Taulu

The bulletin board used to hang somewhere real — the library corkboard, the cafe window, the community-center hallway. It's how you found the chess club, the run group, the open mic. Strangers posting to strangers, in a place everyone already passed through.

Those places are thinning out. The third spaces where community used to form — where you'd stumble onto something and just show up — keep closing or moving behind a screen. What's left is the group chat you're already in: fine for the plans you'd make anyway, useless for finding the ones you wouldn't.

The corkboard didn't just hold the plan. It's where you found the group in the first place.

Taulu is that board, online. An event is a poster, and the people and groups you share it with are the boards it's pinned to. Some boards are private: you and the friends you already have. Others are public: a community's board that a stranger nearby can find, follow and show up to.

Discovery you opt into, not a feed that grabs you. The public side could have been an endless ranked feed, the move every social app makes. Taulu's isn't. Finding a group is a search by distance, interest or name, and nothing appears that you didn't ask for. That's the corkboard on purpose: a bulletin board doesn't decide what you see; you walk up and read it. The cost is that discovery takes a little intent. The point is that it should: the goal is getting people to something in the real world, not holding them in the app.

The simplicity is the product. Some features were ruled out for good, not postponed: messaging, ranked or recommended feeds, AI features, taking payments, photo albums, ratings and reviews. Each is easy to add later and impossible to take back once people depend on it, and each pulls the app away from what it is for. Messaging is the clearest case: even a free-text note on an invite is where a chat app begins, so invites carry none.

A public app is probed by automated scripts from the day it goes up, and a small one is an easy target. So before anyone outside could sign up, the app went through a security review, run with a checklist I built into JAMIE, my development system, and grounded in the industry's standard lists of web risks.

What it led to is unglamorous, which is the point. The app reaches its database through a role that can read and write rows but never change their structure. A sign-in is a session the server can end at once, from one device or all of them. Signing in, signing up and changing a password are rate-limited, since those are where someone guesses at passwords. And the API stops answering questions about its own shape, and stops returning internal error details, to anyone outside. It's the difference between an app that's ready to be public and one that hasn't been attacked yet.