One honest beauty platform, designed as a system.

The usual answer is more. The honest answer is often less.

The insight the whole product is built on: the valuable half of the advice is the half that tells you to stop.

One system, two sides, a neutral core.

Every screen was designed against this map. The customer loop and the salon toolkit share one engine, one directory and one platform — so a salon's in-chair scan gives the same plan as the app, and a customer's plan is what brings salons their clients.

Parts of this map are built and tested but deliberately switched off: bookings, four-hour product delivery and the salon supply marketplace all open together at launch. Until then the pages say so and the server refuses the orders, rather than letting a half-open flow look finished.

Rules you can read, not a black box.

The engine is deterministic: the same inputs give the same plan, every time. AI may reword a reason; it never chooses an item. That is what keeps the advice explainable to a customer and defensible to a salon.

1. 01

   Adjust the readings

   Each adjustment carries its reason — humid air raises oil, under seven hours of sleep raises dark circles.

2. 02

   Diagnose

   Up to three focus concerns above a threshold; strengths below one; graded mild, moderate or high.

3. 03

   Fit the routine to the day

   Cleanser and sunscreen always. Treatment and moisturiser at ten minutes. Eye care only at twenty.

4. 04

   Choose within budget

   Filtered for sensitivity, age, skin tone and past failures, then ranked by match, price and gentleness.

Safety overrides the ranking: severe, painful breakouts put “see a dermatologist” into Necessary and take the treatments out.

Four properties are enforced rather than promised. Ranking never uses margin or paid promotion. Upsell services are never recommended and strong acids never reach sensitive skin. Every item carries a reason, and AI may only reword it. Inputs are hashed with the engine version, so any plan a customer was once given can be rebuilt exactly.

A one-chair salon and a five-branch group on the same model.

The structure had to start simple — one user, one branch, free — and grow without a migration: legal entities for GST, branches with their own menus and prices, departments, and roles that never let anyone grant more than they hold.

Outbound sales, turned inbound.

The directory did more for sales than any pitch could. Every Tri-City business already has a page — so the first conversation starts with “your page is live”, not with a demo.

Nine checkpoints, every turn on the record.

Each step was shipped to the live site, judged against references in the browser, and either kept or turned around. The decisions and the reasons behind them went into the design handover, so nothing was decided twice.

1. Aug 2025

   The first version

   A website-builder shop front: discounts, products, bookings. It sold things. It didn't answer anything.

2. 14 Oct

   Deep violet, low cognitive load

   Twelve rules every page had to pass: one primary action, answer first, one question per step. Purple read as gender-neutral; soft lilac didn't.

3. 15 Oct

   Frosted glass, 65 pages

   Glass on blurred colour, one typeface, a contrast table and a solid fallback. “Copy the newest iOS” turned out to mean the glass, not the layout.

4. 17 Oct

   Liquid-glass tuning

   Clearer fill, saturated fields, a specular rim, a lighter veil. Still too opaque.

5. 17 Oct

   v2, reference-led

   Photographic dusk scenes, smoky glass, ivory pills, numbered answers. The tiles and nav were still far from the references.

6. 17 Oct

   v3, crisp dark glass

   One nav bar, bright jewel scenes, a 1px lit edge, a short tight shadow. The background read dull and the tiles read like tablets.

7. 17 Oct

   v4, cool and gender-neutral

   Navy, cobalt, ocean, teal, emerald and one copper glow, with gold second lines. Magenta and coral had read as too feminine.

8. 19 Oct

   Logo v1 and the brand book

   A sideways heart that reads as B, with a back layer that makes it BB. From a reference sketch, rebuilt as geometry.

9. 20 Oct

   The wordmark

   Set solid in Jost Medium with the tt ligature, chosen from a grid of four geometric faces in three cases.

Five visual directions in three days was only survivable because every value lived in one file. The turnarounds were cheap because the system was cheap to change — not because the decisions were casual.

The rules aren't in a PDF. They fail the build.

A design-system lint rejects raw colours, raw palette classes, emoji used as icons, bold headings, and any button that isn't one of three kinds. It prints file and line, and exits non-zero.

Every scene is modelled at full strength under the veil and the background's white lines — the brightest spot text can ever sit on. A unit test fails if any pair drops below its minimum, so changing a scene colour tells you before anyone sees it, not after.

This is the part I would argue hardest for on any project. A rule enforced by the system does not need anybody to remember it at four on a Friday afternoon.

Honesty isn't a tone of voice. It's an architecture.

A product whose whole promise is telling people what to skip only works if people believe it. So trust was designed at three layers: what the copy promises, what the server refuses, and what the database will never answer.

Before

Row-level security was applied table by table, by hand, as each one was added — which works exactly as long as nobody forgets.

What forced it

A gap shipped and went unreported. I found it myself and closed it the same day, but the real problem was that memory had been the control.

The decision

Every table gets row-level security on, a restrictive no-access policy and no grants to the public API roles, and a trigger locks each new table the moment it is created.

What it changed

An integration test now fails if any table is unlocked, run against the hosted database rather than a local copy. An audit script runs before and after every migration, and an outside-in check probes the API the way an attacker would.

The same principle runs through the copy and the data. “Coming soon” appears wherever something is coming soon. Every demo is labelled sample data. Guidance is marked as guidance, not medical advice. Face photos are read in memory and dropped, never stored. Visits are counted with no cookie and no identifier — which is why there is no consent banner to click.

Live, honest about what's open, and ready to meet the Tri-City.

What I would tell the next systems designer on a project like this: design the go-to-market and the trust model with the same care as the screens. Here the directory did more for sales than any pitch could, and an honest “coming soon” did more for credibility than a launch date would have.