Glow

Inspiration

You notice someone in class, at the gym, or across a hackathon hall. Walking up cold feels risky, so you don't, and you never find out they felt the same. Everyone on a dating app has already said they're open to meeting people, yet the apps ignore the one thing that matters most in person: you're both right here, right now. We wanted the safest possible excuse to say hi, one where interest that isn't mutual is never shown to anyone.

What it does

Glow has two modes in one app, on one account.

Rooms (the core). Check in to a room (a class, an event, this hackathon) by scanning its QR code; the phone checks you're really there and keeps only a pass or fail, never your location. You see "today's look" cards of the other opted-in people in the room: an outfit photo with faces blurred on the phone, no name, no profile, no distance. Tap the person you noticed. They're not told. If they tap you too, both phones buzz, then both screens light up in the same color with the same code word and a meeting spot, so you can find each other across a loud hall. If only one of you tapped, nothing happens, ever.

Blind. Swipe on photos only. Mutual right swipes become hidden matches. At the nightly drop, all your new matches open at once as chats with codenames like Fox or Comet, so you know you liked them but not which one they are. Nobody gets special treatment because of their photo. When both people tap Reveal, names and photos appear. Either of you can leave without ever being revealed. Before you send something that would give you away (a name, an Instagram handle, a description of how you look), the app warns you first.

How we built it

• A native SwiftUI iPhone app (iOS 17), split into feature modules in a local Swift package, with the project generated by XcodeGen.
• A Next.js API server in TypeScript, and Supabase (Postgres, sign-in by emailed code, private storage).
• Every rule lives in the database: one match per pair even when 50 pairs tap at the same moment, blocks in both directions, daily swipe caps, drop gating, expiry. Clients can't read or write any table directly; the server is the only door, and each answer is shaped so it can't leak.
• One OpenAPI contract generates both the Swift client and the TypeScript types.
• Privacy is engineered, not promised: faces are blurred on the phone before any room photo leaves it, image links are signed and expire in about a minute, each viewer's cards carry a faint watermark, coordinates are never stored or logged, and asking for something you're not allowed to see returns the same 404 as something that doesn't exist.
• In Blind mode the server never sends a chat partner's id, name or photo before both reveal. An end-to-end traffic scanner records every response in a scripted run and fails if anything about the partner appears before reveal; we proved it catches leaks by injecting them.
• A design language built on light: a warm dark room, glass surfaces, New York serif for the moments that matter, spring physics, haptics choreographed with motion, and three small sounds synthesized in code.
• We built it with waves of Claude Code agents working in parallel git worktrees (database, server, iPhone, features, a security red team, end-to-end testers, a design team), coordinated by an orchestrator that merged their branches, enforced ownership rules and ran the test suites.

Challenges we ran into

• iPhones throttle Bluetooth for apps in the background, so phone-to-phone detection is unreliable. We designed around it: QR check-in plus a pass-or-fail location check.
• Keeping Blind mode truly blind. Hiding names wasn't enough: our own red team found that swiping and then opening the drop right away revealed which swipe was mutual. Drops now only open matches made before the drop time, and chats open in batches with random codenames so timing can't give anyone away.
• Account takeover: our red team found someone could pre-register your email with a password. We removed password sign-in entirely; the emailed code is the only way in.
• Real phones can't reach a laptop's localhost, so we added a local-network demo mode where the laptop is the server and the phones join a private hotspot.
• Many agents sharing one laptop: we built a fair-share slot pool for Simulators, builds and local databases.

Accomplishments that we're proud of

• Every privacy rule has an automated test and an owner, and a dedicated red-team pass tried to break all of them.
• In our standalone Blind build, the full two-phone loop ran end to end through the real app on two Simulators at once: swipe, drop, blind chat, a one-sided reveal the other phone can't see, then the mutual reveal.
• The glow: two phones, same color, same code word, visible from the back of the room.

What we learned

Privacy that matters is mostly about what you don't send. The hardest bugs weren't crashes; they were tiny side channels, like a count, a timestamp or a "0 chats" answer, that told someone more than they should know.

What's next for Glow

• Crossed Paths: places you both go (a class, the gym), introduced hours later, never live, using native geofences.
• An Ultra Wideband arrow pointing to your match after a mutual tap.
• A wearable glow badge for always-on rooms.
• TestFlight and a first campus.

Built With

• claude
• claude-code
• next.js
• openapi
• postgresql
• supabase
• swift
• swiftui
• typescript
• vitest
• xcodegen
• zod