Everkinly

Overview

A private space where families share photos and stories, follow the funeral schedule, and order printed keepsakes, with accounts for the funeral homes that serve them.

The problem

When someone dies, details scatter across group texts and social posts, and nobody has a calm, private place to gather them. The data is about as sensitive as it gets, so privacy had to be the architecture, not a setting.

What I built

• Memorials that are private by default, with invitations by email and owner, administrator, contributor, and viewer roles.
• Shared photo albums with moderation, a memory board, a funeral schedule with RSVPs and calendar links, and family task lists.
• Print-ready programs and remembrance cards generated as PDFs from the memorial's own details, plus Stripe checkout.
• Funeral-home organization accounts with a partner-code hand-off, so families stay in control of access.
• An optional AI writing assistant that only uses facts the family enters and labels every result as a draft.

Architecture

• A Next.js 16 static export on S3 and CloudFront. Private data is never in HTML or build output; it loads in the browser after sign-in.
• Supabase Postgres with row-level security and column-level grants on every table, plus security-definer functions for sensitive state changes.
• One Node 22 Lambda handles privileged work: Stripe checkout and webhooks, upload verification, email, PDF downloads, and account deletion.
• Photos are served through short-lived, permission-checked links. Shared pages default to noindex.
• Every migration is applied to an in-memory Postgres (PGlite) in CI to prove RLS is on for every table.

What I learned

• Hiding a button is never access control. Every rule lives in the database, so the UI can't get it wrong.