A founder-engineer case study · iOS · Web · Supabase

JESED PTY

Built by Daniel Khafif

Help in Panama is spread across many independent organizations, each with its own phone numbers, forms and way of giving. I built one platform for all of them: a three-language iPhone app where people find help, borrow medical equipment, donate and volunteer, with a staff workspace, a web admin portal and a secure multi-tenant backend behind it.

Explore Interactive Demo

Submitted to Apple App Review Oct 22, 2026
Live website jesedpty.com
3 languages English · Español · עברית
189 commits Aug–Oct 2026

App Store screenshot: Search screen listing community organizations in Panama — Actual App Store screenshots of Build 32

App Store screenshot: Home screen asking How can we help you today, with help categories — Actual App Store screenshots of Build 32

The short version

JESED PTY in 60 seconds

What it is: A community-support platform for Panama. People find local organizations, request help, borrow medical equipment, donate and volunteer; the organizations' staff manage all of it in the same app.
Why I built it: Community help here is scattered: every organization has its own phone numbers, forms and way of accepting donations, so a family has to already know whom to ask. I set out to put it all in one place.
What works today: Search, help requests with organization-defined forms, equipment reservations, card donations with itemized fees, messaging, a staff workspace and an admin portal, in Spanish, English and Hebrew. Version 0.1.0 is in Apple review; jesedpty.com is live.
How it's engineered: React Native + Expo on a multi-tenant Supabase backend where PostgreSQL row-level security isolates each organization's data: 137 migrations, 229 policies, 10 Edge Functions and a 66-file database security test suite.
Where it's going: My targets for the next stage: 70+ partner organizations, 15,000 users and $25,000 in monthly donations. These are goals, not current results.

Interactive demo: demo.jesedpty.com · Contact: danielkhafifl@gmail.com

The problem

Help exists. Finding it shouldn't be the hard part.

In Panama, much community support is offered by independent organizations — medical assistance, equipment loans, food, financial help, clothing, housing. Each one has its own phone numbers, forms and way of accepting donations.

A family that needs a wheelchair for a month, or help with rent, has to already know whom to ask. Organizations, in turn, juggle requests, equipment loans, volunteers and donations across chats and spreadsheets.

The solution

One app for the whole community. People search every organization in one place and act in a few taps. Each organization's staff use the same app, routed to a staff workspace, and platform administrators use a web portal — all on one backend where each organization's data stays isolated from the others.

Organizations, services and request forms are configured as data, not code, so the platform grows without per-organization app updates.

Find organizations

Browse by help category or search by name or service; featured and verified organizations first.

Public app

Request help

Step-by-step request forms that each organization defines, with document uploads and status tracking.

Public app

Reserve medical equipment

Borrow wheelchairs, hospital beds and more, with pickup and return dates.

Public app

Donate money, items or time

Card donations with an itemized fee choice, campaigns, in-kind donations and volunteer applications.

Public app

My Activity & messages

Every request, reservation and donation in one timeline, chat with organizations, and push notifications.

Public app

Staff workspace & admin portal

Staff manage requests, reservations, inventory, campaigns and their team in the app; JESED administrators run the platform on the web.

Organizations · Admins

Interactive demo

Use the app, right here.

A faithful web re-creation of the iPhone app's public side: the same five tabs, screens, colors and icons, and — word for word — the app's own English, Spanish and Hebrew text. Tap anything.

Demo · fictional data · nothing is sent

This demo runs entirely in your browser. It has no login and no connection to JESED PTY's servers, database or payment processor, so nothing you do here reaches a real organization or person.

Web re-creation for demonstration. The real app is native iOS (React Native); the organizations and people shown here are fictional.

Engineering behind the app

A real production system, not a prototype.

Three applications on one backend: the iPhone app (for the public and for organization staff), the Next.js website and admin portal, and Supabase — where security is enforced in the database itself.

137SQL migrations, applied in order, that define and evolve the database

229row-level-security policy definitions, with RLS enabled on 89 tables

10server-side Edge Functions: donations, payment verification, staff invitations, notifications…

3,288interface strings, each one in Spanish, English and Hebrew

Counted from the project's source repository on October 29, 2026. The repository also holds 66 pgTAP database-security test files (1,339 planned assertions), 41 node:test files and 12 Playwright end-to-end specs.

Clients

iPhone appReact Native 0.81 · Expo SDK 54 · Expo Router · TypeScript · TanStack Query. One binary: public experience or staff workspace, chosen by the server after sign-in.

