bytelyx

My role

I directed AI to build this: the folder name suggests ChatGPT for the first copy and a Claude Code project file marks the second. I decided the concept, the privacy and ad rules and tested it. The AI wrote the code. No other people are recorded as working on it.

What it is

bytelyx is a collection of free, local-first browser utilities such as encoders, calculators, SEO and web tools, image and JSON toolkits and a daily quiz, with a Supabase-backed community. Members can sign up, post forum threads, request tools, vote, follow each other and send direct and group messages.

Most tools run entirely in the visitor's browser, so what people type does not leave their device. Ads and analytics only load after the visitor consents. The README points to an ad-revenue and search-traffic model.

The docs state that community content starts empty and is supplied by registered users. No traffic, user or revenue numbers are documented, so none are claimed here.

How it was built

1. Designed the tool catalogue as registriesTools are defined in three registry files (about 61 tool entries by regex count, approximate). Each tool gets a prerendered page with explanation, examples and limits, plus a client-side runner. Closely related tools share runner code.
2. Automated interlinking for searchTool pages link to related tools from curated slugs first, then inferred keyword matches, and to related forum threads. Pages revalidate hourly so new discussions appear without hand-linking.
3. Built the backend schema in one dayAll 22 Supabase migrations are timestamped 24 Sep 2026, from the initial schema in the early morning to production hardening that evening. They create the schema, policies, signup profile trigger, image bucket and forum categories.
4. Added a small social layerFollows, message requests, accept or decline, blocks, read receipts, group chats with invitations and a 20-member cap, notifications, bookmarks and subscriptions.
5. Hardened security in dedicated migrationsRow-level security on public data, a staff check moved to a private function, insert column guards and least-privilege grants. Staff roles are verified in Postgres and again on the /admin server route. Users cannot change their own role.
6. Moved account deletion to an Edge FunctionThe delete-account function runs with JWT verification and removes the member's files and Auth account, so no secret key sits in the Next.js environment.
7. Built privacy and consent inTool inputs are never sent to analytics, sharing starts from an opt-in editable draft, and ad slots stay hidden until consent and configuration are in place.
8. Set up SEO plumbingGenerated sitemaps (community content in 45,000-URL shards), robots rules, structured data, a generated share card and indexing rules that keep account and admin pages out of search.
9. Added tests on the risky logic6 test files under lib cover tool logic, quick logic, interlinking, consent mode and badges.

Decisions and why

Run tools in the browser

Keeps user input private and removes server cost per use.

Use Supabase with row-level security instead of a custom API

Access rules live in the database, so a front-end mistake cannot expose private data.

Abuse limits from day one

Messages capped at 2,000 characters, 30 direct sends per hour and 20-member groups reduce spam.

Ads only after consent

AdSense and regional consent rules require it, and it respects visitors.

Do not end-to-end encrypt messages, and say so

The docs state this plainly rather than overclaiming privacy.

Hardest problems

Letting users post and message without exposing data or enabling abuse.

Row-level security, least-privilege grants, a private staff check, rate limits and a block feature, added in hardening migrations.

Passing an ad network review and consent rules.

A consent-mode design with ad slots gated on consent and configuration, plus an ads.txt file. The README says ads will not serve before site approval, and approval status is not documented.

Scaling sitemaps for community content.

Sharded sitemaps of 45,000 URLs listed in robots.txt.

Numbers

Timeline

• 24 Sep 2026All 22 backend migrations written, from initial schema to production hardening.
• Oct 2026Public beta period. Accounts created before midnight on 31 Oct 2026 (Chicago time) get a Limited Beta badge.

What I took from it

• Putting access rules in the database is safer than trusting the front end.
• Privacy-first tools are a real selling point and cost less to run.
• Without screenshots or analytics saved, a project is hard to show later. Capture images while building.

Links

• bytelyx