STEMQuiz

Cross-platform (iOS / Android / web) app for timed, competitive quizzing across Science, Technology, Engineering, and Math — ~33.5k lines of TypeScript across a React Native client and an Express backend.

Built a server-authoritative tier system (Guest / Free / Premium) enforced entirely server-side, not on client trust. Guests get one quiz per subject for life (permanent DB lock); Free users get one quiz per subject per rolling 24h and must hit ≥70% accuracy to unlock the next level; Premium is unlimited — each gated path returns a distinct 403 code (GUEST_LIMIT, LOCKED_24H, LEVEL_LOCKED…).

Engineered anti-fraud billing reconciliation: resolveUserTier() cross-checks the JWT tier against the DB on every request, and on mismatch sends a refresh header so the client silently self-heals its stale token (rate-limited to 1/45s). Log sentinels ([TIER_MISMATCH], [PREMIUM_BYPASS], [PREMIUM_BLOCK_ERROR]) separate auto-healed cases from real billing desyncs.

Shipped deep gamification — XP, coins, daily streaks with milestone rewards, weekly-XP leagues, coin-based lifelines (50:50, Hint, Pause, Double Attempt), 14 auto-awarded badges, exam mode, and a 3-tier explanation system gated for monetization.

Added growth/conversion engineering: a paywall A/B copy experiment (variant assigned + persisted, separate convert/view logging), free-tier interstitial + rewarded ads (premium/guest excluded), and a first-4-days retention banner loop.

Production ops: request correlation IDs, slow-request + p95 latency tracking with [DEGRADED] alerts, feature flags (EMAIL_ENABLED, FEEDBACK_ENABLED), and a 38-check regression gate that builds, boots, and tests the server before deploy.

Admin panel is a Tailwind SPA with role-based permissions, content/event/leaderboard management, a badge studio, fraud monitoring, Excel bulk question import, bulk user actions, and email-campaign sending.