Member journey
Pre-launch registration, sign-in, member profiles, discovery, likes, mutual matches and messaging form the core experience. Voice/video, translation and premium membership extend engagement.
01 / Investment perspective
The application, at a glance
A relationship-focused web platform combining discovery, communication, verification and guided preparation experiences.
Preparation ecosystem
Date Ready, LoveDNA, Look, Learn English, Reset and Rooms provide complementary experiences, including AI-assisted guidance and learning activities. Availability depends on configuration and launch gates.
Direct, inspectable web stack
HTML, CSS and JavaScript front ends communicate with a compiled Delphi service on Windows/IIS. The database, media and external service dependencies need coordinated operational ownership.
Agree the acquisition boundary
Define source-code rights, branding, data migration, vendor accounts, hosting, support, licences and acceptance criteria in the purchase agreement. This guide is not a licence offer or service-level commitment.
How to read this guide. "Source-verified" describes implementation found in the reviewed code. "Planning guidance" describes a proposed operational baseline. Buyer validation means evidence or a contractual decision is still required. No SOC 2, ISO 27001, PCI DSS, GDPR or WCAG certification is asserted.
| Audience | Start here | Decision to resolve |
|---|---|---|
| Commercial / investment | Product; acquisition & handover | Scope, rights, total cost and acceptance milestones |
| Design / brand / accessibility | Design & experience; front end | Rebranding, assets, device coverage and inclusive design |
| Engineering / solution architecture | Architecture; back end; integrations | Maintainability, deployment topology and vendor dependencies |
| Database / security / legal | Database; security & privacy | Data flows, retention, access controls and assurance evidence |
| Infrastructure / service delivery | Hardware & capacity; operations | Load profile, resilience, observability and recovery targets |
02 / Functional specification
More than a matching interface
Application surfaces present in the source. Commercial entitlement, launch status and third-party provisioning determine what a deployment can offer.
Discover & connect
- Profile creation, photos, preferences and member discovery.
- Likes sent/received and mutual-match journeys.
- Profile settings, account and premium surfaces.
Communicate & translate
- Text conversation and conversation history.
- Browser camera/microphone calling interfaces.
- Translation and AI-assisted conversation flows.
Trust & membership
- Email and identity-verification journeys.
- Reporting, blocking and administrative review surfaces.
- Stripe-based paid membership integration.
Prepare & develop
- Date Ready coaching, LoveDNA and Look experiences.
- Learn English placement, quizzes, teacher practice and audio.
- Rooms and Reset preparation experiences.
Operate & manage
- Administrative dashboard and command centre.
- Launch controls, prompt management and SEO publishing.
- Simulator, test-procedure and diagnostic tooling.
Buyer acceptance scenarios
Walk through registration to a verified match; paid upgrade and cancellation; blocked/reported member handling; a real-device call; AI timeout handling; account lifecycle and an administrative recovery exercise.
A screen or route is evidence of development scope, not confirmation that every feature is enabled, fully integrated or included in a sale.
03 / Visual & interaction design
Designed for connection, reviewed for usability
A mobile-oriented visual language with relationship-led content and distinct companion experiences.
Brand & components
Dark surfaces, pink accents, aqua highlights, profile cards, chips, pill actions and mobile navigation. Existing pages use system fonts and, on selected surfaces, Manrope and Space Grotesk.
Responsive experiences
CSS breakpoints, flexible cards and safe-area spacing support phone and desktop layouts. Shared helpers coordinate navigation and session state. Selected learning experiences include theme switching, replayable speech and visible return controls.
Accessibility review
Test against WCAG 2.2 AA: keyboard and focus order, contrast in both themes, screen-reader names, motion, captions, error recovery and touch targets. Existing semantic controls do not establish whole-product conformance.
Creative asset package
Request editable brand assets, image and font licences, icon attribution, media permissions, localisation strings and component documentation. Confirm whether design-system files and original artwork are included.
Rebranding scope: plan a cross-page pass over colours, logos, email templates, PWA icons, launch video, metadata, legal copy and provider-hosted verification/payment screens. A single CSS change will not necessarily rebrand every module.
04 / System context
Clear layers. Explicit dependencies.
A browser-delivered application with server-side business logic, relational persistence and specialist external services.
