Witness-Endangered Species

Each week, Witness brings you one species on the edge of disappearance: a drawn plate, its true story with sources, and one honest action to help a real organization already doing the work.

Comment

Witness: An Atlas of Endangered Life

Inspiration

Every extinction app I have ever opened did one of two things to me. It either buried me in a scrolling feed of doom until I closed it feeling worse and doing nothing, or it gamified the crisis into badges and leaderboards until the animals felt like points. Neither one respected the subject, and neither one respected me.

I wanted the opposite: something quiet. One species a week. Meet it properly, with a drawn plate instead of a stock photo, a story where every claim has a source and a date, and one real thing you can do about it. No feed, no account, no false promises. The whole idea rests on a line I keep coming back to: attention is the first act of protection. Before anyone donates or volunteers or votes, they have to actually look.

The Shipaton Peace Prize turned that idea from a note on my phone into a real app with a real deadline. The brief was to build something that benefits people and the world, not just users and a metric. That is exactly the constraint I needed.

What it does

Once a week, Witness introduces one threatened or extinct species. You get a full-screen original illustration, a short story with its sources laid out where you can check them, and the evidence behind every number, including what is still disputed or unknown. I would rather hand you an honest range than a confident fiction.

One deliberate tap records your Witness. That word is chosen carefully. It means you gave this species a minute of your full attention. It is not a donation and it is not a claim of impact. The app then shows you the honest, deduplicated count of everyone else who witnessed alongside you this week. One credible conservation organization already doing the work appears in context, with a plain explanation of how supporting it helps. Your record stays private on your device, with room for a personal note, and you can carry it forward as a rights-safe share card if you want to.

All of that, the weekly species, the story, the sources, the count, the action, your private notes, sharing, is free, always, by written policy. The paid layer sells depth and continuity, never the moral act. Field Season One is a one-time purchase: an opening letter and eight chapters with their dossiers, a finite authored edition on eight of the rarest animals alive. The Atlas is a membership that keeps the living library of past weeks and future seasons open. You are paying for the archive and for ongoing production. You are never paying to care.

How I built it

The app is native SwiftUI, split into two pieces on purpose. WitnessApp is the presentation layer. WitnessCore is a dependency-free Swift package holding the species catalog, weekly assignment, streaks, and persistence. The core knows nothing about SwiftUI, StoreKit, RevenueCat, or any backend, which means the entire weekly ritual works fully offline and can be tested on its own.

RevenueCat runs the paid layer. Under the hood there are only two real access facts, a permanent one-time purchase and a membership, even though the store shows five choices: Field Season, a six-month or annual Atlas membership on the same entitlement, and a support tip that unlocks nothing at all. Five doors, two rooms. That was deliberate.

Supabase on the free tier is the whole backend, with separate staging and production projects. There is an idempotent witness-events table keyed by install, species, and week, a read-only aggregate count, and a plain events table for analytics. No user accounts anywhere.

Thirty species cards are launch-ready, and every one of them went through the same fixed pipeline: sourced research, a schema-valid record, original AI-generated artwork in one locked style with commercial rights confirmed, a species-accuracy review, an editorial review, and finally an automated catalog validator that runs in CI before anything ships. Locations are deliberately kept vague so a card never points a poacher at a nest or a den.

The companion site at witnessatlas.com, built on Next.js and Vercel, mirrors the approved catalog exactly. Nothing is rewritten for the web. Every public claim is held to the same evidence ledger as the app, and readers can inspect the sources and suggest corrections directly.

Claude helped me write and, more importantly, hold the line on the product's decision log, the content pipeline, and the truthfulness rules described below. On a solo build under deadline, having something that pushes back when you try to cut a corner turned out to be worth a lot.

Challenges I ran into

Apple's own tooling broke my test coverage. A defect in xcodebuild test on iOS 26.5 stops the command line from syncing the local .storekit configuration to the simulator's store daemon, so the automated purchase-flow tests cannot run end to end from the CLI. Only a subset of non-mutating cases pass. I documented the defect and the ways around it rather than quietly deleting the tests and pretending the coverage existed.

RevenueCat does not cryptographically sign its webhooks. Its documented security model is a shared secret in a header, not an HMAC signature, and I was not willing to claim signature verification I had not built. So I wrote my own doorman: constant-time secret comparison, a five-minute clock-skew window, a strict product allow-list, idempotent atomic writes, and a 28-check adversarial test suite that tries to sneak bad payloads past it. I would rather distrust the payload and prove it than trust it and hope.

The hardest constraint was emotional, not technical. This product exists to make people feel something about a real crisis, and yet a single written rule governs every screen: never imply that a tap, a share, or a subscription saved an animal, funded conservation, or changed an outcome, unless that claim can be formally audited. There were many nights where the most effective sentence was also the dishonest one, and I had to cut it. Holding that line while still wanting the app to move someone shaped more decisions than any bug did.

Accomplishments I'm proud of

A commerce model with five user-facing choices that never turns into a confusing tier system, a badge economy, or a paywalled moral act. The complete ritual is free forever, and that is written policy, not a marketing promise.

Thirty species carried through a real editorial pipeline by one person, each with a dated rights record and a fact-check date, not a scraped or invented catalog.

A backend that gives an honest global witness count with no accounts, no tracking beyond an anonymous install ID, and a webhook I can actually defend under adversarial testing.

A vocabulary of banned phrases, among them "prove you care," "adopt," "donate," and "save this animal by subscribing," enforced as hard rules in the pipeline, not just as taste.

What I learned

The ethical guardrails turned out to be as much engineering as the app itself. A truthfulness policy is only real once it is a validator that fails a build, a webhook check that rejects a bad payload, or an access rule with a test behind it. A paragraph in a document nobody rereads at two in the morning under deadline pressure is not a policy.

I also learned what a security model costs when a vendor's guarantees are weaker than you assumed. Building my own verification layer on top of RevenueCat's webhook was unplanned work that ended up mattering more than most of the interface.

Mostly, I learned that a social-good product earns trust the slow way: dated evidence, checkable sources, and a policy that says no to copy that is easy, effective, and untrue.

What's next for Witness

Clear the remaining release gates, sandbox purchase evidence, accessibility sign-off, and App Review, on the way to the App Store.

Grow from thirty launch cards toward the hundred-species backlog through the same reviewed pipeline, one week at a time, because that is the only pace the method allows.

Get the featured actions reviewed by a conservation or subject-matter advisor, as the Peace Prize impact case calls for. Citing an organization is not the same as partnering with one, and I want that boundary checked by someone who knows the field better than I do.

The thin line is not only where species disappear. It is also where they come back, one counted individual at a time. Witness is my attempt to make people stand on that line for a minute a week.

Join our community on https://community.witnessatlas.com/

Share this project:

Updates

Submission history