Security and architecture

The rails should feel invisible, but they cannot be vague.

Tooth Fairy Network is a warm family product on the surface. Under it sits a minting path, a keepsake record, app-side family data, and a Solana escrow model. This page explains the V1 architecture plainly.

Parent-controlled account

The parent or guardian controls the early account experience, sharing, and unlock path. The child sees the memory and lesson before the technical rails.

Tooth Memory keepsake

The cNFT keepsake records the tooth milestone and points to durable artwork/metadata. Personal story data can stay in the application layer where it can be presented safely.

Solana escrow

Family contributions are intended to sit in a Solana escrow flow, with the age-10 milestone as the default educational unlock target.

Supabase records

Supabase stores supporting profile, story, child, and recovery context so the product can stay understandable to parents.

Deployment gate

What must be true before the domain moves.

Production environment variables must stay complete before each deploy.

`/api/toothfairy/health` should pass before controlled user tests.

One controlled mint should be tested after every meaningful flow change.

Card gifts stay gated until provider setup, payment verification, terms, and deposit handling are tested.

Current controlled-test truth

The site can be reviewed visually now. The minting and wallet flows should stay in controlled testing while email, recovery, and card gifts are wired. The regular card-gift path is intentionally gated until the payment flow and final public terms are tested end to end.

Read parent FAQ