Browser / PWAHTML, CSS, JavaScript
Fetch / JSON
Camera, microphone, speech
Fetch / JSON
Camera, microphone, speech
Windows / IISStatic web delivery
Compiled Delphi service
Authentication & business rules
Compiled Delphi service
Authentication & business rules
Data & mediaRelational persistence
Uploaded assets
Audit & application state
Uploaded assets
Audit & application state
External service plane
Server-mediated identity verification, AI and payment flows are separate trust boundaries. Browser media can use peer-to-peer or configured relay/SFU infrastructure. Media traffic must not be sized as ordinary API traffic.
Request model
JSON endpoints sit behind a compiled server application. The chat client polls messages at a configured two-second interval, and call signalling at 600 ms while active. Other screens add their own request patterns.
Not automatically stateless
Before introducing multiple application nodes, review process-local state, background work, shared media paths, provider callbacks and session consistency. A load balancer alone does not establish horizontal scalability.
Separate the failure domains
Recommended target: isolate web/API, database and media workloads; keep backups outside the primary host; add provider timeouts, retry policies, monitoring and documented degraded modes.
05 / Client engineering
A browser-native front end
Inspectable page-level HTML/CSS/JavaScript with shared application helpers; no framework migration is assumed by this specification.
| Technology | Implementation / purpose | Review consideration |
|---|---|---|
| HTML5 / CSS / JavaScript | Responsive documents, page-level styling, DOM interaction and async Fetch requests. | Maintain shared patterns across independently styled modules. |
| HTTP(S) + JSON | Browser-to-service request/response transport. | Confirm error contracts, timeout handling, CORS and versioning. |
| PWA manifest / service worker | Standalone install metadata and static-asset caching. HTML and API requests are not served from the static cache. | Not an offline dating service; validate install/update behaviour per browser. |
| WebRTC / media APIs | Real-time calling, camera and microphone access. | HTTPS, permissions, codec/device testing and TURN/SFU provisioning. |
| Web Speech APIs | Speech synthesis and recognition in supported learning/voice flows. | Voice, language and recognition availability vary by browser and OS. |
| Web Storage | Session storage and selected local preferences/learning state. | Define shared-device, sign-out and sensitive-data cleanup expectations. |
| Fonts / icons / media assets | Google Fonts and selected Lucide resources, alongside local assets. | Review external delivery, licences, asset provenance and self-hosting policy. |
Browser qualification matrix
Recommended acceptance coverage: current Edge, Chrome, Firefox and Safari; Android Chrome and iOS Safari; installed PWA mode where supported. Explicitly test speech, playback, permissions and interrupted calls.
Engineering verification
The project includes Node-based checks for inline JavaScript and targeted application behaviours. Browser automation can verify navigation, layout and mocked flows. Request a reproducible test run against the exact release being acquired.
06 / Service engineering
Compiled application services
Delphi business logic and Windows hosting form the back-end delivery model.
| Layer | Technology / responsibility | Buyer consideration |
|---|---|---|
| Language & application model | Delphi / Object Pascal; WebBroker ISAPI library delivered as a DLL. | Retain Delphi build expertise and compatible compiler/library licences. |
| Hosting | Microsoft IIS on Windows; ISAPI request dispatch and application-pool lifecycle. | Match DLL architecture, pool bitness and database driver architecture. |
| Persistence | ADO / TADOConnection access to Microsoft SQL Server. | Confirm the deployed SQL Server edition/version, provider and connection limits. |
| Outbound services | HTTP clients and SMTP/TLS components; provider-specific request and callback handlers. | Provision certificates, outbound access, credentials, quotas and delivery monitoring. |
| Schema evolution | SQL scripts for application domains and extension features. | Validate migration order and deployed schema; do not assume automatic migration on startup. |
Business domains
Member lifecycle, profiles, likes and matches, conversations, subscriptions, verification, companion experiences and administrative operations are represented in server and schema sources.
Integration boundary
Payment, identity and AI credentials belong on the server. Client-facing actions call application endpoints rather than receiving secret provider credentials.
Build architecture: the project defaults to a Debug / Win32 configuration and also contains Win64 and ARM64EC property groups. That does not identify the deployed binary. Confirm a tested Release build, actual target architecture, IIS pool settings and matching drivers before handover. OpenAI voice sessions use short-lived client credentials, not the long-lived provider API key.
Release acceptance: request compiler and dependency versions, database drivers, reproducible build instructions and the exact binary matching the reviewed source. Source changes do not become active until the service is rebuilt and deployed.
07 / Information architecture
Data ownership deserves its own review
Review transactional records, uploaded media and third-party processing together, not just the primary database.
