G2M
Gym management SaaS with a web app, a Flutter app and subscription billing
A multi-tenant platform for gym owners covering members, coaches, attendance, class packs, payments and reminders. It runs on web and mobile and is sold on monthly plans.
- Client
- GOFTUS
- Role
- Product engineer: backend, web, mobile, billing
- Year
- 2026
- Stack
- FastAPI, SQLAlchemy (async), Alembic, React
01The numbers
02The problem
Small gyms run on notebooks and WhatsApp. Owners lose track of who paid, who stopped coming and whose class pack is used up, and most gym software is priced and designed for chains.
03What I built
A FastAPI backend where every query is isolated by gym and every delete is soft. The same API serves a React web app, a Flutter mobile app and the marketing site, and Google sign-in works on all three.
Subscriptions run through Dodo Payments, with three plans by client count. Webhooks are verified with HMAC-SHA256 and rejected on mismatch. A class pack creates its payment automatically when attendance reaches the threshold, and reminders go out by email, in bulk or one at a time.
Before launch I ran a security pass. It closed an OAuth bypass, locked down the billing routes, and added a startup guard for the JWT secret, rate limiting, CSP and HSTS headers, CSV formula-injection escaping and mass-assignment whitelists.
04Architecture
05Engineering notes
- A superuser console for support across tenants.
- Privacy, terms and refund pages written for payment-gateway approval.
- About 18 mobile screens, with secure token storage.
- Dependencies upgraded past known CVEs as part of the hardening pass.
06Stack
