PitStop

Clean toilets already exist, in cafés. What is missing is not a place but the right to go without ordering a coffee or negotiating at the counter. PitStop sells that right in advance, as a subscription: a monthly pass at €1, or a 72-hour visitor pass at €1.50.

Three actors, only one pays. The subscriber gets a map, a pass and access instructions. The café owner gives access to their toilets and gets footfall, with no constraint and no cost. PitStop connects the two.

Payment is simulated, and the app says so: the route is literally called mock-subscribe. The network is a demonstration of eight Paris venues.

The map shows nearby partners, blurred behind a banner until you hold a pass. A "Nearest" button computes the walking route through OSRM, capped at 10 km. The list, sorted by distance, accepts one filter at a time: in an emergency you do not compose a query, you tap once.

The venue sheet carries the essentials: structured hours with an "Open · closes at 11pm" badge, walking distance, accessibility, a photo of the entrance, and above all the access instruction, "Toilets downstairs, show the app at the counter". It is the most important field.

The pass is the screen you hold up at the counter: full-screen teal, like a boarding pass, with two proofs of life against screenshots, a clock ticking by the second and a continuously animated badge.

Everything works offline: TanStack Query persists partners, their instructions and hours, and the session with them, otherwise an offline subscriber would fall back on the paywall. The rotating code is never persisted: a stale code would only get you refused.

The sticker: a static QR by the till, scanned with the native iOS camera. The app opens by deep link, checks the pass, records the visit. No embedded QR reader, no camera permission, so it shipped over the air. Accepted limit: it identifies the venue, not the person.

The rotating code: the subscriber shows a QR that changes every 15 seconds and the counter scans it. The token is HMAC-SHA256 signed with a derived secret, lives 20 seconds, is single-use, and needs no storage between issue and scan. Four distinct refusals, each with its message so the counter knows what to say.

The safety net: a 4-digit code per partner, typed by the owner on the subscriber's phone, limited to 10 attempts per minute. And deduplication: the same subscriber counts once per hour at the same partner.

No café-owner app, on purpose: no shopkeeper will install an application to say their toilets are being cleaned. They get a web page, with no account or password, the token in the address is their identification, rendered in plain HTML so it opens on a 2015 phone sitting next to the till.

On that page: their footfall, a scanner for the subscriber's code in the browser, a pause capped at 24 hours during which they vanish from the map, their backup code, and a report form. A printable A4 kit provides the sticker, the code and four lines of explanation.

For the team: an admin screen with statistics, reports, partners and latest sign-ups, adding a venue through Google Places, and an embedded scanner that hits the café owner's real route.

NestJS 10 and MongoDB in strict TypeScript, Expo SDK 52 and React Native 0.76 on the new architecture, expo-router, TanStack Query, Zustand. Device-first identity: you can pay and use the app without an account. 15-minute access tokens, refresh tokens in HttpOnly cookies with rotation, bcrypt, Helmet, throttling. 34 backend tests, 33 frontend, 26 pages of documentation with six architecture decisions. Distributed through EAS Update on three channels.