← Back to OrdinaryMonday

Changelog

What's new in OrdinaryMonday, release by release.

v0.7.0 — Your own OrdinaryMonday space, burst camera & 30-day sessions

Highlights

  • Organisations can now run their own private OrdinaryMonday space on its own web address, with their own colours, logo, font and landing page
  • Spaces can be invite-only: administrators send invite links, and only people holding one can register
  • Every space gets its own administrator portal: members, invitations, a moderation queue, an audit log, data export and settings
  • Space administrators can switch features on or off for everyone in their space
  • Burst camera in the iOS and Android apps: tap the shutter as often as you like — every shot lands in your photo drawer instantly, with a flash, thumbnail and counter as confirmation and no "Use photo" step
  • The buttons at the bottom of the feed are now labelled "Camera" and "Drawer"
  • You stay signed in for 30 days instead of 7, and the surprise "session expired" logouts are gone
  • Scan a QR code on the home page to get the iOS app onto your phone

Security & Privacy

  • Every space is isolated at the database level (PostgreSQL row-level security) and sign-ins are bound to the space they were issued for — a session from one space cannot reach another
  • Caches, uploaded files and rate limits are kept separate per space
  • Each space has its own audit trail of administrative actions; space-level GDPR data exports run as background jobs
  • Platform-level support access to a space is explicit, time-limited and audited
  • A background sweep reconciles orphaned uploaded images so deleted content is also erased from storage
  • Request validation is enforced uniformly on every API endpoint
  • Dependency security patches: Next.js 16.3.8 and Capacitor 8.5.2 (both critical advisories), sharp 0.35.5, brace-expansion, source-map-js, undici

Bug Fixes

  • A sign-in refresh whose response never reached your device (phone pocketed mid-request, laptop lid closed) was treated as token theft and signed you out everywhere — the server now tolerates it for the full session lifetime
  • The app retries once with a fresh session before declaring you signed out, and web tabs refresh their session when they come back into focus
  • Admin status changes now ask for confirmation first
  • Rejected cross-origin requests return a readable error instead of a bare failure

Infrastructure & Developer Experience

  • Playwright end-to-end foundation: real multi-space journeys against the real backend
  • Unit-test coverage is measured and reported in CI (report-only, no gate yet)
  • CI workflows are required-check-safe with job-level change detection; backend CI also runs on release branches
  • Database migrations 027–034 ship with this release (tenant lifecycle, tenant columns, row-level security, platform admin, tenant admin role, branding, invitations, export jobs & audit) — see docs/RUNBOOK_DEPLOY_ROLLBACK.md for the one-time RLS role cutover and the App Service JwtSettings override removal

v0.6.0 — Multi-photo posts, avatars & the photo drawer

Highlights

  • Posts can now carry up to 5 photos — swipe through them right in the feed
  • The photo drawer (iOS & Android): snap photos any time from the new bar at the bottom of your feed — they wait up to 7 days so you can post when you are ready
  • Notifications now reach your iPhone — iOS push notifications work end-to-end for the first time
  • Create a hand-drawn-style avatar instead of a profile photo — three styles (Adventurer, Lorelei, Cameo), shuffle until it feels like you
  • New members can add a photo or avatar right after signing up; everyone else gets one gentle, once-only reminder
  • A one-time "What’s new" screen introduces the important changes after each update
  • Mobile web now points you to the native apps, including the iOS Smart App Banner

Security & Privacy

  • The photo drawer is private per account: photos persist across logout, but only their owner ever sees them
  • When a post suggests someone might be struggling, they now see gentle, language-matched crisis helplines — the post itself publishes normally
  • The Child Safety Standards page and privacy policy now disclose automated content screening, matching how moderation actually works
  • Admins get a one-click "Needs review" queue so auto-flagged posts are seen promptly
  • Your settings are now included in the GDPR data export
  • Dependency security patches (nanoid, brace-expansion)

Bug Fixes

  • The composer toolbar could push the Post button off-screen on phones
  • Opening a composer menu with an empty draft no longer collapses the composer

Infrastructure & Developer Experience

  • Safety operations runbook: recorded response-time expectations and helpline data ownership (docs/SAFETY_OPERATIONS.md)
  • CI now installs cleanly under npm 12; lockfile regeneration procedure documented

v0.5.0 — Groups, invitations & automated content moderation

Highlights

  • Groups are here — create a group, discover public ones via search, and share posts in a members-only group feed
  • Invite people to your group, or request to join; invitations can be accepted or declined right from the notification
  • Group roles (Owner, Administrator, User) with member management and ownership transfer
  • Make your group your own: custom colors and logo, per-group display names, categories, and optional anonymous posting
  • Pinned posts and announcements in groups — announcements notify all members
  • Tag your posts and groups, browse everything behind a tag, and filter group discovery by tag
  • Moderation tools for group owners and admins: hide posts, mute members, and review a moderation log

Security & Privacy

  • Automated content screening of new posts — clearly harmful content is blocked at posting time and the author is told why
  • Your GDPR data export is now complete: it includes group memberships, registered devices, and your profile picture, and anonymous group posts stay anonymous in group-level exports
  • Deleting your account or a photo post now also erases the image from storage
  • Registration now records your consent to the Terms & Privacy Policy (GDPR Article 7)
  • Deleting your account no longer deletes groups you created — ownership passes to another member instead (a group with no other members is closed)
  • Group owners get a full audit log and a group-level GDPR data export

Bug Fixes

  • Push notifications fixed on Android (no more "year 1" timestamps) and device registration made more reliable on iOS and Android
  • The "Hang out" button works again after unfriending or declining, and re-sending a request no longer fails
  • Fixed a reload loop when switching languages
  • Invited users can now view a private group before accepting, and invitation buttons disappear once resolved

