May 30 -> Jun 21, 2026
BikeQuest build log
From blank repo to paid cycling quest app.
A shareable timeline of the decisions, commits, checks, and product cuts that shaped BikeQuest between May 30 and June 21, 2026.
2026-05-3005:51
Project context became the source of truth
The repo started with `BIKE_QUEST_CONTEXT.md`: a written product frame before the app grew features.
Commit 5e892ce- How
- We initialized the repository, checked branch/remote identity, committed the context file, and pushed the first `main` commit to GitHub.
2026-05-3008:29
The static idea became a Next.js app
The first landing moved into Next.js, giving the project real routing, deployability, and a place for product copy to evolve.
Commit 3116a5f- How
- We kept the first implementation thin: App Router page, global CSS, brand mark, and a simple public entry point.
2026-05-3019:09
The visual direction moved away from retro game tropes
BikeQuest settled into modern outdoor adventure: adult, playful, badge-driven, and not a Strava clone.
DA prompt and constraints- How
- We compared the product promise with likely audiences and rejected retro pixel art, fantasy, neon gamer UI, and performance-chart aesthetics.
2026-06-0517:01
Supabase tooling was connected to the build loop
Codex was wired to the Supabase project so database work could be inspected and verified from the same development workflow.
Supabase MCP connected- How
- We added the Supabase MCP server, authenticated it through OAuth, verified it with CLI-equivalent checks, and installed the Supabase agent skills.
2026-06-0519:57
The first MVP loop landed
The app gained its initial quest flow, protected app surfaces, profile management, badge reveal, and catalog momentum.
Commits a9ab972 -> e55dc56- How
- We built the minimum app shell around Supabase auth, rider profiles, quest catalog views, and unlock presentation instead of starting with community features.
2026-06-0519:59
Security was treated as a product milestone
A repo-wide security scan mapped the real trust boundary: Supabase RLS, storage, service-role paths, and protected app routes.
Security review completed- How
- We threat-modeled first, filtered generated files, reviewed runtime surfaces, validated candidates, and kept findings grounded in source and build evidence.
2026-06-0721:14
Quest proof validation entered the core loop
Photo and activity evidence became part of the product, with validation routes and later rate limits around the proof flow.
Commits 785a1c4 and 461e543- How
- We added the validation route, connected quest proof requirements, and followed with rate limits so the AI-backed flow had basic abuse protection.
2026-06-0821:06
Mobile onboarding and profile permissions got tightened
The onboarding path was refined so riders could get into the app with fewer dead ends and cleaner permission handling.
Commit 2af3e34- How
- We inspected auth/onboarding surfaces, adjusted the mobile flow, and kept profile setup aligned with the protected app routes.
2026-06-1416:42
Pricing became simple: €19 once
The landing dropped fake launch scarcity and aligned on a straightforward one-time payment for full BikeQuest access.
Commit 49ee484- How
- We pinned the copy in tests first, then centralized the pricing story in `src/lib/landing.ts` and updated the visible pricing section.
2026-06-1417:50
Progress moved from XP to collection
Gamification became album progress: unlocked badges, family completion, and visible locked badges instead of levels or XP.
Commit f5db8e3- How
- We derived progress from existing catalog and `user_badges` data, added a pure helper, and reused it across app, badges, profile, and success states.
2026-06-1511:27
The MVP was simplified into a badge board
Today, feed, and local quest progress were removed from the rider loop. Quests and badges merged into one scannable board.
Badge-first direction- How
- We turned badges into the primary visual unit, redirected extra surfaces, and focused quest detail pages on proof upload and validation.
2026-06-1522:38
The quest board and rider profile were polished
Quest cards, orange accents, group previews, rider cards, and share surfaces made the product feel more deliberate.
Commits eafecc9 -> deb47f2- How
- We iterated on the same core screens rather than adding pages: quest board, card hierarchy, profile card, and badge sharing.
2026-06-1909:26
Profile uploads became lighter and visible before submit
Avatar upload gained immediate local preview and client-side WebP conversion before the profile form is submitted.
ProfilePhotoInput- How
- We wrote the regression test first, extracted a small client component, used canvas resize to 640x640, and replaced the selected file with `DataTransfer`.
2026-06-1911:09
AI validation prompts were aligned with product rules
Quest prompts, catalog wording, seed data, migrations, docs, and live Supabase rows were tightened together.
Commit 09e7a56- How
- We first reviewed coherence without editing, then applied focused fixes for Roundabout, Dirt Shortcut, 1H Outside, and Quiet Road across every source of truth.
2026-06-1911:28
Proof upload pages got clearer
The quest proof flow was made easier to understand before riders submit evidence for validation.
Commit e223ee2- How
- We scoped the change to the proof uploader and quest surface, checked the diff, verified tests, and pushed the focused commit.
2026-06-2014:44
Stripe checkout turned the app into a paid product
BikeQuest got a real one-time Stripe payment flow, checkout routes, webhook handling, and a paid-access table.
Commit 1816723- How
- We recovered the offer from the repo, created the Stripe product and price, added checkout/webhook routes, applied the Supabase migration, and verified production routes.
2026-06-2018:46
The public site gained trust surfaces
Legal pages, simpler landing header/footer, and clearer public navigation made the launch surface more complete.
Commits 6b00eee and cd27485- How
- We kept the work close to public routes and landing structure instead of changing the app loop underneath.
2026-06-2021:00
A fake user verified the whole paid app path
A test account was created with auth, confirmed email, profile, and a paid purchase row so the full app gate could be tested.
alexis_test profile- How
- We used Supabase Admin through the repo environment, upserted the profile and purchase state, then verified sign-in and paid access.
2026-06-2021:34
Security and UX hardening closed the biggest gaps
Redirects, proof asset ownership, feed likes, paid attempts, and Supabase policies were hardened and pushed to `main`.
Commits e38f800 and 64b827e- How
- We audited the concrete runtime surfaces, wrote targeted schema tests, applied the migration through Supabase, and verified with tests, lint, build, audit, and SQL checks.
2026-06-2022:08
The auth and onboarding funnel got smoother
The app’s sign-up, login, and onboarding path was tightened after the paid-access model existed.
Commit f611ca6- How
- We refined the auth funnel around the actual route sequence instead of treating checkout, onboarding, and app access as separate stories.
2026-06-2117:15
Launch UX, quest cards, and rider sharing were refined
Mission layout, rider-card sharing, all-badge display, launch polish, and quest objective surfaces got a final product pass.
Commits 2610fcb -> f8a1509- How
- We kept iterating on visible launch surfaces: auth copy, quest objectives, card spacing, share card content, and the rider profile presentation.
2026-06-2120:20
Account recovery and promo readiness rounded out the build
Stripe promotion codes, auth confirmation, and password reset pages made the paid launch path more resilient.
Commits 1d3ed86 and d46ef19- How
- We added the practical launch-adjacent surfaces that prevent support issues: discounts, email confirmation states, and password reset flow.