Owner review — keep unpublished

Production launch checklist

Live integration status is read from the server; no secrets are exposed.

Feature readiness

● WorkingEmail sign-up, verification, password resetLovable Cloud auth

● Working21+ gate (email + self-attestation + Terms; provider verification optional, required for calls)Self-attestation is NOT age verification — residual risk of minors; mitigated by reports, protective holds, moderation

○ Needs providerAge verification vendorSigned webhook adapter ready

● WorkingProfiles, discovery, interest matching

● WorkingConsent-based mutual matching

● WorkingPrivate & group chat (realtime, persisted)

● WorkingSupport circlesPeer support, not medical care

● WorkingVent wall with hugs

● WorkingReports, blocks, rate limits

● WorkingKeyword flags → human reviewMultilingual list; editable by staff

○ Needs providerAI moderation screeningFlags only; humans decide

● WorkingModerator dashboard, audit log, appealsAssign roles manually

○ Needs providerMachine translation (chat, posts, profiles, circles, reports)Detect + translate, labeled, original toggle, not stored

◐ PartialUI localisationHE/EN full; RU/UK/AR partial

○ Needs providerVoice/video callsDisabled for everyone (founder decision)

● WorkingData export & account deletion

○ Needs providerCustom email sender domainUses default sender

Production blockers

Rabbinic expert review
Commission a qualified rabbinic reviewer before claiming halachic fidelity for the 'Good Speech' code; AI speech coaching is advisory only.
Legal review
Israeli Privacy Protection Law incl. Amendment 13, database registration/DPO questions; GDPR + EU DSA if serving EU users; replace placeholder Privacy, Terms and Cookie pages.
Consent for sensitive data
Recovery/support circle membership may reveal health data. Needs explicit, granular consent flow approved by counsel.
Age verification vendor (21+)
Not configured. Add AGE_VERIFICATION_PROVIDER_URL and AGE_VERIFICATION_WEBHOOK_SECRET; the signed webhook adapter is ready at /api/public/age-verification/webhook.
Remove dev age mock
Dev mock is off.
Translation vendor
Not configured — translate buttons show a disabled state.
UI localisation
Four UI languages (Hebrew, English, Russian, Ukrainian; Arabic UI retired by founder) have complete strings; Russian and Ukrainian are machine-assisted and await native-speaker review.
Human moderation staffing
Moderator rota incl. 24/7 urgent queue (minors, self-harm), escalation contacts with authorities, wellbeing support for moderators.
Reporting workflows
Queues, severity, audit trail and appeals are built. Define SLAs, law-enforcement escalation (CSAM must be reported), and DSA notice-and-action process.
AI moderation evaluation
Measure false-positive/negative rates in Hebrew, Russian, Arabic slang before relying on it. AI only flags; humans decide.
Voice/video calls
REMOVED by founder decision: no call buttons, routes or settings; server refuses call tokens and the database blocks new calls. Text chat is unaffected.
Create Together hub
WORKING (with backend): song rooms with realtime presence/sections/votes/reactions, version history, consent invites, room chat, 8 group activities. AI co-writer uses Lovable AI (original lyrics only). Suno is copy/paste + external link only — no Suno API integration. Review music copyright/ownership terms with counsel.
Penetration test & security review
External pentest, RLS review, dependency audit.
Email deliverability
Configure a custom sender domain (SPF/DKIM/DMARC) for verification and reset emails.
Rate limiting at the edge
Database-level limits exist for messages, vents and reports. Add edge/IP limiting for sign-up abuse.
Crisis resources review
Confirm local hotline numbers per country/language with a clinical advisor.