Opening sign-ups on Pawdiary

Sign-ups on Pawdiary opened today. The app itself had been working for days. Getting it ready for strangers took longer than I expected, and most of that work is invisible, so here’s the list.

Search engines need real HTML

Pawdiary is a Vue single-page app, so the marketing page arrived as an empty div and a script. Fine for people, not ideal for search engines. The public pages (the landing page, terms, privacy and data processing agreement) are now prerendered at build time, and nginx serves that HTML while the app takes over in the browser. They also got proper titles, descriptions, a share image and a sitemap, and robots.txt stopped blocking them.

Fonts, contrast and the keyboard

Fonts are bundled with the app instead of coming from Google Fonts, which is one less third party seeing every visitor and one less domain in the content security policy. The muted text colour and some pale chips failed WCAG AA contrast, so they’re darker now, and the booking rows work from the keyboard.

Keeping bots out

Anything public gets abused eventually. Sign-up and sign-in sit behind a Cloudflare Turnstile captcha, and new accounts have to confirm their email. The public endpoints (online booking, the waitlist, client portal sign-in links and deposit checkout) have per-IP rate limits. IP addresses are stored hashed and cleared every day, and the edge functions only allow cross-origin requests from the app’s own addresses.

Email that looks like it came from somewhere

Sign-up confirmations and password resets now come from pawdiary.co.uk through Resend, with DKIM and DMARC set up, in branded templates rather than the default ones.

Still to do

Error tracking, Google’s verification so any business can connect Google Calendar, and the Android app, which is built with Capacitor but still has to get through Google Play’s closed test. Those come next. For now, groomers can sign up and start a free trial.