John Coleman

Family information platform. A private, shareable record of everything a family needs when someone is sick, incapacitated, or gone: medical history, finances, home details, estate documents, wishes. Flask web application and native iOS app (in the App Store). I own all technical work: architecture, backend, mobile, infrastructure, security, and product design. Currently launched with paying users.

The design constraint. The users are non-technical, often elderly, and frequently under stress on the day they need this most. The data is the most sensitive a family has. Standard practice resolves that tension by charging for security in usability. I refused that trade on every decision:

• No passwords anywhere in the system. One-time email codes through Auth0. I chose this over password-plus-MFA deliberately: MFA exists to prop up the password, and removing the password removes what MFA was compensating for. A database leak exposes no credentials.
• Deny-first device trust. An unrecognized device gets zero access and must be approved from a device the user already holds. Devices are keyed by a private random value rather than browser fingerprinting, so privacy settings and cleared cookies don't break the user's own account.
• Account recovery without backup codes or security questions. Recovery escalates through progressively harder-to-fake channels, ending in human verification that reads only non-sensitive account metadata. A human check cannot be run against ten thousand accounts the way an automated reset form can.
• Application-level encryption on sensitive fields, on top of transport and at-rest encryption. Keys held separately from the database they protect. Uploaded files encrypted before reaching storage. Internal tooling structurally cannot decrypt case content, so support and analytics operate on account metadata only.
• No AI touches user content, by policy and by architecture. Search is plain word matching on our own server. Prescription label OCR runs on-device.

The permission system, which was the hardest thing to get right. Per-person, per-category, per-action access across nine content categories, with view and edit decided independently for every person and every category. Deny by default: an unauthorized request returns nothing, not a preview. Delegation is explicitly non-transitive. A person granted access cannot re-share it, a manager cannot appoint another manager, there is exactly one manager seat, and owner access cannot be revoked by anyone. Invitations stay mutable and revocable until the moment they're accepted. The whole configuration reads back to the user as an ordinary English sentence rather than a grid of checkboxes.

Security as an operating practice, not a claim. gitleaks, pip-audit, and bandit on every commit. OWASP ZAP before every release. Weekly Dependabot across Python, JavaScript, and build tooling. Cloudflare at the edge. Daily encrypted database backups to independent object storage, written by an account with no delete permission, which is the control that actually survives a ransomware event. Public quarterly security reporting committed to, first report due Q4 2026.

Stack: Python, Flask, PostgreSQL, Auth0, native iOS (Face ID, Keychain), DigitalOcean App Platform, Cloudflare.

Video-first mobile vehicle inspection service for used car buyers, built as a technology business operating a service business. Profitable since January 2026.

I built the entire platform: Python Flask backend replacing a stack of Square and Acuity workflows, Android application, video processing and transcription pipeline, automated report generation, and booking widget integration. Architected for territory operators from the start, so a second market can run on the same system without me in it.

Prevented a $100K fraud attempt on a single inspection. The recurring theme in customer reviews is that it was the best money they've spent.

The open question I'm still running: high-trust services have low repeat revenue by nature. Whether this scales through partners or stays owner-operated is a live test, and I built the platform to support either answer rather than committing before the data was in.

AI career intelligence tools, built to test one product thesis two ways.

ReApply is the full platform: a nine-engine AI pipeline covering gap analysis, ATS optimization, company research, and interview preparation. Flask, PostgreSQL, Redis, Stripe. FitCheck is the opposite bet: a Chrome extension that returns a job fit score in fifteen seconds, now expanding to generate application materials in place on job listings.

Concept to production in six weeks. Roughly 300 users, averaging 15 signups per week and accelerating, growing organically with no paid acquisition. Credit-based rather than subscription, with margins engineered through prompt optimization specifically to fund a generous free tier. Paying users today, meaningful revenue projected next year.

Technical partner for founders, small businesses, and nonprofits. 100 production websites delivered across small business, nonprofit, and healthcare.

Relaunched in 2025 around three lines: fast MVP development for non-technical founders, modern static sites built in Astro, and migration services for businesses leaving legacy WordPress and Divi installations. Early signal on the migration and static site work is good and it's where I'm currently focused commercially.

A consultancy that applied e-commerce practice to charitable giving. Running Cobalt Cable taught me how to measure and improve a buying journey, and a donation is a purchase with a different motive behind it.

I mapped each client's donor journey and built repeatable frameworks for optimizing it, so the method carried from one organization to the next instead of being reinvented each time. The aim was to move donors from one-off transactions to an ongoing relationship with the cause.

Client digital donations rose by up to 600%.

Managed IT and security services for nonprofits, small businesses, and healthcare clients. Network administration, email and enterprise integration, 24/7 monitoring, and cybersecurity training programs built for nonprofit staff. Ten years of running production systems for organizations handling regulated data, with the client relationships and compliance obligations that come with it.

Taught web development and design at the Airway Heights Corrections Center, a minimum security prison, to more than 50 students a semester. The average student had about an eighth grade education, and some had never seen the internet. The course ran from visual and graphic design through web design to building working sites.

I also worked with students one on one on the skills of independent freelance work: taking someone else's creative problem, coming up with a solution, and pitching it. The point was to leave them with a creative, technical trade they could run for themselves after release.

It is still the hardest audience I have explained technology to.

Contract technical director on a $10 million a year website project for the National Center for Telehealth and Technology, built to help returning veterans. I led a team of developers, designers and usability specialists, and recruited and hired the UX and web designers who went on to steer the work.

When I arrived, outside developers were taking weeks to produce things that could be mocked up in a day or two. I started building functional mockups and prototypes myself on one to two day cycles, and then made that the process: wireframes, rapid prototyping, user testing to check ideas before anyone built them, web analytics, Section 508 accessibility validation, and application frameworks in place of hand-built interfaces.

The larger change was getting the project to put usability at the center of its decisions. Interface choices started being tested with users instead of settled in meetings.

This is the closest thing on this page to walking into an established organization, finding where the process is stuck, and building the team and standards that unstick it.

Direct-to-consumer audio cable company built against an industry running 10x markups and 12% return rates. Scaled from a basement to $5M in revenue and 50,000 units sold, at 7% conversion against an industry norm of 2% and under 4% returns. Reduced manufacturing costs 35% while improving product quality.

Profitable in the first year and cash-flow positive the whole way through, with no outside money. I designed the entire product line, including custom versions for professional and military clients, and our own designs held 50% gross margins in a commoditized market. I negotiated the 35% cost reduction directly with overseas manufacturers.

Every sale happened online, so the website was the business. I built several generations of the store, each one measured against the last. A single redesign raised conversion 80% and nearly doubled average order value. I wrote all the site and advertising copy, and systematic testing kept advertising returning $5 for every $1 spent.

Hired and led a cross-functional team across Spokane, WA and Austin, TX covering engineering, customer service, marketing, fulfillment and operations, creating 10+ full-time local jobs. Profitable exit after seven bootstrapped years.