Servicentos

Problem

Today, people looking for a manicurist, hairdresser or aesthetician search on Instagram, arrange things on WhatsApp, pay by hand and choose by word of mouth. For professionals, the schedule lives in a notebook and no-shows leave no trace.

Solution

• Clients: search with filters and sorting by distance, professional profiles and portfolios, booking, per-booking chat and reviews.
• Professionals: onboarding, their own schedule, a waitlist, no-show tracking, cancellations that notify the other side, and replies to reviews.
• Commission-free business model: clients pay professionals directly via PIX (Brazil's instant payment system), and revenue comes from the Professional plan (R$ 39.90/month, with a 30-day trial).

Role

Own product, built solo: product, data modeling, API, frontend, payments, security, infrastructure and testing.

Architecture

• API: FastAPI with async SQLAlchemy 2, Pydantic v2 and Alembic, serving REST and WebSocket.
• Database: PostgreSQL with PostGIS for location search, plus indexes and constraints such as one booking per time slot.
• Queues and cache: Redis and a Celery worker for work outside the request.
• Frontend: Next.js and TypeScript, with TanStack Query, Zod and Tailwind CSS, SEO and legal pages.
• Integrations: Stripe for subscriptions, Firebase Cloud Messaging for push and Google sign-in.

Technical decisions

• Per-transaction commission was replaced with a professional subscription: no payouts, refunds or holds to manage, and predictable revenue.
• A single visibility rule: a professional is listed if and only if their subscription is current. The detailed status is informational only.
• Idempotent Stripe webhooks, where a payment never shortens the expiry date and events from old subscriptions are ignored.
• Service payments go straight to the professional, who confirms them in the app, so the platform never touches the money.

Security and privacy

• Token blacklist on logout, sessions revoked after a password change and a WebSocket that rejects inactive accounts or revoked tokens.
• Rate limiting on login, search, uploads and password recovery, security headers and logs without sensitive data.
• Uploads validated by real file type, an XSS fix in the chat and HTML escaping in emails.
• Self-service account export and deletion, and admin access to chats only with a reason recorded in the audit trail.

Production engineering

• Production stack with Caddy and HTTPS, non-root containers, health checks, resource limits and log rotation.
• Deploy, rollback, smoke test, backup and restore scripts, with a documented runbook.
• CI on GitHub Actions with lint, migrations on a clean database, tests, frontend and image builds and dependency audits.
• End-to-end browser tests covering subscriptions, bookings, PIX, professional sign-up, authentication and the admin dashboard.

Numbers

• 153 commits, from March to October 2026.
• 25 versioned database migrations.
• A 70% minimum coverage enforced by pytest in CI.
• 8 core flows tested end to end.

Stack

• Python
• FastAPI
• PostgreSQL
• PostGIS
• Redis
• Celery
• Stripe
• Next.js
• TypeScript
• Docker
• Caddy