Cossy

Cossy is a social media and tool platform for cosplayers.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Cossy

Inspiration

I cosplay myself, so I know the problem firsthand. A cosplay takes weeks, sometimes months. Patterns, foam, thermoplastic, sanding, priming, painting, a budget that keeps growing and a con date that doesn't move. And almost none of that story survives. It ends up scattered across camera rolls, Pinterest boards, notes apps and group chats.

When I researched the space, two things stood out:

  • Cosplanner, the best known cosplay planning app, is abandoned. Its last iOS update was in 2020, the Android app was pulled in January 2025 and the web login is broken. It still holds a 4.5 star rating. The demand is real and nobody is serving it. Its reviews read like a requirements document: sub-checklists inside checklist items, buy vs. make cost tracking, reference storage, dark mode.
  • Community-only cosplay apps died too. They had social features but gave people nothing to do.

Ravelry showed the formula for knitters years ago: pair a community with real hobby utility, so the tools feed the social layer. Nobody had done that for cosplay on mobile. So I built the app I wanted for my own builds: Build, share, meet.

What it does

Cossy is a social app for cosplayers, costume makers and cosplay photographers.

Build

  • Cosplan tracker with pieces, nested steps and budgets (buy, make or commission)
  • A private reference vault for every build
  • Set a con date and Cossy counts down
  • Log each work session and keep your craft streak
  • Con Crunch mode puts the days left next to the steps left

Together

  • Group cosplans, with pieces split between crew members
  • A room for every convention, plus character rooms
  • Con buddies: plan a con with friends before you arrive
  • Met at Con: scan a QR code at a con you both attend and Cossy remembers where you met

Share

  • Build timeline reel: your build log becomes a before and after reel
  • Chronological feed, Discover, likes and awards
  • Credit by role (cosplayer, maker, photographer), not just an @mention
  • DMs and group chats, with request-to-message so strangers can't cold DM you

Premium and Coins (RevenueCat)

  • Monthly and yearly Premium: premium themes, a crown badge, unlimited cosplans (free tier = 3) and a place in the supporter spotlight
  • Coins to send awards to creators you want to support

Available in English and Japanese.

How we built it

Cossy was built solo, from the first commit on 19 July 2026 to a live App Store app.

  • App: Flutter (iOS + Android), one codebase, full i18n from day one
  • Backend: Supabase (Postgres, Auth, Realtime, Edge Functions) in the EU. The app talks to Postgres directly, so Row Level Security is the whole authorization layer: 53 migrations and 13 edge functions (awards, uploads, push, data export, account deletion and more)
  • Monetization: RevenueCat for subscriptions and Coins. The coin balance lives in a server-side ledger, credited by the RevenueCat webhook and spent through a server function that prices every award, so the client can never mint coins
  • Media: presigned uploads to Cloudflare R2, with EXIF/GPS stripped before upload
  • Moderation: a self-hosted NudeNet (ONNX, CPU) worker. Cosplay has a lot of legitimate skin, so the model never rejects anything. It only flags images for human review
  • Push: OneSignal, including a weekly digest every Friday
  • Quality: Sentry for crashes, opt-in PostHog analytics, and a release gate that replays every app query against the live database schema before a build can ship
  • Release: Codemagic to TestFlight, and the Play Developer API to Play tracks
  • Rollout: every feature shipped dark behind a realtime feature flag table, then got switched on one at a time during Shipaton for #BuildInPublic

Cold start matters for a social app, so launch day already had 31 real conventions (2026 to 2027, dates checked against the official sites) and a populated feed.

Challenges we ran into

  • Security with no backend in between. When the client queries Postgres directly, one loose grant is a vulnerability. A full OWASP audit near the end found a real privilege escalation path through a view. I reproduced every exploit against a local copy of the old schema, fixed them in hotfix migrations, proved the fixes locally, then verified in production that the exploits were blocked. There were no signs of exploitation.
  • App Store privacy review. iOS 1.0.0 was rejected because the privacy label wrongly declared location tracking. Cossy collects no location and doesn't track, so the fix was correcting the label, not adding a tracking prompt.
  • Google Play's closed-testing gate. New personal developer accounts need 12 opted-in testers for 14 continuous days before production unlocks. You can't speed up that clock, so Android is in closed testing while iOS is live.
  • Moderating cosplay fairly. Auto-blocking would punish legitimate costumes, so the pipeline is flag-then-human, with report, block, mute and a takedown path from day one.
  • Schema drift vs. dark features. A migration could silently break a query in a feature that was still switched off. The schema smoke test that replays every select against production became the release gate.
  • Solo scope. Each week meant choosing what not to build. I dropped in-feed ads and upload caps on purpose, because growing the community matters more than squeezing it early.

Accomplishments that we're proud of

  • Live on the App Store (1.0.2 since 24 September 2026), with Android in Play closed testing
  • A real planning toolkit (nested steps, budgets, con countdowns, Con Crunch) inside a social app, not bolted onto one
  • Credit by role, and consent-first messaging, for a community where photo rights and harassment are live issues
  • Fully localized in English and Japanese
  • Security audited and hardened before scaling, with the exploits reproduced and proven fixed

What we learned

  • Utility drives community. Every tool action (a new cosplan, a finished step, a con attendance) is content the feed can use.
  • With a client-to-database architecture, the database is the product's security. Test grants and policies like code.
  • Ship dark, flip in public. Feature flags turned a big release into a daily #BuildInPublic story.
  • Store compliance is its own project. Privacy labels, data safety forms, content ratings, child safety standards and tester gates took as much planning as features.

What's next for Cossy

  • Android production release once the closed test completes
  • Continued feature rollout from the flag queue
  • AI cosplay suggestions, already built and in the rollout queue: take a short taste quiz, get idea cards, turn a pick into a ready-made cosplan
  • Commissions and deeper maker profiles, so cosplayers can support each other directly
  • Growing the convention calendar and the Japanese community

Built With

Share this project:

Updates

Submission history