Source

# Feedback

Feedback is a free feedback board with voting, a public roadmap and a changelog, and a free alternative to Canny, Frill, Featurebase and UserVoice. It is an OpenApp in the OpenApps free apps store (https://openapps.free/), owned by the OpenApps team.

## What it promises

- Free, with no limit on boards, ideas, votes, comments or team members, no ads and no paid tier. Never add a cap, an upsell or tracking. The size limits (a 140 character title, 5,000 characters of details, 20 tags) are sizes, not upgrade levers.
- No sign-up. Every visitor is a guest account created in the browser. Email sign-in (Bounded hosted login) is optional and only keeps a person's votes on every device.
- One vote per person per idea: the vote record's path is the person's id, and the idea's count moves by exactly one in the same batch. Say plainly that a guest can vote again from another browser.
- Anyone with a board's link can read it, post, vote and comment. The random board id is the link's secret. Boards are unlisted: nothing lists them.
- Only owners set statuses, merge, pin, hide, edit, delete, edit tags and write the changelog. The creator is an owner; anyone who opens the admin link (`/b/<id>/admin#k=<key>`) becomes one. The key travels in the URL fragment, so servers never see it.
- Hidden ideas and their comments are seen only by owners and the idea's author, in the app and in the API.
- AI assistants can do what a person can, except vote, through the public API (`functions/api.ts`), documented in `public/llms.txt` and `public/openapi.json`. Keep both true whenever the API changes.
- Be honest about limits: no integrations, no email notifications, no sign-in with the customer's own app accounts, no custom domain, no private boards beyond the unlisted link, and no iframe embedding on other sites (the hosting sends frame-ancestors limited to OpenApps and Bounded hosts).

## How it is built

- `index.html` is the static landing page that search engines and AI crawlers read. Keep its copy, comparison (figures from `docs/research/wave4-pricing.md` in the store repo, hedged "as reported in 2026", with the "Updated" month), FAQ and JSON-LD (SoftwareApplication with dateModified, BreadcrumbList, FAQPage matching the visible FAQ) in sync with what the app does. `public/index.md` is the same page in Markdown, `public/llms.txt` the guide for assistants, `public/openapi.json` the API description (linked as rel service-desc).
- `src/` is the React app. `/` mounts the board maker (`Create.tsx`) and "Your boards" (`YourBoards.tsx`, from localStorage) into the landing. `/b/<id>` hides the landing and shows the board (`Board.tsx`): ideas (`Ideas.tsx`), `/roadmap` (`Roadmap.tsx`), `/changelog` (`Changelog.tsx`), `/p/<postId>` (`Post.tsx`), and `/embed`, the compact board the website button opens in a small window. Owner sheets live in `Admin.tsx`.
- `functions/lib/feedback.ts` holds the logic shared by the app and the API: statuses, tags, sorting (Top, Trending, New), search and duplicate suggestions. `functions/lib/config.ts` holds the app id and the site URL used in links.
- `policy.json` holds the data rules (Pattern B in the store's app guide, with the key-exists guard on claims):
  - `boards/<id>` with `joins`, `owners`, `boardkeys` (readable only by the public API function, which checks a presented key before any owner action) and `boardclaims`.
  - `boards/<id>/posts/<postId>`: anyone joined creates one with status new and their own vote in the same batch. Non-owners may only move `votes` by one with their vote record, or `comments` by one with a new comment named in `lastComment`; every other field must stay the same.
  - `boards/<id>/posts/<postId>/votes/<userId>` plus the mirror `boards/<id>/people/<userId>/votes/<postId>`, so a device lists its own votes in one read. Only the voter and the owners can read a vote record; everyone else sees the count on the post. Owners may create votes on another idea only for people who voted on the idea being merged (`from`).
  - `boards/<id>/posts/<postId>/comments/<commentId>` (`team` only for owners; readable only by whoever can read the post) and `boards/<id>/changelog/<entryId>` (owners only).
- Signing in makes a new account, so before leaving for sign-in the guest takes its votes off the boards this browser opened and notes them; whoever comes back puts them back (`src/lib/votes.ts`).
- Every API caller shares one public principal, which becomes an owner of every board it was shown a key for. So owner routes always check the key, and reads leave hidden ideas out unless the key comes with the request.
- `policy-tests/` covers every rule that guards boards, claims, votes, comments, statuses, merging and the changelog. Run `bounded tests run` after any policy change. The sandbox cannot batch a delete with a write, so the unvote and comment-delete batches are checked in the running app.

## Working on it

Changes ship through previews and releases as your runtime instructions describe; the app is an OpenApp, so nobody deploys it directly.

```bash
npm install
npm run build        # typecheck + build to dist/
npm run preview      # http://localhost:4344
```

Check a change by making a board, posting from a second browser, voting and taking a vote back in both, commenting, moving an idea across the roadmap, merging a duplicate that both browsers voted for (the count must not double), writing a changelog entry that links an idea, signing in with email and seeing your votes come along, opening the admin link on another device, and calling every API route with curl, including a wrong owner key and the HTML form post.

## Voice

Plain words, short sentences, no jargon, no em dashes. Say what happens, not how clever it is.