PlayProtocol & LAXProtocol
Two branded sports injury-prevention apps on one backend. Warm-up, strength, and recovery drills filmed rep by rep by physical therapists — native SwiftUI and Jetpack Compose clients, signed video delivery, server-verified entitlements on both stores.
Drills a coach can actually run.
PlayProtocol grew out of the injury-prevention movement screenings that Cape Concierge Physical Therapy runs for school sports programs. The screenings kept surfacing the same gap: coaches wanted the warm-up, strength, and recovery work the PTs prescribed, in a form a team could actually follow — not a PDF, not a YouTube playlist. So we built it as a product: over 75 drills, every one filmed rep by rep by physical therapists, organized by sport across soccer, football, field hockey, and lacrosse.
The trust model is deliberate: every sport opens with free warm-up drills a coach can run at the next practice — no account, no sign-up, nothing collected. Programs that enroll with the PT team get their teams' prescribed drill protocols and daily check-ins layered on top.
LAXProtocol is the lacrosse-focused sibling: its own brand, its own content line, a full season of lacrosse-specific work — running on the same backend, the same content pipeline, and the same client codebases. Two store identities, one system. Both ship on the App Store and Google Play.
What it does.
Filmed Rep by Rep
Every drill is demonstrated on video by a physical therapist — full reps, correct form, no stock footage. The video library is the product.
Free Warm-Ups, No Account
Each sport opens with free warm-up drills, usable immediately. No sign-up, no email capture — a coach can evaluate the whole idea at practice tomorrow.
Prescribed Protocols
Enrolled programs see the drill protocols their PT team actually prescribed for their teams — the app is the delivery channel for real clinical programming.
Daily Check-Ins
Teams log completion daily, so the PTs running the program can see adherence instead of guessing at it.
Two Brands, One System
PlayProtocol covers four sports; LAXProtocol goes deep on lacrosse under its own store identity. Same backend, same pipeline, separate content and branding.
Honest Paywall
Pro content is withheld at the server, not hidden in the client — entitlements are verified against Apple and Google receipt APIs before a single locked byte is signed for delivery.
How it's built.
Four native clients — two apps × two platforms — collapse into one Go backend, one SQLite database, and one content pipeline. Each client is native: SwiftUI on iOS, Kotlin / Jetpack Compose on Android, sharing the same API. Drill video lives in S3-compatible object storage and is served through time-limited signed URLs, minted only after the server has decided what that caller is entitled to see.
The paywall decision is made once, server-side, per catalogue request: the client sends its store receipt, the server verifies it against Apple's and Google's APIs, and locked content is simply absent from the response — no signed URL is ever minted for a tier the caller hasn't bought. A client bug can't leak what the client never received.
Tech.
iOS Clients
- SwiftUI, native throughout
- StoreKit in-app purchase
- Projects generated with
xcodegen - TestFlight internal + external beta lanes
Android Clients
- Kotlin / Jetpack Compose, Material 3
- Play Billing with server verification
- Signed AAB releases across four Play tracks
Backend
- Go with
chirouting + per-route rate limits - Embedded SQLite (pure-Go driver, no CGO)
- JWT auth on the shared platform core
- S3-compatible blob store, signed-URL delivery
Shipping Discipline
- Release gates that inspect the built artifact — the signed bundle's own manifest and bytes — not the intent
- Store copy checked against the served catalogue, so marketing claims can't drift from the product
- Static marketing site with per-deploy live verification
The parts worth writing down.
Entitlements are a server fact, not a client flag
Both stores' purchases funnel into one server-side entitlement check — Apple receipts and Play purchase tokens verified against the vendors' APIs, then the catalogue response is built from what the caller is entitled to. The client renders what it's given; it never decides.
One pipeline, two brands
Drill content is ingested, tiered, and served by a single pipeline keyed per app and per sport. Launching LAXProtocol was a content and branding exercise, not a second codebase — the marginal cost of the next branded vertical is close to zero.
Verify the artifact, not the commit
The release lane extracts the actual signed bundle and asserts what's in it — the billing permission in the merged manifest, the corrected copy in the compiled bytes — before anything is promoted. A green build proves the repo; only the artifact proves the release.
Truth-checked marketing
The marketing site's claims — drill counts, what's free, what's enrolled-only — are checked against the live catalogue as part of deploy. If the product changes, the copy fails the gate until it's true again.