Cadence Studio
Case study

Pinloop

A mobile-first app where Disney pin traders find each other and trade safely. Every trader is identity-verified, addresses are released only after both sides agree, and every trade is tracked from offer to doorstep.

iPhone and Android appWeb app and admin panelBuilt and launched in 2026
The Pinloop wordmark on a warm paper background with gold twinkles
Pinloop's wordmark.

At a glance

Platform
iPhone and Android app, plus a web app and an admin panel for the team
Languages
TypeScript throughout; SQL for the database
Phone app
Expo 54 and React Native, with Expo Router and React 19
Web and admin
Next.js 16 and React 19, styled with Tailwind CSS 4
Back end and database
Supabase: a Postgres database with row-level security (the database itself decides who may see each record), edge functions (small pieces of server code, run on Deno), file storage and realtime updates
Sign-in
Supabase Auth, the sign-in service built into the same back end
Identity check
Didit
Payments
Stripe
Subscriptions
RevenueCat, for Premium on the App Store and Google Play
Shipping
EasyPost, for postage labels and tracking
Email
Resend
Notifications
Push notifications through Expo
Hosting and releases
The web app on Vercel; the phone apps built and sent to the stores with EAS (Expo's cloud build service); automated checks on every change with GitHub Actions; one pnpm monorepo for all of it
Built in
2026, launched the same year

What it does

  • Find people, not just pinsCollections, trade lists and in-search-of lists, so traders can see who has what and who wants what, close to home or anywhere.The lists live in Supabase's Postgres database, and row-level security decides, inside the database itself, who can see each one, so a private list stays private even if the app has a bug.
  • Trades that stay honestOffers, counters and agreements happen in the app. Addresses stay locked until both traders say yes, and the trade is tracked through shipping to delivery.Each step of a trade is checked by server code, not by the phone. Addresses are encrypted when stored and only released by the server once both traders have agreed.
  • A community with standingVerified traders, reviews after every finished trade, and reporting and blocking, with a moderation panel behind it all.The identity check is Didit: the trader verifies with Didit and Pinloop records the result. The moderation panel is a Next.js app on Vercel that needs a team role to open.

How it fits together

The wiring, with the service behind each part named. Each box is a real part of the app.

People use Phone app Expo and React Native iPhone and Android, built and shipped with EAS Admin panel Next.js on Vercel for the team: moderation, reports, support Pinloop backend, on Supabase Sign-in and accounts Supabase Auth, every trader verified Collections and trades Postgres with row-level security: each person sees only their own Private addresses encrypted, released when both agree Pin photos and live updates Supabase Storage and Realtime; server code in edge functions Outside services Identity check Didit Payments Stripe; premium via RevenueCat Shipping labels EasyPost: labels and tracking no custody, ever: the app never holds pins or money People use Phone app Expo and React Native, iPhone and Android Admin panel Next.js on Vercel, for the team: moderation, reports, support Pinloop backend, on Supabase Sign-in and accounts Supabase Auth, every trader verified Collections and trades Postgres with row-level security: each person sees only their own Private addresses encrypted, released when both agree Pin photos and live updates Supabase Storage and Realtime; server code in edge functions no custody, ever: the app never holds pins or money Outside services Identity check Didit Payments Stripe; premium via RevenueCat Shipping labels EasyPost: labels and tracking

A trade, end to end

  1. 1

    List

    Traders add pins to their collection and mark what they would trade.

    Photos go to Supabase Storage; the listing lives in Postgres.

  2. 2

    Offer

    One trader proposes a swap; the other accepts, counters or declines.

    Each offer moves through clear statuses (sent, viewed, countered, accepted) kept in Postgres, so both traders always see the same state.

  3. 3

    Agree

    Both sign the same terms before anything moves.

    The agreement goes through a database function that checks every rule; the phone only asks.

  4. 4

    Release

    Only now are the two addresses shared, and only with each other.

    Server code releases each address to the other trader only, and only after both have agreed.

  5. 5

    Ship

    Labels and tracking show both pins on their way.

    Labels are bought through EasyPost and paid with Stripe; tracking updates flow back in from EasyPost.

  6. 6

    Review

    Each trader reviews the other, and standing builds over time.

    Reviews are stored in Postgres and shown on each trader's public profile.

Why we chose it

  • Expo and React Native. One codebase for iPhone and Android, and EAS builds and submits both apps from the cloud, so an update reaches both stores together.
  • Supabase. A real Postgres database with sign-in, file storage and live updates built in. Row-level security means each person's data is protected by the database itself, not only by the app.
  • Stripe. Payments through one provider traders already trust.
  • EasyPost. Real postage and tracking from the major carriers through one connection, so a trade can be shipped without leaving the app.
  • RevenueCat. Handles subscriptions on both app stores, so Premium works the same on an iPhone and an Android phone.

Pinloop is an independent community platform and is not affiliated with, endorsed by, or sponsored by Disney.

Want an app built like this for your business?

Tell us about it in a few lines. We'll come back with questions, then a plan and a price.

Start a project with usSee more of our work