Bumerán

React Native 0.85 + Expo SDK 56

Frontend — Mobile Framework

Cross-platform iOS/Android from a single TypeScript codebase. Expo managed workflow with expo-dev-client for native module support. EAS Build will generate signed APKs for distribution once the feature set is stable.

NativeWind (Tailwind CSS)

Frontend — Styling

Tailwind utility classes applied directly to React Native components via NativeWind. Consistent design tokens across the whole app — no StyleSheet juggling for layout and spacing.

react-native-maps + expo-location

Frontend — Maps & GPS

Full-screen MapView with color-coded pins per post type (orange = necesito, green = ofrezco, blue = regalo). The map centers on the device's real GPS position via a two-step strategy — getLastKnownPositionAsync for an instant fix, then getCurrentPositionAsync for accuracy, smoothly animated with animateToRegion — plus a floating 📍 button to recenter on demand. Exact location is never shown publicly; it's only shared via WhatsApp chat once both parties agree.

@gorhom/bottom-sheet + react-native-reanimated 4

Frontend — Gestures & UI

The main screen is a full-screen map with a bottom sheet that snaps to 20%, 45% or 85% — swipe up to browse, swipe down to see the map. Reanimated 4 drives the search bar hide/show animation on scroll.

Intent-aware feed + FiltersModal

Frontend — Core UX

WelcomeScreen asks 'do you need help or want to give it?' — the answer pre-filters the feed so users never see irrelevant posts. FiltersModal lets them further narrow by tipo (necesito/ofrezco/regalo), estado (abierto/en_proceso/cerrado), and a 'saved only' toggle. Haversine distance calculated client-side and used for secondary sort.

Connections lifecycle + Safety Modal

Frontend — Social Flow

Tapping 'contact' on a post triggers a safety modal with real-world tips (meet in public, never send money upfront, share location only via chat). On confirm, the user is sent to WhatsApp. The connection then tracks states: pendiente → aceptada → completada/cancelada — visible in ConexionesScreen with separate tabs for received and sent requests.

Reviews system

Frontend — Reputation

After a connection is marked completed, both parties can leave a review. ReviewScreen handles the rating flow — building local reputation so the community can self-regulate trust over time.

Context API + expo-localization (ES/EN/DE)

Frontend — State & i18n

AuthContext holds JWT + user info with AsyncStorage persistence. FavoritosContext manages saved posts. LanguageContext drives full EN/ES/DE translations via a flat t.key lookup — all UI strings externalized, including categories, safety tips, error messages and form labels.

NestJS 11 + TypeScript

Backend — Framework

Modular architecture: AuthModule, FavoresModule, UsuariosModule, ConexionesModule, ReviewsModule, VerificacionModule. Global ValidationPipe with whitelist mode — unknown DTO fields rejected at the boundary before reaching any controller.

Prisma v7 + PostgreSQL

Backend — Database & ORM

Schema: User (googleId unique, UUID pk, verified phone unique for anti-abuse), Favor (tipo enum, estado enum, GPS lat/lng, expiraEn), Conexion (pendiente/aceptada/completada/cancelada), Review. Prisma migrations version-control the schema — dev uses Docker Compose PostgreSQL, prod uses Railway DATABASE_URL.

Google OAuth + JWT

Frontend + Backend — Authentication

Frontend sends Google ID token via @react-native-google-signin. NestJS verifies it with google-auth-library, upserts the User in DB and issues a custom JWT. Token stored in AsyncStorage — injected as Bearer header on all protected calls via AuthGuard.

@nestjs/throttler + Helmet

Backend — Security

ThrottlerGuard applied globally — 100 req/min per IP. Trust proxy enabled so Railway's reverse proxy doesn't collapse all clients into one IP. Helmet adds HSTS, X-Frame-Options and other standard security headers.

Twilio SMS phone verification

Backend + Frontend — Trust & Safety

POST /api/conexiones is guarded — an unverified helper gets a 403. Verification sends a 6-digit code via Twilio SMS that expires in 10 minutes, and a phone number can only be verified on one account at a time to prevent abuse. A dev-mode fallback returns the code in the API response when Twilio isn't configured, keeping the flow testable locally. On the frontend, a 3-step VerificacionTelefonoScreen (number → SMS code → success) plus a DetailScreen gate that intercepts connect attempts and offers to verify first.

refrescarUsuario() — instant state

Frontend — Auth State

AuthContext exposes refrescarUsuario(), which re-fetches /api/auth/me so the new verified status is reflected immediately — a green '✓ Teléfono verificado' badge and an orange warning banner in ProfileScreen update without any logout/login cycle.

FooterLegal — GDPR / RGPD

Frontend — Legal & Privacy

A reusable FooterLegal component (embedded in Profile, Favoritos, Notifications and Conexiones screens) discloses every third-party data source — Google Maps, Google Sign-In, WhatsApp — with links to their policies, lists the full set of GDPR rights (access, rectification, export, deletion), a contact email and the right to complain to a national data-protection authority. Fully translated to ES/EN/DE, with a 'Conforme al RGPD' compliance badge.

Production on Railway

Infrastructure — Deployment

Backend deployed to production on Railway with environment variables for Twilio and JWT; the frontend targets the live API (bumeran-backend-production.up.railway.app). JWT auth is persisted in AsyncStorage and the session is restored automatically on app launch.

Claude Sonnet 4.6 (Anthropic)

AI-Assisted Development

Co-developed with Claude Sonnet 4.6 as an engineering partner throughout the build — architecture decisions, NestJS module design, navigation flows, i18n strategy, the connections lifecycle state machine and the safety modal UX.