Website & admin portalNext.js 14 · Tailwind · hosted on Vercel at jesedpty.com. Public pages plus the platform administrators' portal.

Shared backend

SupabaseOne backend for every organization.

PostgreSQL + RLS — policies re-derive the caller's organization from their session, never from client input.
Auth — email, Sign in with Apple and Google; four role tiers; staff invitations.
Edge Functions — server-only work: donations, payment reconciliation, staff invitations, account deletion, push notifications.
Storage — private documents served through short-lived signed URLs.

Services

PagueloFácilPanamanian card processor behind a provider-neutral payment layer; payments are confirmed by asking the processor directly.

Expo push & EASPush notifications, cloud builds and App Store submission.

Transactional emailBranded auth emails in three languages via Resend SMTP, with SPF, DKIM and DMARC.

Problems worth solving

Six engineering challenges, and how they were solved.

Security

Many organizations, one database

Problem: Every organization's requests, documents and donors share one PostgreSQL database. A bug in any client could expose one organization's data to another.
Solution: Access rules live in the database. Row-level-security policies derive the caller's organization from their session, never from what the app sends, and a 66-file pgTAP suite tests cross-organization access directly.

0013_row_level_security.sql · supabase/tests/database/

Roles & permissions

Staff who can't promote themselves

Problem: Organizations need different permissions for different staff, and no staff member should ever be able to widen their own access.
Solution: Four platform roles and six organization staff roles, from administrator to read-only. A database trigger blocks self-escalation, and only an organization's administrator can invite another administrator.

0001 role enums · prevent_self_permission_escalation (0012) · invite-org-staff

Internationalization

Hebrew, right-to-left, from the first launch

Problem: On a phone set to Hebrew, the first launch rendered left-to-right: the mirrored layout was applied only when someone picked Hebrew by hand.
Solution: At startup the app aligns React Native's layout direction with the active language once, guarded so the reload this requires can never loop.

apps/mobile/lib/i18n/index.ts · commit 42678b2

Payments

Money that arrives while nobody is watching

Problem: A donor can pay and close the browser before the app hears back, leaving a captured payment recorded as unfinished.
Solution: A reconciliation function asks the processor directly, server to server, and records a donation only when the processor's own record proves it.

supabase/functions/reconcile-payments

Donor trust

Fees donors can actually see

Problem: Card fees and tax reduce what an organization receives, and donors deserve to know by how much before they pay.
Solution: Donors choose to add the fees or include them. The breakdown is itemized (3.5% + $0.50, plus 7% ITBMS on the fees) and marked “estimated” until the actual fee is reconciled.

fee migrations 0135–0140 · try it in the demo

Shipping

Fixing production without a new build

Problem: With the app build locked in Apple review, new accounts' emails could arrive in the wrong language.
Solution: Fixed on the server instead: a database trigger sets each new account's language from sign-up, without touching the build under review (code below).

0144_users_language_from_signup.sql

Tenant isolation in the databasesupabase/migrations/0013_row_level_security.sql

-- ── organizations ─────────────────────────────
create policy organizations_public_read on public.organizations for select using (
  status = 'active' or public.is_super_admin() or public.is_org_staff(id)
);
create policy organizations_super_admin_insert on public.organizations for insert with check (public.is_super_admin());
create policy organizations_super_admin_delete on public.organizations for delete using (public.is_super_admin());
create policy organizations_update on public.organizations for update using (
  public.is_super_admin() or public.has_org_role(id, array['org_admin']::org_staff_role[])
);
-- column-level enforcement of locked fields happens in enforce_organization_field_locks() (0012)

Access rules live in PostgreSQL, so even a modified client can't read or change another organization's data.

Designing for the person, not the tableapps/mobile/app/(public)/(tabs)/requests.tsx

// Statuses that mean the ball is in the USER'S court (or time-sensitive for them). These cards get
// a highlighted attention line and count toward the filter-tab badges — before this, a card
// waiting on the user's documents looked identical to one merely submitted, so requests stalled.
const ATTENTION_KEYS: Record<string, string> = {
  information_required: "myActivity.attentionInfoNeeded",
  more_information_required: "myActivity.attentionInfoNeeded",
  documents_required: "myActivity.attentionInfoNeeded",
  interview_required: "myActivity.attentionInfoNeeded",
  ready_for_pickup: "myActivity.attentionReadyForPickup",
  return_due: "myActivity.attentionReturnDue",
  overdue: "myActivity.attentionOverdue",
};

My Activity merges six kinds of records into one timeline and surfaces the ones waiting on you — try it in the demo above.

