Cloudless Sun & Skin Studio

The problem

A treatment studio's website is a diary with photographs attached. The hard part is not the photographs — it is that two people must never be able to take the same slot, and that a studio cannot lose an afternoon to a form that emailed itself into a spam folder.

What we built

• A four-step booking flow — treatment, day, time, details — with availability computed on the server and the slot re-checked immediately before the write
• Duration and price read from the catalogue rather than from the request, so a tampered form cannot buy a two-hour appointment at the price of fifteen minutes
• A Postgres schema whose exclusion constraint refuses an overlap even when two requests arrive at once — the database enforces it, not the application
• Six treatment pages generated from one catalogue, plus eight written by hand, including a price list published in full
• A honeypot, a minimum fill time and per-IP rate limiting on the booking action, with the IP only ever stored as a hash

Where it landed

The demo for any business that sells time rather than things. It is also the most careful build in the set about saying what it is: the disclosure appears on the footer, the contact page and the portal, and the portal states plainly that appointments live in memory rather than a database, because a booking form that quietly goes nowhere is worse than no booking form.