Database platform: Microsoft SQL Server, accessed through ADO. SQL migration sources include explicit foreign-key relationships for selected domains, including payment records linked to member records. The exact deployed version, edition, collation, full constraint coverage and index baseline must be confirmed from the acquisition environment.
| Domain | Typical information | Lifecycle questions |
|---|---|---|
| Identity & access | Members, sessions, verification state and login audit. | Expiry, revocation, provider identifiers and deletion obligations. |
| Profiles & discovery | Profile attributes, preferences, photos, likes and matches. | Consent, visibility, location precision and media cleanup. |
| Communication | Messages, conversation history, call/signalling metadata. | Retention, participant access, moderation and legal hold. |
| Commerce | Membership, checkout, subscription and payment references. | Reconciliation, webhook deduplication and accounting retention. |
| Preparation & AI | Learn English progress, LoveDNA, Look, Rooms and companion activity. | Prompt content, sensitive inferences, export and provider retention. |
| Operations | Administrative actions, diagnostics and configuration. | Least privilege, log redaction, audit integrity and disposal. |
Schema & migration pack
Obtain a physical ER diagram, data dictionary, keys/indexes, schema baseline and ordered migration scripts. Verify the actual deployed schema against the source SQL and define rollback and compatibility checks.
Back up the whole information estate
Coordinate database, media, configuration and encryption-key recovery. Define retention and restore targets; test restoration into an isolated environment. Database backups alone do not restore uploaded files.
08 / Trust & assurance
Controls are evidence, not certification
A procurement-oriented account of security-related mechanisms and the assurance work a buyer should commission.
Web delivery controls
IIS configuration includes HSTS, content-type protection, same-origin frame restrictions, a referrer policy and camera/microphone permissions policy. Source and selected operational directories are restricted in the web configuration.
Member access journeys
Shared helpers manage session state, launch access, membership and verification journeys. Browser checks improve experience; server-side authorisation remains the enforcement boundary.
Passwords & sessions
Password hashing and verification use BCrypt helpers. Server-side session lookup checks stored session tokens and expiry; administrative authorisation and audit-related handlers are present. Validate policy settings and all role boundaries in the acquired release.
Verification & moderation
Didit session/status and webhook flows update verification state. Blocking, reporting and administrative account actions are represented in the implementation. Provider configuration, webhook enforcement and moderation procedures require deployment acceptance.
Application assurance
Commission an OWASP ASVS-aligned assessment and penetration test covering authentication, role boundaries, uploads, webhooks, APIs, payment flows, AI input handling, abuse prevention and dependency exposure.
Personal data & consent
Dating, identity and AI content can be sensitive. Establish lawful processing, age/eligibility policy, consent records, data-subject workflows, retention, subprocessors, international transfers and incident response for the intended jurisdictions.
| Standard / framework | Position in this guide |
|---|---|
| HTTPS / WebRTC | Technologies used by the application; validate deployed TLS, media routing and certificate policy. Transport encryption is not a claim of end-to-end encrypted messaging. |
| WCAG 2.2 AA | Recommended accessibility acceptance target, not a conformance claim. |
| OWASP ASVS / API Security | Recommended verification references; no independent test report is asserted here. |
| GDPR / local privacy law | Deployment-specific legal obligations; no compliance certification or legal conclusion. |
| PCI DSS / ISO 27001 / SOC 2 | No certification claimed. Hosted payment processing does not remove all merchant obligations. |
Buyer validation: obtain evidence for encryption at rest, secret rotation, administrative MFA, security-event retention, rate limiting, backup protection and incident exercises. Their presence and effectiveness are not established by this page. Detailed security material should be shared under controlled due diligence, not published here.
09 / Service ecosystem
Understand the services behind the experience
External services require buyer-owned accounts, contracts, quotas and data-processing decisions. Provider availability is separate from application ownership.
