A REST API on Google Cloud Run in the EU, backed by PostgreSQL, is the single source of truth for bookings, wallets and memberships. The web apps are built in Angular 20 and 19, with standalone components, Signals, lazy loading on every page, and server-side rendering for fast first loads. The member app is built in Flutter for iOS and Android, with a layered structure (screens → view models → services) and reactive streams, so a change to a member’s balance or Clubhouse access updates every screen on its own. Firebase handles sign-in, with a token checked on every API call, plus push notifications on web and mobile, hosting and media storage. The reasoning behind the mobile app’s key decisions is written down in fifteen Architecture Decision Records.

The venue’s rules are enforced by the platform, not by goodwill. Each membership plan has its own limit on active bookings, with a counter members can see. Members who cancel too often are suspended automatically for a set period, with the end date shown clearly. Under-18 rules are set per sport, academy accounts follow their own simpler rules, and members whose plan doesn’t include app booking are told to contact the front desk instead of hitting a broken screen. On the staff side, nine roles (Admin, Front Desk, General Manager, Staff, Coach, Academy, Grid Maintainer, Clubhouse Manager and Customer) each get their own permissions and their own start page, enforced in the interface and on the server.

Privacy and security are designed in. Health data is treated as a special category under GDPR Article 9: explicit consent, encryption, one-click erasure, and every staff view of it audit-logged. Error reports, sent to Sentry, carry only what engineers need: never what a member typed, never health data, and email addresses masked. The web apps ship with a strict Content Security Policy, and payment result pages can’t be opened by typing their address. The web apps release through GitHub Actions, with a preview link for every pull request and separate staging and production environments.

The web app is built in Angular and the mobile apps in Flutter, and both talk to the same platform: a versioned cloud API on Google Cloud Run, with endpoints for users, events, results, social, chat, search, payments, campaigns and forms, plus Firebase Cloud Functions for serverless logic. Firebase Authentication handles every sign-in method, and each account is mirrored on the AthletesWeR server so one identity works everywhere. Cloud Firestore holds users, events and chat rooms. The Firebase Realtime Database carries everything that has to be instant: chat messages, typing indicators, unread counters and live notifications. Public pages get server-side social previews, so a shared link always shows a proper image and title.

The rules of the platform are explicit. Organisers are approved before they publish. Results uploads are reviewed before they go live. Events move from submitted to approved or rejected, with listed, draft or private visibility. Result matching never attributes a result to the wrong person without the athlete’s confirmation. One subscription gate decides whether to show Premium content or an upsell, so the free/paid boundary is identical on web and mobile. Card payments happen only on hosted Stripe pages or through the app stores, and the server confirms every order before notifying the athlete.

The team can steer the platform without a release. A bilingual maintenance page switches on in seconds on web and mobile, the apps can show a soft or mandatory update prompt, and legal pages are edited from the CMS. Development, testing and production are separate environments with one-command deployment. Every feed uses infinite scrolling and pagination so large lists stay fast, and errors are reported to Sentry in real time.