Local Haunts: Case Study

Where It Started

The Failure

A burger joint locals love was invisible from anywhere in Charlotte.

20The most results Google returns for one search, with no next page

5 miA search that returns the 20 most famous restaurants in range

0Neighborhood spots among them: prominence ranking buries exactly the places this app exists to find

Google’s nearby search ranks by prominence, which in a city means the 20 most famous restaurants and never the corner spot. The data was there; the ranking buried it. I treated that as the product: every search runs twice, once by distance and once by popularity, and the two lists are merged.

I ruled out review sites on purpose. Ratings need volume to mean anything, and free text brings a moderation burden a solo developer cannot carry. People vouch with one tap instead, and the rest of the app is built to keep that signal honest and cheap.

The Core Loop

One Search, Followed

What happens between opening the map and seeing a result, and what each step costs.

You Open The Map

Location is asked once, after an explanation, and never answered from a made-up position. An early build fell back to a leftover mock city, which served Asheville restaurants to anyone who declined. The default area is Walking, about a mile.
The Cache Answers First

Searches are keyed by geohash, radius and tier and kept for an hour, so everyone searching the same cell shares one Google bill. A hit costs nothing. Place details live 48 hours and reviews seven days, because reviews are a pricier field tier.
A Fan-Out Of Calls

The first two calls are always centered: one ranked by distance, one by popularity. Anything more is a ring of distance-ranked cells around you, sized so no result can come from beyond the area you chose. The table below shows the budget.
Two Lists Become One

The passes are merged and de-duplicated. In Charlotte, 20 results became 28 to 37, and the mix shifted from landmarks to neighborhood places.
The Filter Removes Chains

Non-food venues go first, then the country’s chain blocklist, a repetition rule inside the search, and a learned location count. The next section covers it.
Ranking

Distance is a half-life decay multiplier, never a divisor: dividing made proximity swamp everything inside a mile and “Recommended” came out identical to “Distance.” Quality is rating-led and normalized over 3.0 to 5.0, with review count setting only how much to trust it. Vouches and crowns add a saturating boost capped at 2.0, enough to beat a better-rated neighbor and never one across town.
Thin Results Widen Themselves

A search returning fewer than five places steps outward automatically and says what it did: “Only 2 within walking range. Showing Nearby.” Tapping the notice adopts the wider radius; otherwise your saved preference is untouched.

The Call Budget

Google Calls Per Search	Walking (1 mi)	Nearby (5 mi)	Citywide (15 mi)
Free	2	4	6
Pro	4	6	8
Cost, uncached, free tier	about $0.06	about $0.13	about $0.19

The count used to come from tier alone, so all three radius settings made the same two calls and the picker looked broken. Result count is a filtering outcome, not a radius outcome.
Geometry that nothing visibly reveals gets a check. A paid offset cell reached 1.2 times the distance the user chose and nobody noticed, because the extra places looked normal. A script now asserts the geometry and pins the call counts.
Hours cost a billing tier. Adding opening hours to the list payload moved the request from the Pro SKU to Enterprise, about $32 to $35 per 1,000 calls. I bought it deliberately: “Open right now” is the sort people ask for most.

Filtering

The Chain Filter, Country By Country

McDonald’s is a chain everywhere. Tim Hortons is only a Canadian problem.

Country	Own Entries	Exact-Match Only	Effective Set
United States	627	21	627
Canada	121	24	748
Australia	75	8	702
New Zealand	31	4	658
Singapore	58	5	685
Hong Kong	73	2	700

Each country stacks on the US list. One global array would either miss Tim Hortons or hide an American independent that shares a word with a Hong Kong chain.
Names that read like independents match only as a whole name. “Milestones” is an English word, “Quesada” is a surname, and “Killiney” is a Singapore road that independents name themselves after. Each would otherwise have hidden a real restaurant, invisibly, with nothing logged.
A repetition rule scales with the area: 5 occurrences in one search at about a mile, 7 at five, 9 at fifteen. A flat 5 caught a beloved five-location regional on a citywide search.
A learned count costs no extra Google spend. Every search records which names were seen in which cell, so a brand seen in more than eight locations across states is dropped, and one seen in fifteen cells is dropped regardless.
Language does not guarantee English names. Live testing in Hong Kong returned 16 of 76 results in Chinese, so that list carries Chinese entries alongside the English ones.
The two failure directions are not symmetric. A chain that slips through is on screen and can be reported. A real independent that was hidden never appears anywhere, so it has its own form. Reports are evidence for a person to read, never an automatic change.

