Social-first onboarding
OAuth signup → provisionSelf backend → username/languages/phone wizard → Goodreads CSV import → first personalized recommendations.
Back to portfolio
Case study — Portfolio
Lirix
The social network for real readers — no ads, no tracking, no infinite feed
iOS · Android · Web — shipped solo in ~8 weeks by a hands-on CTO/PO/RSSI
Lirix is a social reading tracker: no infinite feed, no ads, no tracking. MAG&Cie designed, coded, secured and shipped everything solo — TypeScript monorepo with Expo for mobile + web, Fastify + Prisma for the API, BullMQ workers for cron jobs, all in production on Fly.io, Vercel and Supabase.
Triple hat: CTO / Product Owner / RSSI
Why Lirix is an end-to-end demonstration of what a fractional CTO can ship without a team.
CTO — solo architect and tech lead
Single TypeScript monorepo for mobile, web, API, workers and shared packages. Full GitHub Actions CI/CD (lint, typecheck, tests, migrations, deploys). EAS Build cloud, Fly.io for the API, Vercel for the web, Supabase for the database.
Product Owner — pricing, gamification, UX
Free Solo + Premium (monthly or lifetime), Gamification 2.0 (XP, levels, quests, badges, 30-day reading duels), sprint-driven roadmap, UX refined through 5 consecutive App Store rejections up to build 34 in re-review.
RSSI — GDPR by design
Instant soft-delete + automatic purge after 30 days, JWT + JWKS with HS256 fallback, OAuth PKCE, phone-number hashing (SHA-256) for contact matching, strict CSP, secrets only in GitHub secrets and Fly secrets.
The product in one paragraph
Lirix is a social reading tracker for French- and English-speaking readers: personal library, multi-catalog search (OpenLibrary + Google Books + BnF SRU), notes and reviews, consistency stats, friend feed, gamification quests and reading duels. MAG&Cie designed, coded, secured and shipped everything solo — TypeScript monorepo with Expo for mobile + web, Fastify + Prisma for the API, BullMQ workers for cron jobs, all in production on Fly.io, Vercel and Supabase. Automated distribution: every push triggers lint, tests, DB migration, API + workers + web deploy and mobile OTA via EAS Update. Started as a side project, turned into an end-to-end demonstration of what a fractional CTO can ship without a team.
Key numbers
1
person — design, code, security, distribution
~8
weeks of intense dev from idea to stores
~40,000
lines of TypeScript across the monorepo
3
simultaneous platforms (iOS, Android, Web) — a single codebase
23
gamification quests + XP, levels, badges and duels
6
OAuth providers (Apple, Google, Microsoft/Entra, email…)
Technical stack
Every layer picked to keep the promise: one person, three platforms, production from day one.
| Mobile | Expo SDK 54, React Native 0.81, Hermes, Fabric (New Architecture), Expo Router 6 |
|---|---|
| Web | Same Expo codebase → static SPA export, Vercel deploy |
| Styling | NativeWind (Tailwind on React Native), declarative dark mode |
| Client state | Zustand + TanStack Query + AsyncStorage persister |
| Backend | Fastify, Prisma, Zod, RFC 9457 problem+json, Fly cdg region |
| Database | Supabase Postgres (transaction pooler 6543) |
| Cron workers | BullMQ + Redis, node-cron: release scan, weekly digest, monthly recos, streak-at-risk, reading-duels tally |
| Auth | Supabase JWT + JWKS + HS256 fallback, PKCE OAuth |
| CI/CD | GitHub Actions: lint + typecheck + tests + i18n parity + DB migration + prod deploy |
| Distribution | EAS Build cloud, App Store Connect API auto-submit, Google Play internal track |
| Observability | Fly logs, Supabase logs, GitHub Actions run history |
Concrete shipped features
Gamification 2.0
23 claim-based quests, XP per action, level chip visible on friends, level-up modal, 30-day reading duels between friends.
Contact discovery
Client-side SHA-256 hashing of phone numbers, server-side matching without ever storing plain values — security and GDPR from day one.
Multi-catalog books
Parallel fan-out OpenLibrary + Google Books + BnF SRU, 15-min Redis cache, bidirectional ISO 639-1/639-3 language filter.
GDPR
Instant soft-delete + 30-day purge worker, CSV library export, account resurrection on re-login within 30 days.
App Store journey
5 consecutive rejections on Guideline 2.1a (Fabric + iPadOS 26.5) fixed via documented iterative patches: Sign in with Apple custom button, splash resilience, orphan sessions. Build 34 in re-review.
