The link is the grant
An invitation link is all a guest needs, so the code in it is treated like a key: it is never written to a log, never shown in a URL preview we control, and never searchable. Privacy is built into the structure, not added as a setting.
Nothing secret on your phone
Your phone holds what you can see and nothing that could be stolen from it: no signing keys, no card numbers, no ticket secrets. The server signs; the phone shows.
Offline is a state, not a failure
A venue's signal goes, and the app keeps working: your tickets, your guides and your countdown are on your phone, and whatever you change lands when you are back. Losing a message must cost latency, never correctness.
Every outcome is recorded
When the app or the server decides something — refuses a sign-in, skips a sync, rejects a scan — it says so somewhere a person can find. Silence is a defect: it is indistinguishable from the code never having run.
One rendering
The app looks the same on iPhone and Android, measured against one reference, screen by screen. A difference between the two is a bug, not a platform convention.
Deletion is real
Delete your account from inside the app and it goes: your profile, your sign-ins, your devices, your tickets, and the credential your sign-in provider issued for it. What must stay for other people's events to add up — a seat count, a ticket that was scanned — stays with your name removed.
Tests are not optional, and neither is saying so
A change ships with its tests, and a change that could not be verified says that it could not, and why. A row in a ledger that nobody has walked is not a pass.