pilot beyond the current South African cohort.
Log in or sign up for Devpost to join the conversation.