# Build brief — a focused alternative to Snapchat

> **Verdict:** Not faithfully · **Buildability:** 7/100 · **Category:** Social Media
> **Source:** https://www.canitbevibecoded.com/snapchat
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from Snapchat. Verify current pricing and capabilities before acting.

## Context

**Snapchat** — Camera-first messenger where snaps, stories and streaks disappear · the app is the friend graph. It currently costs $3.99/mo.

The mechanics one-shot fine: ephemeral photo messages, 24-hour stories and streak counters are CRUD plus a delete timer. None of that is the product. Snapchat is where your friends already are · the value of a disappearing photo is who is on the other end, and a self-hosted clone with two users is a group chat with extra steps. Add the AR lens stack built on years of face-tracking models, screenshot detection that needs OS-level app privileges, and media infrastructure moving billions of snaps a day, and the honest verdict is that the network is the app. The prompt below is the consolation build: a private snap relay for one friend group that opts in.

This brief describes a focused, single-operator replacement for the part of Snapchat that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

Snap a photo with a caption overlay and send it to an invited friend group; each snap deletes after one timed view, with daily streaks and 24-hour group stories.

- Draft, queue, and track content for the few networks you actually use.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- Friends willing to install the PWA and actually use it.

### Data and integrations

- A small VPS or free-tier Node host with HTTPS (camera and push APIs require it).

Each of these needs a real account, credential, or quota. Set them up before writing feature code.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build me a private ephemeral photo-messaging app, snaps for one friend group that opts in. Requirements:

- Node 22 + Fastify + better-sqlite3, and a vanilla-JS installable PWA served from
  /public with no build step: manifest, service worker, an offline shell that caches
  the UI but never caches snaps.
- Core loop: open the camera with getUserMedia, capture a photo, type or draw a
  caption overlay on a canvas, send it to one or more friends.
- A snap is viewable exactly once for up to 10 seconds; the server deletes the image
  file immediately after the view and keeps only a minimal sent/opened log row.
- Accounts are invite-code only: the admin seeds codes with a CLI script, signup is
  username plus passcode, sessions are httpOnly cookies.
- Per-pair daily streaks tracked server-side, shown next to each friend.
- Group stories: a snap posted to my story is visible to all members and hard-deleted
  after 24 hours by a sweep job.
- Media lives as files on disk outside the web root; metadata in SQLite with WAL mode.
- Web push for new snaps behind a permission prompt; the app must work fully without
  it, and the README says iOS web push is best-effort. VAPID keys and session secret
  in .env, with a documented script that generates them and a .env.example.
- HTTPS is required for camera and push: document local dev with a self-signed cert
  and production behind Caddy on a cheap VPS.
- Be honest in the UI: label view-once as deleted from our server, and state plainly
  that screenshots cannot be detected on the web.
- Tests for delete-after-view, the 24-hour story sweep, and streak day-boundary math
  with a fake clock.
- Out of scope: AR lenses and face filters, Snap Map, Discover or Spotlight feeds,
  video calls, screenshot detection, analytics, and third-party auth.
- README: setup, deploying, where data lives, how deletion actually works, and how
  to invite the first two friends.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- The people: everyone you snap with is on Snapchat, not on your server.
- AR lenses and filters backed by years of face-tracking models.
- Screenshot detection · a web app cannot see or stop screenshots.
- Snap Map, Discover, Spotlight and the creator ecosystem.
- The value comes from the people already using it.
- Model quality and inference operations are part of the product.

## What you still own after launch

- Secure credentials, rotate secrets, and handle provider rate limits.
- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.

## Risk

**Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost.

Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.

## Prior art

Working open-source software you can read, fork, or borrow from before starting:

- [Signal](https://github.com/signalapp/Signal-Android) — open-source messenger with disappearing messages and view-once media, minus the social layer
- [Pixelfed](https://github.com/pixelfed/pixelfed) — federated photo sharing with ephemeral 24-hour stories

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/snapchat