Key takeaways
- I audited and fixed real privacy gaps: Delete Everything now actually erases every on-device account archive, not just the active one, and account deletion now purges attachment files that were previously left orphaned.
- A backend view that let any signed-in person query another account's aggregated Control Center data was closed off.
- The website's domain moved to AWS (Route 53 + Amplify), and the internal staff sign-in was fixed the same day.
- I wrote the full GA (general availability) release record — audit, checklist, App Store privacy answers pulled from the actual code, not guessed — so the state of the project is documented, not just remembered.
- Public general availability stays blocked on one thing outside my control: independent clinical review of the safety content. Everything I could fix myself, I fixed.
Why this day mattered more than a feature would have
Most updates are about adding something. This one was about closing gaps — the unglamorous, necessary work before an app that touches health and mood data can honestly call itself ready for a real audience. I set aside the day for a full GA (general availability) readiness pass on the release/1.0 branch: no new product features, feature-frozen, just privacy, security and documentation.
Fixing Delete Everything so it actually deletes everything
The app can hold local snapshots for more than one account on the same device — for example if someone signed out and back in with a different Apple ID during testing. "Delete Everything" was supposed to erase all local data, but it only erased the currently active account's on-disk archive. Older, inactive account snapshots survived the delete. I fixed LocalStore.clearAll() so it now erases every per-owner archive on disk, not just the one in front of you, and added tests to prove it stays that way.
Closing an orphaned-file gap in account deletion
On the backend, deleting an account was removing database rows but not the actual attachment files (things like medical document uploads) stored in file storage, because those blobs weren't linked by a foreign key the delete process could follow. They were being left behind, orphaned. I fixed the account-delete function to explicitly purge storage attachment blobs and the Life Timeline tables, and updated account-export to include those same tables so an export is genuinely complete too.
A backend view that was too open
The internal Control Center (our own team's aggregate stats dashboard) had database views that any signed-in user — not just staff — could technically query, bypassing the row-level security that protects the underlying tables. I revoked that grant in a migration. This was an internal tooling gap, not a path a mother's data was ever shown through in the app, but it should never have been queryable by a regular account and now it isn't.
Moving the site's front door, and fixing the mark on it
The DNS cutover I laid groundwork for on September 4 happened today: Terraform now creates the Amplify domain associations and every DNS record they need in Route 53 (ACM validation, apex/www/control/survey aliases), pointed at the new AWS-hosted site instead of the old host. Email and the API subdomain were left untouched. Alongside it I fixed a bug where the internal staff sign-in page redirected back to itself instead of showing the Apple sign-in button (an anonymous-access gate was wrongly wrapping the sign-in page itself), and wrote docs/BRAND.md as the single source of truth for the brand mark — the app's real icon, not a hand-drawn heart — used consistently across the site and the internal Control Center from here on.
Writing down the truth about where the app stands
The rest of the day went into the GA release record itself: a feature-freeze note, an App Privacy document with every answer resolved directly from the actual code (Sign in with Apple requests only a name, never email; that name never leaves the device; notifications never use a push token — so those fields are honestly "Not Collected"), a GA-1.0 checklist with evidence for each item rather than a checkbox someone just ticked, and a clinical sign-off cover sheet. I re-ran the checklist a second time later in the day after pinning the exact commit for clinical review, to make sure nothing had drifted. At the end of the day: 246 iOS tests and 16 backend tests passing, the site building cleanly at 61 pages, and Terraform showing a clean, safe plan.
Where and when
- Sept 5, ~12:10 — Multi-page site expansion: /why and /roadmap pages, real app icon as the brand mark site-wide (1caee7d).
- Sept 5, ~12:25 — Amplify SSR build fix (the buildspec bug that had been serving a blank 500 on the internal dashboard) and staff account bootstrap by email (faa5e71).
- Sept 5, ~12:41 — Fixed staff sign-in page redirect loop (3a573de).
- Sept 5, ~12:44 — docs/BRAND.md written; Control Center brand mark switched to the real app icon (f9d28bf).
- Sept 5, ~12:49 — DNS cutover to AWS: Amplify domain associations + Route 53 records via Terraform (a52d5e1).
- Sept 5, ~15:55 — v1.8 GA readiness: Delete Everything fix, attachment purge fix, Control Center view lockdown, release docs (7032229, backend + iOS).
- Sept 5, ~16:16–16:48 — App Privacy answers resolved from code, GA-1.0 checklist evidence recorded, clinical review commit pinned (7a90c97, f2349c1, 28bc853).
- Sept 5, ~16:49 — release/1.0 merged (PR #18) alongside the sign-in fix (PR #16) and DNS cutover (PR #17).
What's still blocking a public launch
Everything engineering could fix, is fixed: 145+ tests passing across the app, the safety engine proven to always run before any AI call reaches a user, privacy answers verified against real code instead of assumed, persistence hardened against corruption. What's still blocked, and can only be unblocked by someone outside this codebase, is independent clinical review of the safety-related content and a native-speaker review of the Ukrainian safety language. I won't flip that switch myself, and the release config is version-pinned so it can't accidentally ship as reviewed until it actually is.
What this means if you use the app
If you ever use Delete Everything, it now genuinely removes every account snapshot stored on your device, not just the one you were last signed into. If you export your data, the export now includes your Life Timeline and attachments, not a partial copy. And if you read our privacy answers on the App Store, they were written by checking what the code actually does, not by guessing.
Questions mothers ask
Was any real user data exposed by the bugs fixed on this day?
These were pre-release hardening fixes found during our own GA audit on the release/1.0 branch — the app has not had a public general-availability launch yet. They're fixed now, before any wide release, rather than found in production.
What is the Control Center mentioned in this post?
It's an internal dashboard our own team uses to see aggregate, anonymized product stats. It is not a page that shows any individual mother's personal entries, and it isn't part of the consumer app.
Did the app's domain change for users?
The site (mommyrefuel.com) now points to AWS hosting instead of the previous host, via a DNS cutover done this day. The domain itself didn't change; only where it points.
What exactly is blocking general availability now?
Independent clinical review of the app's safety-related content, and a native-speaker review of the Ukrainian safety language. Both are external reviews outside engineering's control, and the release is deliberately gated until they're done.
Product designer and engineer from Kyiv who designed and built Mommy Refuel end to end. CTO at Kyiv Academy of Media Arts, founder of seven a.m. He writes every product update here: what shipped, where and when.
About SerhiiAvailability can vary with the installed app version. Statuses are founder-confirmed at the time of writing.
