Built on Cloudflare: Pages for the site, D1 for the database, KV for fast key lookups. Serverless and globally distributed, which is why it's quick from anywhere and why the hosting bill stays inside a free tier at small-business volumes.
Lightweight by choice: no heavy front-end framework, so it loads fast on a phone. Security-hardened throughout: anti-bot screening, rate limiting, careful handling of customer data, secrets kept server-side.
Photos are handled unusually, and it's worth explaining. When a customer attaches a picture, it goes straight to your Telegram with the booking alert. Your database stores only Telegram's reference to that file, not the image itself, and the admin panel fetches it back through your own server so the bot token never reaches the browser.
That keeps image storage at exactly zero cost, and there are trade-offs you should know about rather than discover later: the file lives on Telegram's servers rather than in your own account, retrieval depends on Telegram staying reachable, and the image is recompressed, so it's fine for "show me the machine" but it isn't the pristine original. If you need originals kept in storage you own (retention guarantees, multiple photos per job, a gallery, archiving), Cloudflare R2 is the clean upgrade and it has a generous free tier of its own. It isn't wired in today, and we'd quote it rather than imply it's already there.
Everything runs in your own accounts: your Cloudflare, your Google, your Anthropic, your domain. Your customer data sits in your database. That's not a policy we promise to keep. It's just where the software lives.