Infrastructure & Developer Experience

  • Cache layer hardened for clustered Redis, and cache failures are now logged instead of silently ignored
  • Database migrations now run through a tracked, idempotent migration runner
  • A CI gate keeps the published API contract in sync with the backend

v0.4.0 — Connections-first feed, post audience controls & session security

Highlights

  • Your feed now opens in Connections mode by default, with a friendly “you're all caught up” note at the end instead of an endless wall
  • Choose a default audience for your posts (Everyone or Connections) — a one-time prompt on your first post, changeable anytime in Settings
  • Change who can see a post after publishing, from the post menu
  • Tap a photo in a post to view it full-screen
  • Deleting a post now removes it from your feed instantly

Security & Privacy

  • Session tokens hardened: refresh tokens are stored hashed, rotate safely on unstable connections, and confirmed token theft now revokes the whole session
  • More reliable sign-in on the mobile apps — token storage and refresh are now atomic and race-free, so you stay logged in instead of being bounced to the login screen
  • New public Child Safety Standards page, meeting Google Play child-safety policy requirements

Bug Fixes

  • Fixed the All/Connections feed showing the wrong posts in some cases and occasionally skipping posts while scrolling
  • The home page on phones now uses a compact menu instead of a crowded top bar, and gained an "Already have an account? Log in" link
  • The home and login pages now follow your in-app language choice in the mobile apps, and signup legal links no longer restart the app
  • Corrected the post edit window stated in the Terms & Conditions

Infrastructure & Developer Experience

  • Backend build and full test suite now run on every pull request, with supply-chain security gates
  • Safer production deploys: automated test and health gates with slot swap and a documented rollback path
  • App Store and Play Store versions now derive automatically from release tags

v0.3.1 — Delete your own posts, security hardening & audit fixes

Highlights

  • Delete your own posts — from the post menu, with a confirmation step
  • Friendly error screens with a retry button — no more unrecoverable blank screen if something goes wrong, especially in the mobile apps

Security & Privacy

  • Full dependency audit: all known vulnerable packages resolved, with automated weekly dependency updates and a CI gate to keep it that way
  • Security headers and a strict Content-Security-Policy on the web app
  • Verification and password-reset codes now come from a cryptographically secure generator
  • Credentials and verification codes are redacted before request logging
  • Rate limiting now applies per client instead of one shared global bucket
  • Deleted and hidden posts no longer appear in user post lists, reply counts, or notification previews
  • Secret scanning added to the build pipeline

Bug Fixes

  • Clearer error messages — a friendly rate-limit notice in your language and a consistent error format across the API
  • Verification and password-reset emails are sent in the background, so signup no longer waits on the mail server

Infrastructure & Developer Experience

  • API versioning (/api/v1) with client version reporting, so future API changes cannot break older app releases
  • Application Insights telemetry, deep health checks, and request correlation IDs

v0.3.0 — Native iOS & Android apps, user blocking & connections-only feed

Highlights

  • Native mobile apps — OrdinaryMonday now runs as a native iOS and Android app built from the same codebase, in beta via TestFlight and Play internal testing
  • Installable web app (PWA) with an install prompt and offline awareness
  • Push notifications on iOS and Android
  • Block users — block from any post or profile; their content disappears from your feed, search, and profiles (and yours from theirs), with a Blocked list under Connections to unblock
  • Connections-only feed mode — switch the feed between All and Connections; a short connections feed is topped up with clearly marked suggested posts
  • Native camera integration for photo posts on mobile
  • Change your username and password from the settings page
  • Public changelog page — what's new, release by release

Security & Privacy

  • Blocking is silent and bidirectional — blocked users generate no notifications in either direction
  • API access for the native apps restricted to explicit app origins
  • Azure Key Vault secrets loaded in every environment

Bug Fixes

  • Fixed top-of-screen UI hiding behind the iOS status bar and Dynamic Island, and bottom UI behind the home indicator
  • Fixed the iOS app failing to reach the API ("Unable to connect")
  • Replaced the placeholder splash screen with OrdinaryMonday branding and re-padded the app icons
  • Fixed declining incoming connection requests
  • Fixed admin user list pagination skipping entries across timezones
  • Improved Norwegian translations

Infrastructure & Developer Experience

  • Automated iOS TestFlight and Android Play Store release pipelines triggered by version tags
  • Redis caching layer for feeds and hot lookups
  • Frontend unit and component testing with Vitest and React Testing Library
  • GitHub releases generated automatically from this changelog

v0.2.0 — Multi-language, email verification, profile photos & production launch

Highlights

  • Multi-language support — English, German, Norwegian Bokmål, and French
  • Email verification & password reset with 6-digit codes
  • Profile photos — upload, display, and management across all post and user views
  • Age verification — 18+ enforcement with birthdate validation on registration
  • Legal compliance — Terms & Conditions, Privacy Policy, and Imprint pages with explicit consent on signup
  • Post editing — edit your own posts within 15 minutes of posting
  • Admin audit logs — per-user audit log viewer in the admin dashboard
  • Production deployment — live at ordinarymonday.com

Security & Privacy

  • Email addresses removed from user search results
  • Logout now revokes tokens on the server
  • Secrets managed via Azure Key Vault
  • Permanent redirect from www.ordinarymonday.com to ordinarymonday.com

Bug Fixes

  • Fixed infinite reload loop on Chrome when switching language
  • Fixed language selection not working on Safari iOS
  • Fixed photo duplication issue
  • Fixed text overflow in notifications
  • Fixed mobile login page UI collapse

Infrastructure & Developer Experience

  • Docker-based local development environment
  • Automated test environment setup
  • Refactored API endpoint layer with shared error handling
  • Expanded API documentation