← Sebastián Allende

Citofonía: the building intercom on your phone

Concierge calls, door opening, QR visits, parcels, reservations and votes. One app serves residents and the concierge's tablet, and a web panel serves the administration. It is in development, shown here with a fictional building.

ArchitectureOther iPhone apps
A 65-second silent tour with on-screen text in Spanish. All data is fictional. Download the video

One product, three seats

A resident, a concierge and an administrator need very different screens, but they work on the same data. The resident and concierge modes share one React Native app, and each building turns on only the modules it wants.

Incoming concierge call on the resident's phoneConcierge call
Common-area reservations with their rulesReservations
Visits list with a QR pass that expiresVisits
Concierge tablet screen for calling an apartment
The concierge's tablet. A call rings on the apartment's phones for 30 seconds, and the first person to answer takes it.
Administration panel with the day's parcels, visits, missed calls and pending tasks
The administration panel.
Building modules that can be turned on or off
Modules per building.

How a call works

  1. Concierge calls
  2. Rings for 30 s
  3. First answer takes it
  4. Door can open for a short time

The call is the hard part of this product. It has to behave correctly when several phones ring at once, when someone answers on two devices, and when a database write fails halfway.

  • A pure state machine. The call logic has no network or storage, and it takes the clock as an argument. A Durable Object runs it on the server, and an in-memory version runs the same logic in tests.
  • Limits that respect emergencies. A concierge station has one active call, and each apartment has a limit on attempts per minute. An emergency call has its own higher limit, so it is not lost to that cap.
  • One owner for the audio. A call to the concierge rings on every concierge device, but the audio and the hang-up button belong to the one that answered.
  • Failures that clean up. If a database write fails, a job that runs every minute closes the stuck call, so it does not keep blocking new calls to that apartment.

Privacy in the data, not only in the text

  • Notifications carry no names. A parcel or visit alert says how many arrived, without a name, apartment or detail.
  • The audit log removes personal data. Personal data such as names, ID numbers, license plates and QR codes is removed from visit and parcel changes before they reach the audit log.
  • Data has an expiry date. A daily job applies the retention period set for each type of data.
  • Reports are tested for leaks. The monthly report has aggregate figures only, and a database test checks that no names or apartment numbers come out.

The privacy and terms text follows Chile's Law 21.719, but it is still a draft that a lawyer needs to review.

Tests

105 database migrations, 88 pgTAP test files for access rules and data, and more than 30 Vitest files for the API and panel. CI also runs end-to-end tests against a local database. The source is private, and I am happy to walk through it in an interview.