Full-Stack Developer for QR Pet ID App

**Project Type:** Contract / Freelance **Tech Stack:** React / Next.js, Node.js, Supabase (or Firebase), OAuth 2.0 ### About the Project We are building a premium, artistic QR-code-based pet ID tag platform. To ensure high security and streamlined operations, we are using a split architecture: a Squarespace storefront handles all e-commerce, while a custom, highly secure web application handles the dynamic pet profiles, QR activation, and location-routing logic. We are seeking an experienced Full-Stack Developer to build the custom web application, the owner dashboard, and the secure backend infrastructure. ### The Role & Responsibilities You will be responsible for building out the custom web app (Phase A, B, and C user journeys) where pet owners activate their physical tags, manage pet profiles, and recover lost pets. Because this app handles user location data and device IDs, strict adherence to security protocols, anti-hijacking measures, and data privacy compliance (GDPR/CCPA) is mandatory. ### Key Features to Develop * **Secure Tag Activation:** Implement a robust onboarding flow requiring OAuth 2.0 login and a physical 4-digit PIN printed on the packaging to claim a URL. * **Multi-Pet Dashboard:** Build a responsive user portal for owners to manage multiple pets, update photos/medical info, transfer ownership, or remotely deactivate tags. * **Safe vs. Lost Modes:** Develop privacy toggles where "Safe Mode" hides owner contact info behind a secure contact form, while "Lost Mode" exposes direct contact methods (tel/sms/mailto links) and triggers location tracking. * **Finder Geolocation Flow:** Build a transparent, consent-driven location request screen for finders. If GPS is approved, it captures exact coordinates; if declined or timed out, it falls back to IP-based regional location. * **Manufacturing Export Module:** Create a secure admin portal to export dynamically generated, collision-checked 8-character ID URLs and 4-digit PIN pairs for factory printing. ### Security & Privacy Requirements * **Cryptographic URL Generation:** Implement CSPRNG (Cryptographically Secure Pseudorandom Number Generator) for 8-character URLs using a specific 55-character, visually unambiguous alphabet. * **Brute-Force Protection:** Implement strict rate-limiting (e.g., 5 failed PIN attempts per hour triggers a lockout) and standard WAF endpoint throttling to prevent keyspace scraping. * **Data Compliance:** Build automated 30-day deletion policies for GPS/IP data, self-serve account deletion ("Right to be Forgotten"), and image upload moderation. ### Performance SLAs * **Speed:** Profile pages must fully render in under 2.0 seconds on standard 3G/4G connections. * **GPS Timeout:** Browser geolocation requests must timeout after 5 seconds to prevent endless loading screens, defaulting smoothly to the IP fallback.