photo sending with identity and consent checks — Loopi
The photo pipeline made trustworthy: a character only sends a picture after a real offer, the picture is always of her, and a promised photo still arrives if you answer days later.
What is it?
The work that made a character sending a photo something the app can guarantee rather than hope for.
What it does
- A photo counts as authorized only after a genuine offer, not because someone asked
- A picture can only ever show the character herself — asking her to put someone else in it no longer works
- She stops typing out a description of a photo instead of sending the photo
- A one-time story photo still arrives with its moment intact if the person says yes days later
- Photos open full screen, with pinch to zoom and drag
- When one photo in a conversation can't be shown, only that one shows as missing instead of hiding every photo in the chat
- Blocked photos are listed in the admin with the reason recorded against each one
How it works
One decider answers "is a photo authorized this turn," so the prompt and the safety check can never reach different conclusions. A story moment is reserved, verified, then spent — it only counts as used once the photo actually reached the person, which is what stopped one-time moments being silently burned by a message that failed to send. Characters are told a character's age before her picture is drawn, so the app stops generating images its own safety check rejects.
Built with
TypeScript, Expo, Fastify, Postgres, Cloudflare R2 with signed URLs, kie.ai for image generation.
stack
screenshots
