The week we checked our own work

The build is finished. This week did not go into opening the doors; it went back through our own work the way we tell you to inspect a house before you sign, looking for the places where a promise and the thing behind it have come apart.

The pay path is whole now. You can subscribe, get a receipt, and leave again in a single click, and every part of it stays switched off until the day we open. We built the way out at the same time as the way in, because a subscription you cannot leave easily is one we would not sign ourselves.

Then a plain question: does someone reading the site have to clear a cookie banner first? We read every line of our own code that could store something on your device or call out to anyone else, and the answer is no. The one outside call the check found was a font service: every page load quietly told another company’s servers that you were there, without our ever saying so. It is gone. We host the type ourselves now, and while you read a page here the site reaches no one else. We confirmed the built site makes zero requests to any other server across four pages, and it held.

When something on our side breaks we catch it, and we catch nothing about you. The shape of the failure lands in our own logs, where we can act on it. The database keeps only a key to group one fault with the next: no message, no detail of yours.

We ran the harder inspection on the code and the way the system fits together, looking for the failure that has not happened yet. The answer was: open, once you close this short list. So we closed it the same day. A lock now sits in the plan so your costs can never be redrawn twice at the same moment and appear doubled. The app refuses to boot at all in the one configuration that would leave it open to the public without charging. Our own counting is held in agreement across the two halves that record it. And the outside watch that pages us if the site ever stops answering got tested the honest way: we made it believe the worst had happened and confirmed the alarm reached us.

We also wrote down, in plain words you can read, how long we keep each kind of record. An abandoned signup clears in seven days. Security data, like the network address a login came from, clears in ninety. An invited account that never became a paying one is held twelve months, with a plain email a month before it goes, so nothing is deleted out from under anyone. Contractor details you saved are held two years after you last touch them. Every one is a period we can name, not “for as long as we like.”

The one thing that faced outward this week is free and needs no account: a calculator that tells you whether a component is in a repair year or a replacement year, by the measure that settles it, the cost set against the years of use it buys.

What is left is the flip itself, and the flip is now a checklist and one reviewed change held for the day we run it. What remains is the date. Mid-July.