Monetization from day one
Free Solo + Premium €3.99/month or €49 lifetime, RevenueCat for iOS/Android IAP, Stripe on web, Fnac/Amazon affiliation with an anti-bias charter.
Screenshots
Excerpts from the user journey — library, search, notes and stats.
Security & GDPR by design
Treated like a real SaaS product from the very first line of code.
- Instant user-side soft-delete + automatic purge worker after 30 days (executable right to be forgotten)
- Phone numbers hashed client-side via SHA-256 — never stored in plain text
- OAuth PKCE + JWT verified via JWKS with signed HS256 fallback
- Strict CSP on the web, hardened security headers (HSTS, X-Content-Type-Options, Referrer-Policy)
- Secrets only in GitHub secrets and Fly secrets — never in the repo, never in the logs
- Full CSV export of the user's library — data portability guaranteed
The method — how to ship a cross-platform app in 8 weeks
Four back-to-back phases, one operator, an architecture designed to keep the promise.
- 1
Product scoping
Clear positioning (no infinite feed, no ads, no tracking), Free Solo + Premium business model, Gamification 2.0 (XP, quests, duels), sprint-driven Notion roadmap.
- 2
Architecture and build
Single TypeScript monorepo for mobile (Expo/RN New Arch), web (SPA from the same codebase), backend Fastify + Prisma + Supabase, BullMQ + Redis cron workers. NativeWind design system, Zustand + TanStack Query state.
- 3
Security and GDPR
GDPR by design: instant soft-delete + automatic purge after 30 days, SHA-256 hashed phone numbers for contact matching, OAuth PKCE + JWT verified via JWKS, strict CSP, secrets only in GitHub secrets and Fly secrets.
- 4
Distribution and CI/CD
EAS Build cloud + App Store Connect API auto-submit + Google Play internal track. End-to-end GitHub Actions (lint, typecheck, tests, DB migration, API + workers + web deploy + mobile OTA via EAS Update). Observability via Fly logs, Supabase logs, Actions history.
What Lirix shows a prospect
Commercial translation: if Lirix is what he ships for himself in his own time, imagine what he ships on a paid engagement.
- Ship solo what a 4-person team would take 6 months to build
- Own the whole chain: product, tech, security, deployment, store distribution
- Understand App Store and Google Play stakes (5 rejections overcome)
- Automate end-to-end (CI/CD, OTA, DB migrations, auto-submit)
- Design for security and GDPR upfront (hashing, proper JWT, CSP, automated purge)
- Wire a SaaS service, a mobile app and a Prisma backend into production the next day
Frequently asked questions
What we get asked most about Lirix — and what we can say about it.
How long did it take to ship Lirix?
About 8 weeks of intense development, from idea to stores. One person: product design, code, security, deployment, distribution — a fractional CTO wearing the Product Owner and RSSI hats at the same time.
What technical stack was used?
Single TypeScript monorepo. Mobile: Expo SDK 54 + React Native 0.81 New Architecture. Web: same Expo codebase exported as a static SPA and deployed on Vercel. Backend: Fastify + Prisma + Zod, Fly cdg region. Database: Supabase Postgres (transaction pooler 6543). Workers: BullMQ + Redis. CI/CD: GitHub Actions. Distribution: EAS Build cloud.
How was security and GDPR handled?
GDPR by design from the very first commit. Instant user-side soft-delete + automatic purge worker after 30 days (executable right to be forgotten). Phone numbers hashed with SHA-256 client-side — never stored in plain text. OAuth PKCE + JWT verified via JWKS with signed HS256 fallback. Strict CSP, HSTS, secrets only in GitHub secrets and Fly secrets.
How many platforms is Lirix available on?
Three simultaneous platforms — iOS, Android, Web — from a single TypeScript codebase. iOS via the App Store, Android via Google Play, Web at lirix.club. Automated distribution: every push updates the API, workers, web and pushes a mobile OTA via EAS Update.
What does Lirix show a future MAG&Cie client?
That MAG&Cie can ship solo a complete product — mobile + web + backend + infra + security — without spinning up a team. That the firm owns the entire chain: product, tech, security, deployment, store distribution (5 App Store rejections overcome). Automation and GDPR designed for upfront.
Can we get similar support from MAG&Cie?
Yes. Every engagement is scoped bespoke. Whether it's a fractional CTO, an end-to-end product + tech + security engagement or a feasibility audit, the starting point is a conversation about scope and ambition. Contact us via /contact or book a call directly.
Similar need?
Looking for a fractional CTO who can ship a complete product — mobile + web + backend + infra + security — without spinning up a team? Let's talk.