Human Layer

Signal Without Words

Neither mark accepts text, so there is nothing to moderate.

Mark	Cost	Limit	What Others See	Guard
Vouch	Free	One per person per place	“Vouched” below three, a count from three up	Confirmed email, 15-minute account age, 20 a day, counted from an append-only ledger
Crown	Pro	One per dish category; a new one displaces the old	Counts triple on Local Legends	Server checks Pro against its own record, never the client’s
Been Here	Free	One flag per place	Nobody; private	Earlier timestamp wins when two devices disagree
Saved To The Caché	Free	500, an abuse guardrail rather than a tier line	Nobody; never counted	Lists are labels across one set, so a lapsed subscription strands nothing

Money never buys ranking influence. The original spec gave Founder picks a 1.10 times weight and a guaranteed top-5 slot. I dropped it: an app whose value is honest local signal cannot sell influence over that signal.
A precise number can read as weakness. “1 local vouches” states weak evidence exactly, and a count that moves from 0 to 1 the instant you tap identifies you to yourself in a small town.
The card shows the count; only the detail screen can cast one. A tap target on every row invites low-thought tapping that erodes the signal.
Local Legends reflects signal and never feeds it. It ranks what an area vouches for, and it does not exist until the area has five qualifying places. The readiness check fails closed, because an empty board from an unreachable server looks the same as an empty board from nobody vouching.
Retention runs on first-party signal only. Pick For Me, the weekly nudge and vouch alerts all use data that is free to query forever. A loop that searches Google on a person’s behalf is a bill that grows with success.

Reach

Why Six Countries

I judged every candidate on language, units, legal exposure, data and money. The launch list came from the legal gate, not from market size.

Region	Language	Legal	Verdict
US, Canada, Australia, New Zealand, Singapore, Hong Kong	English-first	Common law; no local representative required	Launched, each only after its chain list existed
EU, EEA and UK	English works in the north and west	GDPR Article 27 needs a paid representative, about USD 800 to 1,200 a year for the EU and UK pair	Deferred a year, revisited on traction
Latin America	English-only is a non-starter	Mostly no representative needed	Out until the app is localized
Turkey, Russia, Belarus	Not the deciding gate	Registration paperwork or data localization	Out

Europe would cost a named liability before the first download, for an app with no European revenue. The fee is a bloc fee, so deferring it is one decision, not twenty-seven.
A country does not open until its chain list is live. Tick Canada without the Canadian list and Tim Hortons is served as a beloved local independent on day one.
Opening a country is three settings, not one: app availability, the store listing and every in-app purchase. Missing the third ships a paywall that fails after the tap.
Distance units follow the phone. Miles stay the internal unit because two ranking constants are calibrated against them; converting the function would have silently re-ranked every list.
The honest gap: only Charlotte data ever proved the filters. The other five countries are researched, not observed.

Money

What It Costs, What It Earns

Pricing follows the cost model: usage-based costs argue against anything uncapped.

$9.99Pro, per year. There is no monthly tier: nobody subscribes monthly to a weekly-use app.

