Journey Sync

Journey Sync is a mobile web app for a study-abroad agency, which I built alone. Students build a profile, apply to courses and send their documents; counsellors work through applications, documents and messages; an admin sees the whole service. It is built for a 360 px Android phone and installs as a PWA.

A student applying abroad keeps track of courses, documents and conversations with a counsellor across WhatsApp and email. Counsellors check each passport, transcript and English test report by hand against what the student said about themselves. The agency needs one place where every application, document and message sits, where each person sees only what is theirs, and where a counsellor can see what is waiting on them.

• →Sign-in and sessions: Google sign-in with signed sessions of my own, checked on every private API route.
• →A private demo for each visitor: accounts made for one visitor as a student, a counsellor or a look-only admin, deleted after 24 hours.
• →Applications and payments: three free applications enforced by a database trigger, and a fourth through Stripe Checkout in test mode.
• →AI document checks: Gemini reads passports, transcripts and test reports, and plain code flags mismatches for a counsellor to rule on.
• →Live chat and an assistant: read ticks, typing and files over Supabase Realtime, and a Groq assistant that answers while a counsellor is away.
• →Screens for three roles: student, counsellor and admin, each checked at 360 px, with notifications by Web Push.

• →Adding a trust boundary. The prototype's 80 routes trusted a userId sent by the browser. I replaced it with signed sessions and a CI check that fails on any unguarded route.
• →Moving the assistant to Groq. Gemini's free tier took 2 to 34 seconds to start an answer; on Groq it arrives in about a second.
• →Moving the functions to Mumbai. Vercel ran them in Washington, far from the database. Pinned to Mumbai, a request that read the database went from 1.0 s to under 0.2 s.

The browser asks the Next.js app for everything it reads or changes, and every private route checks the session before touching Supabase. For live chat and notifications the browser gets a separate 15-minute token.

• →Document reading on 29 sample documents: 272 of 277 fields read correctly, and every expected flag raised.
• →Payments tested end to end with signed Stripe events, and paid once more on Stripe's real checkout page at 360 px.