An append-only migration, applied to production Oct 26, 2026supabase/migrations/0144_users_language_from_signup.sql

create or replace function public.users_language_from_signup()
returns trigger
language plpgsql
security definer
set search_path = public
as $$
declare
  signup_locale text;
begin
  select raw_user_meta_data ->> 'locale' into signup_locale from auth.users where id = new.id;
  if signup_locale in ('es', 'en', 'he') then
    new.preferred_language := signup_locale;
  end if;
  return new;
end;
$$;

revoke all on function public.users_language_from_signup() from public, anon, authenticated;

A new account starts in the language it signed up in, so its emails arrive in Spanish, English or Hebrew — fixed on the server, without touching the app build under Apple review.

What I built

My role, stated plainly.

Initiative, decisions and ownership, with an honest account of how the code was written.

I created JESED PTY and took it from a working codebase to an app submitted to Apple. I own and operate every part of it: the source repository, the Supabase projects, the website and its hosting, the domain, the Expo account, and the Apple developer account the app is submitted under.

I developed it with AI coding assistants — mainly Claude Code — as pair programmers. Most commits in the repository are marked as co-authored with Claude. I decided what to build, directed and reviewed the work, tested it, and approved every change that reached production.

Why I say this up front: much of the code was written with AI assistance. The honest description of my work is the product and engineering decisions, the testing, and running a real system in production — not that I typed every line.

Saw the problem and scoped the productWho it serves, what they need to do, and the decision to serve the public and organization staff from one app, with a five-tab experience and three languages including Hebrew right-to-left.
Made the architecture callsMulti-tenant Supabase with security enforced in the database, organizations configured as data rather than code, and a provider-neutral payment layer designed before choosing a processor.
Set the bar for trustDonors see itemized fees before paying, a payment counts only when the processor confirms it, and staff can never raise their own permissions.
Runs it in productionDatabase migrations, Edge Function deploys, website hosting, DNS and email deliverability, EAS builds, and the App Store Connect listing and submission.
Tests what shipsBuilds tested on iPhone in all three languages, end-to-end checks of sign-up, invitations, emails and payment-sandbox flows, and fixes for what they found.
The record189 commits between Aug 9 and Oct 26, 2026, most from my machine; the history also includes commits from one other contributor.

Development evidence

Real screens, real milestones.

These are the App Store screenshots submitted with Build 32, captured from the actual app. Select one to view it full size.

Search screen with organizations — Search

Organization profile

Donation details with itemized processing fees — Donation with itemized fees

Milestones from the commit history

Aug 9, 2026Repository baselineThe working app is committed as the starting point of the current history.
Sep 17–22Payments architectureProvider-neutral payment layer, then PagueloFácil sandbox integration with verified settlement.
Sep 23Staff onboardingOrganization staff invitations and unified role-based routing.
Oct 11–12Public website and Hebrew QAjesedpty.com public site, security headers, and right-to-left layout fixes across the app.
Oct 13–20Production readinessLive-ready payments, itemized donor fee options, Sign in with Apple and Google.
Oct 22Submitted to Apple App ReviewVersion 0.1.0, Build 32.
Oct 26Transactional email systemBranded sign-up, password and invitation emails in three languages, verified in production.

App Store status

Submitted for Apple review

Version: 0.1.0 (Build 32)
Submitted: October 22, 2026
Last verified: Waiting for Review (Oct 22, 2026)
Availability: iPhone and iPad · Panama

The app has not been approved or published on the App Store yet.

Website live

jesedpty.com — public site, support and privacy pages, and the admin portal sign-in.

Where it's going

The Vision: Scaling Community Impact

JESED PTY works today and is waiting for its App Store debut. These are the scale objectives I have set for what comes next.

Projection $25,000 Projected monthly donations Future goal, not a current result
Target 70+ Target partner organizations Future goal, not a current result
Target 15,000 Target users Future goal, not a current result

These are goals, not results. The app has not been published on the App Store yet, so there is no public user base or donation volume to report. The figures describe the scale I am working toward; they are not a dated forecast, and they don't imply any partnership that doesn't exist.

Contact

Happy to walk through any part of it.

danielkhafifl@gmail.com

Explore Interactive Demo