$29.99Lifetime for the first 250 buyers, who become Founders and the beta cohort

$49.99Lifetime for the other 750 of a batch capped at 1,000

Lifetime is capped because the costs are usage-based. Every search hits Google, so a lifetime buyer is a small bill that never stops.
Discovery is never gated. A capped discovery app gets deleted. Pro buys curation: crowns, lists and the Recommended and Rare Finds sorts. “Open right now” moved to free because whether a place is open is access, not curation.
Entitlement is server-owned. It is written only by the signature-checked webhook and fails closed to free when the server is unreachable.
Billing watches itself. Google Cloud billing is on the business account with a $50 project budget and alerts at 50, 75 and 95 percent.
Pricing came from precedent outside the category. Nobody in restaurant apps sells lifetime at all; the precedent is indie utility apps.

Retrospective

Failures That Looked Like Something Else

The expensive bugs were the ones that looked like something else. Each is now a line in a gotchas file and, where possible, a check.

What I Saw	What It Was	What Changed
Purchases worked and every dashboard looked healthy	The purchase webhook had never succeeded: a trailing newline in its secret answered 401 to every delivery, hidden because the app writes the same record itself	Both sides trim the value; a subscription expiring, which the client cannot fake, is the test
Nothing a signed-in user saved reached the server for about three and a half weeks	A fixed local id, “default,” did not fit a uuid column, and the error printed as “[object Object]”	The default list takes the user’s id on the server; every log site extracts the message
The app hung on its splash screen from a shared link	No route existed for the share path, hidden for months because Android never verified the domain	A redirect route and a not-found screen, so no link shape can look like a dead app
Push alerts never arrived on Android	No Firebase config in the build, so no token was ever minted; the function answered “sent: 0,” which is also what it says when nobody is registered	Config shipped; a push feature is verified by receiving a push
A wider radius returned fewer places	The call count came from tier alone, so widening reached more chains for the filter to remove	Calls scale with the area, and a script pins the counts and geometry
Sheets drew a grab handle that could not be dragged	The gesture lived on a 22-point strip nobody grabs, then trailed the finger at JavaScript frame rate	The whole sheet is the target, on the native gesture libraries

A pass is defined by an inventory, not by attention. Three device passes in one day each missed something. A full sweep is now measured against 17 routes, both styles and both color schemes, 68 screens a phone, and a tool’s failure lines count as findings.
The first iOS submission took several rounds: a missing subscription terms link, review notes that did not say where the purchases were, and a pre-permission button that named the permission.
What I would do differently: test the webhook with an event the client cannot produce from the first purchase test, make every log path readable from the first commit, and build the route inventory before the first device pass.

Stack

Under The Hood

An Expo app, a Supabase backend that holds every key, and Google reached only through functions that cache, filter and sign.

App

Expo SDK 55, React Native, Expo Router, TypeScript. Map, List, Saved and Settings. iOS and Android from one codebase.

Supabase

Postgres with PostGIS and row-level security, 15 migrations, and 9 Deno Edge Functions: search, details, reviews, photos, alerts, webhook, entitlement sync, deletion and logs.

Google Places

Server-side key only. Photos go through an HMAC-signed proxy with bucketed expiries, so one leaked URL cannot be looped to run up the bill.

Services

RevenueCat for purchases, Sentry for opt-in crash reports, Expo push with FCM for vouch alerts.

Cache tables are closed to the public key. A permissive select policy would have let anyone page Google’s place data through the API, which Google’s terms prohibit. The share page reads through one security-definer function instead.
Account deletion resolves the user from the caller’s own token, sits behind two confirmations, and clears local saves only after the server confirms.
No request path calls the auth service. Resolving the tier that way once cost a 30-second search; the token’s claims are read locally.

React Native Expo TypeScript Supabase PostGIS Deno Google Places API RevenueCat Sentry Jest EAS

Every request has a price, and the design only holds if each feature can pay for its own.
The through-line with my professional work is the unit cost. In FinOps the question is what a workload costs per unit of value. Here the unit is a search, and most of the architecture exists to make sure nobody, including me, can quietly make it more expensive.

Visit localhaunts.app

Back to Projects

Local Haunts

The Failure

One Search, Followed

You Open The Map

The Cache Answers First

A Fan-Out Of Calls

Two Lists Become One

The Filter Removes Chains

Ranking

Thin Results Widen Themselves