Dependency review: confirm the active providers and model choices in the acquired deployment. Source references can include optional paths; they do not prove an active subscription or transferred entitlement.
| Provider / service | Implemented purpose | Data / commercial review |
|---|---|---|
| Didit | Identity-verification session creation, status retrieval and webhook processing. | Workflow-defined identity evidence, session references and result payloads. Confirm document/biometric scope, consent, regional processing, retention and per-check fees. Simulator approvals are not production identity checks. |
| OpenAI | Configurable chat completions/model selection, companion responses, translation and Realtime voice sessions using ephemeral client credentials. | Prompts, conversation context and audio as applicable. Review model availability, token/audio rates, retention, safety, quotas and data-processing terms. |
| xAI / Grok | Alternative configurable chat-completions provider. | Prompts and context sent on selected routes. Confirm selected models, usage pricing, retention and behaviour if unavailable. |
| Metered SFU | Server-mediated create/publish/subscribe/renegotiation operations for configured WebRTC SFU mode. Legacy P2P/TURN transport is also represented. | Session/media routing data. Confirm account entitlement, regions, relay paths, bandwidth/minute charges and capacity. A separate TURN service may be required by the chosen transport. |
| Stripe | Checkout, subscription status/cancellation and webhooks with related payment records. | Customer, checkout and subscription references. Validate live/sandbox separation, account ownership, tax/refunds, reconciliation and merchant responsibilities. |
| Configured SMTP service | Transactional/verification and administrative email through Indy SMTP/TLS components. | Email address and message content. Provider is deployment-selected; confirm delivery limits, SPF/DKIM/DMARC, TLS policy and costs. No particular email vendor is guaranteed. |
| Google Fonts / Lucide via UNPKG | Selected font and icon delivery on existing pages. | External asset requests expose standard request metadata. Review versions, licences, availability, integrity and the option to self-host. |
Provider-neutral procurement
Models, endpoints and feature switches are configurable on selected paths, but that is not proof every provider is interchangeable. Any replacement must preserve request/response semantics, streaming/media behaviour, moderation and error handling.
AI governance & quality
Agree approved use cases, model evaluations, prompt change control, harmful-output handling, sensitive-data minimisation, escalation to people and a spend ceiling. AI-generated advice and translations should not be sold as guaranteed factual or professional guidance.
10 / Infrastructure planning
Size for activity. Not just accounts.
Indicative procurement starting points for 3,000, 5,000, 10,000 and 25,000 registered members. These are engineering estimates, not measured application limits or guarantees.
Baseline assumptions: 10% of registered members online at peak; every online member polling one active conversation every two seconds; 5% of online members in one-to-one calls; 1.5 Mbps video per participant. AI inference is external. Recording, group calls, heavy search, uploads and provider quotas need separate budgets. If you mean 3,000 simultaneous users, use 3,000 as the online count, not the registered count.
| Registered / online | Web / API tier | Database tier | Storage & network starting point |
|---|---|---|---|
| 3,000 / 300 | 1 node: 4 vCPU, 16 GB RAM. No application-node redundancy. | 4 vCPU, 16 GB RAM; 150 GB SSD. | 150 GB media SSD; 1 Gbps NIC. Off-host backup capacity additional. |
| 5,000 / 500 | 1 node: 8 vCPU, 32 GB RAM. Add a validated standby for continuity. | 8 vCPU, 32 GB RAM; 250 GB SSD. | 250 GB media SSD; 1 Gbps NIC. Separate media delivery preferred. |
| 10,000 / 1,000 | 2 nodes: each 8 vCPU, 32 GB RAM; load balancer after scale-out acceptance. | 8-16 vCPU, 64 GB RAM; 500 GB NVMe; separately budget standby. | 500 GB shared media allocation; CDN recommended. 1 Gbps per node; benchmark egress. |
| 25,000 / 2,500 | 3-4 nodes: each 8-16 vCPU, 32-64 GB RAM; validated shared-state design. | 16 vCPU, 128 GB RAM; 1 TB NVMe; replica/standby design subject to DB edition. | 1 TB shared media allocation; CDN; 1-10 Gbps tier network after measured demand. |
| Above 25,000 | Increase tested application capacity from measured peak requests; no linear scaling guarantee. | Index/query tuning and measured IOPS/working set before further scale-out. | Independent media/relay and AI quota planning. Specialist load engineering required. |
App specifications are per node; database and media disk allocations are separate and exclude OS, logs and backups. Baselines assume modern server-class CPUs and low-latency SSD storage. They are not vendor-certified minimums. A 32-bit service can hit process address-space limits regardless of host RAM; additional host memory does not remove that constraint.
Explore your workload assumptions
This calculator estimates traffic, not the number of servers required. Hardware above stays at its stated 10% baseline.
Enter a whole member count between 1 and 10,000,000.
1,000peak online members
500message polls / second
25simultaneous 1:1 calls
94relay egress Mbps incl. 25% headroom
25 calls add about 84 signalling polls/second. Illustrative primary content budget: 80 GB before indexes, logs, backups or recordings.
