GoVibee

Problem

Every weekend in Juazeiro (BA) and Petrolina (PE), someone asks: "what's happening tonight?". Information about parties, bars and gigs is scattered across stories that vanish in 24 hours, WhatsApp groups and posters. National aggregators ignore the local scene.

Solution

A hyperlocal nightlife and events guide that brings both sides of this market together:

• People going out find what's on tonight, on a map, with time, price, age rating, lineup, directions and a live chat with others who are going.
• People who make it happen (bars, promoters, artists and agencies) publish for free, reach people who already want to go out and track real interest: views, directions requested, ticket clicks and which cities the audience comes from.
• B2B business model: partner subscriptions, event boosts and artist spotlights, with a launch offer for the first partners ("Founder").

Role

Conceived and built the product end to end: product and UX; app, dashboard and API; database design; infrastructure, deployment and observability; security and LGPD (Brazil's data protection law); the sales landing page and analytics; and pricing, together with the business analysis.

Architecture

Polyrepo (recorded in an ADR): one repository per component, each with its own semantic versioning and changelog.

• API: FastAPI with REST and WebSocket: business rules, authentication, chat, notifications, analytics and automations.
• App: a single Flutter codebase shipped as an Android app and as a web app (PWA).
• Dashboard: React and TypeScript for partners (venues, events, artists, performance, verification) and for operations (moderation, queues, partners).
• Infra: production Docker Compose, nginx, deploy, backup, restore and monitoring scripts, and Terraform.
• Docs: versioned OpenAPI contract, ADRs, roadmap and policies.
• Landing: partner acquisition page with SEO, Open Graph and anonymous measurement.

Technical decisions

The rule behind every one: the simplest solution that solves today's problem, with its limit and upgrade path written next to the code.

• The OpenAPI contract is the boundary between API and clients: the dashboard's types are generated from it, and a contract test breaks the build if the API changes without updating the docs.
• Plain latitude and longitude instead of PostGIS: enough for "near me" at regional scale and cheaper to run.
• OpenStreetMap instead of Google Maps, with no per-request cost.
• A virtual machine (EC2) instead of ECS/Fargate: predictable cost for a single-replica MVP.
• In-process notification scheduling and chat broadcast instead of an external queue, worker and pub/sub, with the upgrade path documented.

Features

• Curated home, infinite-scroll Explore as a list or map, filters by city, style, price and free events, and search.
• A domain rule where "the night turns at 5 a.m.": a Friday 11 p.m. event still counts as Friday until dawn.
• Per-event live chat with moderation: reports with automatic muting, blocking, profanity filter, anti-flood and minors kept out of 18+ chats.
• Private events with an organizer-approved access queue; favorites, reviews, a vertical story-ready card and links with rich previews.
• Push notifications: new event nearby, event starting, a favorite venue or artist posted, and a weekend digest.
• For partners: interest reports (30-day series, rankings, aggregated and anonymous leads by city), a Verified badge with human review, and boost requests with an admin queue.

Production engineering

• One-command deploy per component: pre-checks, tests, lint and type checks, image build and publish, migrations with an automatic backup first, a health check on the new version and automatic rollback on failure, tested in production by forcing a failure.
• Sentry on the API and the app (no personal data), external UptimeRobot checks and a watchdog on the VM every 5 minutes, with email alerts.
• Daily encrypted backups (AES-256) to R2, 14-day retention and an automatic monthly restore test compared against production.
• Disaster recovery runbook with a 24-hour RPO and a 15-minute to 3-hour RTO, on a server with ~1 GB of RAM.
• gzip on nginx cut the web app's initial download from ~11 MB to ~4 MB.

Security and privacy

• Short-lived JWTs with rotating refresh tokens and revocation; rate limiting by real client IP behind the proxy and login attempt lockout.
• Email verification before publishing, Brazilian tax ID validation, Google OAuth requiring a verified email, uploads checked by real file type and private storage for documents.
• Privacy by design (LGPD): public profiles only with consent, cascading account deletion including files, aggregated anonymous analytics and one-click email unsubscribe.

Data and automations

• In-house analytics with no cookies or identifiers: user, landing page and partner funnels.
• Partner onboarding, a weekly performance report and a weekend digest by email and push, with deduplication, local-time windows and a dry-run mode in production.

Numbers

• 6 repositories and ~500 commits, from July to October 2026.
• ~450 automated tests (API 297, app 117, dashboard 36) and ~91% API coverage.
• 42 versioned, reversible database migrations and 6 recorded architecture decisions.
• Platforms: Android, web (PWA), web dashboard and landing page.

Lessons learned

• Simplicity with a written-down limit scales better than speculative architecture.
• Running blind is the biggest risk for a small product: monitoring, tested backups and rollback came before new features.
• Measure before selling: analytics showed the bottleneck was supply (listed events), not technology, and shifted the focus to sales.
• Marketing promises must match the code: the landing page and pricing table were audited against the implementation and every mismatch was fixed.

Stack

• Python
• FastAPI
• PostgreSQL
• Redis
• WebSocket
• Flutter
• React
• TypeScript
• Docker
• AWS
• Terraform
• Sentry