COEXR
A social fitness platform for discovering nearby workouts, hosting sessions and finding a crew to move with.
Visit COEXR (opens COEXR website in a new tab)A system shaped by real-world constraints.
COEXR connects people around real-world activity: a host creates a workout, nearby people discover it, join, and coordinate around a shared session. The mobile app, API, public workout pages and staff dashboard now cover much of that journey.
Discovery, hosting, participation, profile preferences, invitations, workout photos and notifications use backend routes. The in-workout activity feed and some hosted-workout editing still use session-scoped fixtures in the mobile app.
Where I contributed.
- Co-founded the product and shaped its host-to-participant journey, privacy rules and mobile experience.
- Built the Expo client and Spring Boot API across passwordless sign-in, profiles, geospatial discovery, workout creation, participation, media and sharing.
- Built the Next.js public site and workout previews, plus staff-facing user and workout reporting. Established the outbox, scheduler and notification-worker boundaries for asynchronous work.
What made the work difficult.
- Nearby discovery needs enough area and distance context to be useful while keeping exact meeting details and optional host contact information behind participation rules.
- Concurrent joins must respect capacity and prevent a participant from joining two workouts with the same start time; schedule end times must come from the server.
- Invitations must work for people outside the app without exposing private workout data or treating a public share code as permission to join.
- Notifications and reminders cross database, broker and provider boundaries, so failed delivery must remain recoverable without corrupting workout state.
What mattered technically.
Passwordless identity and profile setup
Implemented email-code sign-in with bounded Redis verification state, short-lived access tokens and rotating hashed refresh tokens. The app routes new members through profile setup before workout actions.
Geospatial discovery with privacy gates
Used PostGIS distance filtering with radius, activity and interest controls. Workout responses expose an approximate area to browsers; exact coordinates, address and optional host phone are reserved for the host or an active participant.
Server-owned workout and participation rules
Derived workout end times from start and duration on the API. Joining locks the participant and workout rows, checks capacity and same-start conflicts, and records withdrawal and host acknowledgement as explicit state changes.
Public invitations with limited data
Gave public workouts opaque share codes and server-rendered preview pages. The anonymous response uses a fixed field allowlist; signed-in visitors resolve the private workout separately and must still choose to join.
Permissioned workout media
Added workout photo albums with host and participant access checks, upload policies, batch limits and cleanup of stored files after rolled-back transactions.
Recoverable events and reminders
Recorded asynchronous work through an outbox and versioned RabbitMQ contracts. Separate notification and scheduler workers handle email, push and workout reminders with retries and failure paths.
Operational visibility
Built staff sign-in and read-only user and workout views, including filtered tables, charts, participant history and workout details, without making the dashboard a second source of product rules.
Correctness beyond the happy path.
- OTP expiry, resend cooldown, attempt limits and single-use cleanup bound verification; refresh-token reuse revokes active sessions.
- Database-backed join checks enforce capacity and same-start conflicts even when multiple clients act at once.
- Anonymous workout previews omit exact locations, contact details, internal IDs, descriptions, participant identities and media.
- Outbox publication, broker confirmation, retries and dead-letter handling make asynchronous delivery failures observable and recoverable.
What the work made possible.
- The codebase now covers the path from finding or hosting a workout through joining, private sharing and post-session photos across mobile, API and web surfaces.
- Keeping activity-feed fixtures explicit shows where the product experience still needs backend integration.
Technology should support the system, not become the story.
Java · Spring Boot · PostgreSQL · PostGIS · Flyway · Redis · RabbitMQ · React Native · Expo · Next.js · React