Traffic & storage arithmetic
Online = members × selected percentage (rounded up). Message polls/s = online ÷ 2. Calls = 5% of online ÷ 2 (rounded down). Signalling polls/s = 2 × calls ÷ 0.6. Relay egress = calls × 2 × 1.5 Mbps × 1.25, assuming all calls are relayed.
Content budget = members × 8 MB: six 0.5 MB photos plus an illustrative 5 MB message/metadata allowance per member. Decimal GB; a planning allowance, not a measured record size.
Media, AI & resilience
Relay ingress is additional to egress; thumbnails, translation and audio add overhead. At a sustained 1 Mbps, one hour transfers about 0.45 GB. TURN/SFU charges depend on routing and duration. AI cost depends on model, tokens, audio minutes and peak concurrency, not registered members.
High availability needs spare capacity, shared-state validation and tested failover. None of the single-node examples provides an availability guarantee.
Required before procurement: run mixed-workload load/soak tests against the release and intended topology. Include sign-in, discovery, polling, writes, uploads, AI waits and real relayed calls. Record p95/p99 latency, error rate, DB locks/IOPS, queue depth, process memory, bandwidth and provider throttling. Agree targets, then right-size with at least 30% measured headroom.
11 / Delivery & service management
Operate a service, not just a website
Recommended operating model for a buyer-managed installation. Operational controls must be demonstrated in the target environment.
Deployment prerequisites
- Supported Windows Server, IIS and compatible compiled Delphi runtime/dependencies.
- Database service, compatible drivers and schema migrations.
- DNS, TLS certificates, secure outbound access and provider callbacks.
- Protected media storage, secrets and environment-specific configuration.
Environment separation
- Separate development, staging and production services and credentials.
- Sanitised test data and sandbox payment/verification accounts.
- Reproducible builds, reviewed migrations and release artefact checksums.
- Database/media rollback and application-pool recycle procedures.
Observability & support
- Synthetic checks for sign-in, discovery and messaging.
- API latency/errors, database health and provider response monitoring.
- Call connection success, relay usage and AI/payment quota alerts.
- Redacted logs, escalation rota and incident communications.
Backup & disaster recovery
- Agree recovery time (RTO) and maximum data loss (RPO).
- Encrypted off-host backups with tested restore procedures.
- Database, media, configuration and key recovery together.
- Regular recovery exercises; a backup job is not proof of recoverability.
| Cost centre | Budget basis |
|---|---|
| Infrastructure & licences | Application/database nodes, Windows/Delphi/database entitlements, storage, backup, load balancer and network. |
| Usage-based providers | Identity checks, payment processing, AI tokens/audio, email and media/relay traffic. |
| People & assurance | Support, moderation, patching, monitoring, accessibility, security testing, legal and incident response. |
| Change & growth | Branding, localisation, migrations, integration updates, capacity tests and recovery exercises. |
12 / Acquisition readiness
A professional handover is part of the product
Use this checklist to convert a demonstration into an evidence-based acceptance and transition plan.
Define exactly what transfers
Source and binaries, copyright/IP rights, brand/domain rights, original assets, database/schema ownership, historical records, documentation, build tools and third-party licences. Confirm exclusions and whether vendor accounts are transferable.
Establish a repeatable release
Named release, compiler/dependency inventory, software bill of materials, build instructions, schema baseline, environment template without secrets, deployment/rollback runbooks and executable test evidence.
Review data and contractual obligations
Data-controller/processor roles, lawful transfer, consent and retention records, subprocessor agreements, residency, export/deletion workflows, payment obligations and vendor termination/portability arrangements.
Complete acceptance testing
Business journeys, mobile/browser coverage, accessibility, independent security assessment, peak-load and soak testing, provider outage handling, subscription reconciliation and a full restore/failover exercise.
Agree commercial and operational terms
Purchase/licensing structure, support period, defect remediation, service levels, moderation ownership, training, warranties, recurring costs, transition responsibilities and measurable sign-off milestones.
Build the transition team
Buyer product owner; Delphi/Windows engineer; front-end engineer; DBA; infrastructure/SRE; designer/accessibility specialist; security/privacy lead; customer support and moderation. Roles can be combined where appropriate.
Evidence pack to request: physical ERD and data dictionary; API catalogue; dependency/licence register; provider/data-flow register; test and assurance reports; performance results; recovery evidence; operational runbooks; training and known-limitations register. This guide is a public overview, not a substitute for that controlled technical pack.