The blog
Notes on building websites, design, and the brands I love working with.
Why I Stopped Pursuing a Career in Games
Leaving the games industry gave me room to build custom AI solutions, teach more than 50 students and keep making games on my own terms.
Okay, But Actually… Before You Launch That Vibe-Coded App
Vibe coding can make a useful prototype. Once strangers can enter real details, pay or rely on the result, the owner has launched business software and has to deal with whatever goes wrong.
Okay, But Actually… “US Servers” Is Not a Data Transfer Review
SCCs are one tool for some international data transfers. Before choosing the paperwork, follow the customer information through every provider that can receive or access it.
Okay, But Actually… An AI Subscription Is Not a Development Process
AI can help a developer build faster. It cannot replace understanding the business, testing the awkward cases or taking responsibility for what reaches the client.
Okay, But Actually… A Breach Does Not Mean Calling Every Government Agency
A breach may need to be reported, but not to every regulator on Earth. First establish what happened, whose information was involved and which rules actually apply.
Okay, But Actually… Owning an App Doesn't Mean Maintaining It Alone
A custom app can come with maintenance, support and a clean handover. A complicated SaaS setup can lose its specialist too—and still charge every month.
Okay, But Actually… A Log File Is Not a Breach Alarm
A commenter guessed that Pedro's software had little more than basic logging. Here's what logs can tell you, who gets an alert, and why a software subscription deserves the same questions.
Okay, But Actually… A Custom App Can Simplify Security
GoHighLevel can handle a booking. What happens to the measurements, photos and staff access during the rest of the job? A focused custom app may make that work easier to secure.
Okay, But Actually… Custom Software Can Be the Cheaper Choice
The subscription price is only part of what a business spends on software. A focused custom app can also save the staff time spent working around tools that do not quite fit.
Okay, But Actually… “You’ll Get Sued” Is Not Useful Security Advice
Someone predicted lawsuits and a “world of pain” for a custom app nobody had described. What would need to happen for that warning to be useful?
Okay, But Actually… Insurance Is Not a Custom Software Tax
A custom app does not automatically require a pile of insurance policies. A GoHighLevel subscription does not make a business's insurance decisions disappear.
Okay, But Actually… A DPA Is Not a Magic Spell
A DPA matters when a service handles customer information, but it may already be part of the terms the client accepted. Here is how those agreements work for a custom app, and when its developer needs one too.
Okay, But Actually… A Certification Logo Does Not Cover Your Whole Business
An ISO certificate is useful evidence about a software supplier. Before relying on it, check what was audited and what your own business is doing with customer records.
Okay, But Actually… Five Million in Revenue Is Not a Software Requirement
A company's revenue affects its budget, but choosing software still comes down to the work, the people using it, and the requirements it must meet.
Okay, But Actually… “Client Data” Is Not a Risk Category
“Client data” could mean a booking email, a door code or a client's unreleased product plans. This post follows a small home-service app to show why the contents of a field, who can see it and how long it stays matter more than the label.
Okay, But Actually… Encryption at Rest Does Not Fix a Bad Application
Someone asked whether a hypothetical business app used envelope encryption and what its blast radius was. Fair questions, once we know what the app stores. Here is what encryption at rest protects, what it cannot fix, and why a locked database can still hand information to the wrong person.
Okay, But Actually… Big Companies Build Custom Software Too
Someone asked why the world's most profitable companies don't build custom software. Walmart and JPMorganChase do. Their own explanations show how large businesses choose what to build and what to buy.
Okay, But Actually… Data Residency Is Not the Same as Data Protection
People love throwing California, Europe and Brazil into conversations about custom software before asking what the application actually does. Here is what data residency tells you, what it does not, and why buying SaaS does not make the legal questions disappear.
Okay, But Actually… Your Six-Figure Business Does Not Need Enterprise Cosplay
Apparently a small business cannot own custom software without recreating the IT department of a multinational bank. Before buying the costume, it might be worth finding out what the application actually stores.
Okay, But Actually… A Pile of Security Vocabulary Is Not a Security Review
Apparently you can review an application without knowing what it does, as long as you mention California, Brazil, envelope encryption, blast radius and lawsuits quickly enough. Here is what those terms actually mean, and what a useful security conversation sounds like.
Okay, But Actually… Custom Does Not Mean Homemade Security
Using Supabase, Stripe or managed hosting does not make a product less custom. I am much more concerned about the person who chose the whole stack because AI sounded confident and now cannot explain what any of it is doing.
Okay, But Actually… One Developer Is Not Automatically the Scary Option
An experienced solo developer should not be confused with a beginner holding an AI subscription, and a crowded agency org chart is not proof of competence.
Okay, But Actually… No, Buying SaaS Does Not Make You Safe
Buying SaaS moves some security work to the provider. It does not remove forgotten admins, shared passwords, abandoned integrations or your own questionable decisions.
Okay, But Actually… Custom Software Is Not the Problem Here
Some AI-built apps should not be anywhere near real customer data. Before hiring anyone, ask who controls access, what happens after launch, and whether the person building it can explain their own security decisions without secretly asking AI.
Why some websites feel instant (and others make you wait)
Having a fast website isn't a matter of luck. Here's what makes a site feel instant, why speed decides whether people stay, and a few things you can check on your own site.
I got the first screen back, and it humbled me
The oldest, smallest piece of the game turned out to be the hardest. It also reinforced what I already knew about AI: it can be completely thorough and completely wrong at the same time, and just as sure of itself either way.
The first five seconds: what your homepage says before anyone reads it
People decide how they feel about your website in about five seconds, before they read a word. Here's what they react to, and how to make those seconds count.
I'm rebuilding a dead game for an audience of two
The servers went dark back in 2018. All I've got left is the app file, a lot of nostalgia, and AI tools that finally make rebuilding it possible.
Why 'it works' isn't the same as 'it's done'
You can get a website on screen fast. Getting one you can trust with real users and real money is different. Here's why the order you build in matters.
The quiet design choices that make people click
A handful of well-understood design choices explain why some pages get people to act and others stall. Here's how I use them to help visitors, not trick them.
What women-led brands actually need from a website
Women-led brands don't need corporate polish. They need clarity, confidence, and a site that sounds like them. Here's what I focus on when I design for them.
Why I build from scratch instead of using templates
Templates are fine, until they aren't. Here's where they stopped working for me, why I build custom instead, and the honest cases where a template is still the right call.
Will AI replace web designers?
Will AI replace web designers? Here's the honest answer from someone who builds with AI daily. It changes the job a lot, and deletes it far less than the headlines say.
Designing for animal brands: warm, but still trustworthy
I have three Pomeranians and I've been the anxious owner picking a dog trainer at midnight. Here's what actually earns trust on an animal brand's website, from both sides of it.
What actually goes into a website (the parts you can't see)
The design you see is about half of a website. The other half is invisible to most: speed, accessibility, SEO, security, and responsiveness. Here's what really goes in.
Why I redesign brands nobody hired me for
I redesign brands that never hired me, on purpose. Here's why concept work is some of my favorite portfolio, and how I pick which brands to reimagine.
No AI slop: what I actually mean (yes, I use AI every day)
I use AI every day to build websites, and I still say no AI slop. Here's what that actually means, and why the tool was never the problem.