Drunkava

Drunkava is a private-by-default social memory app for adults. The Expo SDK 54 client uses Supabase Auth, PostgreSQL, Storage, Realtime, Edge Functions, and Row Level Security. SQLite remains an encrypted-platform-adjacent offline cache and durable mutation outbox; Supabase is the source of truth.

The app covers onboarding, night logging, photos/video, Stories and exports, Feed, relationships, discovery, venues, clubs, events, messages, notifications, insights, reports, settings, data export, and account deletion. It never estimates BAC, sobriety, or fitness to drive.

App setup

Requirements: Node 20.19+, Bun 1.3+, Expo SDK 54 tooling, and an Expo development build for full native notification/media behavior.

bun install --frozen-lockfile
cp .env.example .env.local

Set only the Project URL and publishable key from Supabase’s Connect panel:

EXPO_PUBLIC_SUPABASE_URL=https://YOUR_PROJECT.supabase.co
EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...
EXPO_PUBLIC_APP_ENV=development
EXPO_PUBLIC_ENABLE_PUBLIC_DISCOVERY=false

Never put a secret/service-role key, database password, SMTP password, or provider secret in an EXPO_PUBLIC_ variable.

Run the client:

bun start

Supabase deployment

The schema is migration-controlled. Do not edit the hosted database manually after linking it.

bunx supabase login
bunx supabase link --project-ref YOUR_PROJECT_REF
bun run db:push
bunx supabase config push
bunx supabase functions deploy --use-api
bunx supabase gen types typescript --project-id YOUR_PROJECT_REF > src/types/database.ts

Generate and set a server-only internal function secret, then configure scheduled cleanup and notification delivery from trusted database webhooks/Cron. Do not commit the secret.

bunx supabase secrets set INTERNAL_FUNCTION_SECRET="$(openssl rand -hex 32)"

The committed Supabase configuration enables immediate email/password signup without an email-verification gate, 8-character letter-and-number passwords, secure password changes, and drunkava://** password-reset redirects. Configure production SMTP and branded reset templates before launch.

The initial age policy is deliberately named DEVELOPMENT. Replace it with a legally reviewed, enabled launch-market policy and update the client market selection before making a production build.

Account setup is server-authoritative: age eligibility is checked locally, current policy versions are accepted atomically, and the profile is considered complete only after the complete_onboarding RPC succeeds and bootstrap returns ready. Incomplete accounts require a connection; offline entry is available only after that account has previously reached ready. Raw dates of birth are never uploaded or persisted.

Data and security model

• Auth sessions persist in chunked Expo SecureStore on Android/iOS and browser storage on web.
• Every exposed table has RLS. Private authorization predicates live outside the Data API schema.
• Night creation, drink calculations, blocking, age-policy acceptance, notification updates, and deletion requests have trusted database contracts.
• Media uses private Storage buckets, ownership paths, short-lived signed URLs, reference-aware cleanup, and local immutable caches.
• Offline mutations are written transactionally to SQLite before network sync and replay with stable UUID idempotency keys.
• Realtime channels are private; authorization and table RLS filter notifications, messages, Stories, comments, and collaborative-night updates.
• Export and permanent deletion run in authenticated Edge Functions. Service-role access never enters the app.
• Production accounts start empty. Fictional seed content is restricted to the unauthenticated development fixture path and is never uploaded automatically.

Quality

bun run format:check
bun run typecheck
bun run lint
bun run test
bun run theme:audit
bun run media:audit
bun run doctor
bunx expo install --check

Database checks require Docker for the local Supabase stack:

bun run db:start
bun run db:reset
bun run db:test
bun run db:lint

Bundle verification:

CI=1 bunx expo export --platform android --output-dir /tmp/drunkava-android
CI=1 bunx expo export --platform ios --output-dir /tmp/drunkava-ios
CI=1 bunx expo export --platform web --output-dir /tmp/drunkava-web

Remaining external launch gates

Supabase integration does not supply the business decisions or third-party accounts needed for a store launch. Before production, provide a legally reviewed launch market/age policy, production legal and support URLs, a real places provider, production SMTP, moderation staffing/processes, an EAS project ID and push credentials, monitoring/consent configuration, store privacy disclosures, backups, and incident/rollback ownership.

Read DRUNKAVA_BUILD_SPEC.md before changing product behavior.