Skip to content

Identity

An account in Tomoda is a single human's place on the map and in the graph. It's the anchor everything else hangs on — events, friends, chat, moments, presence — and it's intentionally easy to start, hard to spoof, and forgiving to leave.

The story

A social product gets exactly one chance to make the first thirty seconds feel respectful. We took ours seriously. There are six ways into Tomoda — email + password, Google, Apple, LINE, passkey, and OTP-gated registration — because the cost of friction at the front door is not the user we wanted. Whichever door someone walks through, the system on the other side sees the same user_id. The auth layer is a polyglot front; the rest of the app is monoglot.

We are equally serious about leaving. A delete request doesn't blow the account away — it sets a 30-day deactivation flag, revokes every session, and waits. If the user comes back inside that window, login transparently reactivates them and they pick up where they left off. After 30 days, the account is really deleted — friendships gone, direct chats hard-deleted, group-chat messages anonymised (so the surviving members still have a conversation), avatars and moment media removed from object storage, and the user row itself unscoped-deleted from Postgres. We didn't want to be a product where "delete my account" means "we'll get back to you in six weeks." It means now, with a grace window.

The third leg of the stool is device awareness. A single device can sign up at most three accounts in any rolling 30-day window, and every active session is visible to the user on their security screen with the device, IP, and last-active time. We don't show this to look secure; we show it because location-aware social products are exactly the kind of product where a compromised session matters.

What we're optimising for

  • Low friction at the front door. Six sign-in methods, one identity model.
  • Verified email at signup. OTP gates registration so the email is real before the row exists.
  • Real deletion with a real grace window. 30 days is long enough to un-rage-quit; not so long that "delete" feels like a lie.
  • Visible sessions. The user sees their devices and can revoke any one.
  • Sensible defaults. Display name has a cooldown; usernames are unique; avatars have a reasonable size cap; refresh tokens live 7 days on web and 30 days on native (because re-logging-in on a phone is more annoying than on a browser).
  • Hostile to abuse, friendly to humans. Device-fingerprint signup caps, disposable-email rejection, an under-18 block — but no aggressive fingerprinting or behavioural scoring on top of it.

What identity is not

  • It is not a real-name verification system. Display name and username are user-chosen; the only identity we verify is the email at sign-up and the payment method at upgrade time.
  • It is not a creator identity. There is no "verified" badge, no follower count, no @-mention surface beyond chat.
  • It is not Single Sign-On for anything else. Tomoda is the relying party, never the identity provider.

See also