Publish with personalized permission-based URLs and secure domains without compromising BAU management services.
Getting Started
AI Native, Agent Secure
Sign up with Google, Shopify, or email
Add bio, photo, social links
Build your portfolio page
Personalized, private document storage
Story, music, video, game
3D, image, event, fundraising
Organize into stacks
Invitation, restricted access collaboration
Connect with classmates
Share work, give feedback
Collaborate across colleges
Supported Formats
glTF, GLB, USDZ models via model-viewer. Inline poster rendering with orbit controls.
Spotify, Apple Music, SoundCloud embeds. Native audio playback for uploaded files.
YouTube, Vimeo, native video (mp4, webm, mov). Interactive games via itch.io, Scratch, CodePen. Publish via Replit, Netlify, Vercel, Git, Cloudflare Pages.
JPEG, PNG, WebP, SVG, GIF. Cloudflare R2 storage with edge CDN delivery. Gallery views.
PDF, Word, PowerPoint uploads. Private document sharing with granular access controls.
Semantic API editor with headings, lists, quotes, links, and inline images. Markdown-friendly.
What You Can Do
Rich text editor with media embeds. Preview as a card stack before publishing. Upload and store PDFs, docs, 3D models, games, interactives, music, and media. Create your own subscription self-publish portal.
Your personalized payment portal. Secure global payments via Shopify, Stripe, PayPal, Venmo, Cash App, Ticketmaster, Kakao Pay, MPP, and agentic wallets.
Control who sees your work. Public, group-only, or private. GDPR, CASL, and PIPA compliant.
Security & Permissions
Sign in with Google, Shopify, or email. Sessions use JWE-encrypted tokens validated at the edge on every request. Idle sessions auto-expire. No passwords stored in the browser.
Every card, document, and stack has a visibility level: private, family-only, instructor, group, or public. You control who sees what. Permissions are enforced server-side, not just hidden in the UI.
Cloudflare Workers validate uploads, enforce rate limits, and sanitize responses before data reaches the backend. A public-field allowlist ensures private fields are never exposed, even if the database schema changes.
On-device translation runs through Workers AI at the edge. Your content is processed in-flight and never stored, logged, or sent to third-party model providers. No training on user data.
Every file upload is validated against magic byte signatures before storage. Declared file types must match actual content. Filenames are sanitized, paths are user-scoped, and categories are restricted to an allowlist.
Consent flows adapt to your location. GDPR cookie consent for EU, CASL express consent for Canada, PIPA protections for Korea. Consent history is auditable. You can download or delete your data at any time.
Share documents via time-limited links (1-30 days) or email invitations. Share tokens are separate from login tokens. Revoke access instantly. Track share status: pending, accepted, expired, revoked.
Per-IP rate limits are tuned per endpoint: strict limits on payment verification and uploads, higher thresholds for public embeds. Prevents abuse without blocking legitimate traffic.
CSP headers restrict scripts, frames, and connections to an explicit allowlist. Embed domains are managed via a config file, not hardcoded. Camera and microphone access are disabled by default.