Designing a trust system for dog owners, trainers, and shelters

I was the product team: strategy, design, specs, and code.

The target was never a clickable prototype. It was a demo world complete enough to drive: characters with histories, dogs with care needs, walks that already happened.

I defined the trust model, the service marketplace, and the shelter program, designed every surface, and wrote the strategy and specs into a living documentation system that governs the build.

There was no handoff. The spec, the design, and the code moved in one loop, so decisions got tested the day they were made.

• 4 monthsof build
• 3guided demo journeys
• 7demo personas
• 75+routes
• 180+components
• 300+design tokens

A privacy model you can feel safe inside

You want to meet the dog people around you, but not everyone wants to be seen the same amount. For plenty of people, being visible in a neighbourhood app is the scary part: a public profile feels like too much, and a friend request announces itself. For a trainer, being visible is the whole point. One switch can't serve both.

Your profile starts private. To a stranger it's a locked card: no posts, no dogs, no way in.

Familiar is the first step, and it's one-sided and silent. You open your profile to someone, and they're never told you did it. Only if they mark you back does the option to connect appear, for either of you.

That silence only works because the same thing happens three ways: some people set their profile public, some mark everyone from a walk in one go, and some pick one person. The result is identical, so being seen never means being singled out.

And public is a choice, not a lapse. A trainer building a client base opens their profile on day one, because being found is the point. The same model holds the person easing into the neighbourhood and the person promoting to it.

Connecting is mutual: a request arrives, you accept or decline, and accepting is what opens the chat. Paid care sits behind that, so you can book from someone you've actually met. The ladder shapes discovery too, ranking those people above the open marketplace.

Private, Familiar, Connected. Three states, because trust isn't a switch.

Care without becoming a gig worker.

The trainer wanted an audience. Most dog people don't. You'd happily walk a neighbour's dog now and then, and that's it. But the usual options are both wrong: list yourself as a provider and you're running a side hustle, strangers and all; keep it an unspoken favour and it quietly goes unbalanced. So most people don't offer at all.

Offering care is a dial on your existing profile, not a second account. Turn it up a little and your services open to your circle only, the same people from the trust model above, and no one else. You never appear in the public directory, there are no ratings, no separate gig-worker profile. Turn it all the way up and you're a full provider, open to anyone: the trainer from a moment ago. Same person, wider audience.

Care is a dial you turn up, not a role you sign up for.

A set price comes with it, computed once and shown identically to both sides, so asking and accepting stay clean. The barrier to helping drops to almost nothing, so more people offer, and more dogs get looked after by someone they already know.

A system you can visit

The build runs on Groundwork, a system I built for it: one playbook of hard rules, work in scoped phases, and a walkthrough review closing every phase, where decisions get challenged, sometimes reversed, and always logged. That system is what let one designer ship 82 phases of product in four months, with Claude Code as the build partner, and keep the specs honest the whole way.

The decision logs are timestamped. This page doesn't reconstruct my reasoning after the fact. It is the record.

The workshop grew a front door

Halfway through, the documentation system got its own product: a 24-page dashboard rendered from the docs on every commit. The board, the trackers, the decisions log, the strategy shelf: all of it browsable, all of it live. Every push redeploys the truth, and the surface alarms on its own drift when a doc and a page fall out of shape. The deeper payoff is structural. Deciding how the documentation should render meant deciding how it should be organized, and that organization is what makes the trackers and the strategy shelf easy to dig into, for me daily and for the founder at a glance.

Derived, never authored. To change a page, change its source doc. If the surface ever disagrees with the docs, the docs win.

One system, down to the tokens

Every colour in the app routes through semantic tokens: blue is paid care, green is community, violet is the volunteer lane. People render as circles; dogs as rounded squares. Dark mode shipped as the proof the system holds: 95 token overrides, zero component rewrites.