Make it

  9 min read

Mobile app security best practices: a checklist for app owners

The OWASP Mobile Application Security project covers technical areas such as storage, cryptography, authentication, network communication and resistance to reverse engineering. App owners usually work at another level: access, enabled features, connected services and change management.Security, privacy and compliance overlap, but they answer different questions:AreaMain questionSecurityHow are accounts, data, services and access protected from misuse?PrivacyWhat personal data is used, why is it used and what choices do people have?ComplianceWhich legal, contractual and store rules apply to this app?An app can describe its data practices accurately and still grant access too broadly. Store approval is not a security certificate. This guide provides an operational baseline; sensitive data, regulated processes or substantial custom code may require a qualified assessment.

  6 min read

Who renews your PWA's SSL certificate?

SSL certificates expire by design — and faster every year. Why the web wants it that way, what keeping that calendar takes, and who keeps it for your PWA.

  9 min read

Mobile app personalization: tailor content, access and notifications

A teacher looks for staff documents, a parent checks the calendar and a student saves an assignment guide. Sending all three people every notice would be easy, but progressively less useful. The relevant question is not how much data you can collect. It is which part of the experience should genuinely change:some sections are shared, while others depend on the user's role;notifications go only to the audience concerned;each message arrives at an appropriate time and opens a useful destination;users choose which recurring updates and content they want to keep.That is practical mobile app personalization. No opaque scoring model is required.

  7 min read

Prompt teardown: the same word, two memories

Two prompts ask for the same thing: remember. One gets a personal memory, the other a memory shared by the whole studio. Here are the words that decided.

  10 min read

Location-based marketing for mobile apps: geofencing, beacons and better notifications

“You’re near our store. Come and visit us!”This message knows where someone is, but not why the interruption matters. It offers no specific value or next step. At its best, location-based marketing uses proximity as context, not as the entire strategy.Now compare it with:“Your order is ready. You’re close to the pickup point—show this message at the counter.”The second message connects a known person, a relevant place, the right moment and an immediate action. That same logic can guide a museum visit, an event alert or a local service—not only a promotion.

  10 min read

Mobile app analytics: what to measure for better decisions

The download count often becomes the headline number after launch. But it records acquisition, not the full relationship between a user and your app.A person can install an app and never open it again. Another can return every morning, read several articles and respond to notifications. Counting both as one download hides the difference that matters.The same caution applies to every isolated metric. More page views can indicate useful exploration or confusing navigation. A longer session can signal deep listening or friction in a task that should take seconds. Ask what behavior produced the number and what decision it can inform.

  9 min read

Mobile App Accessibility: How to Make Your App More Accessible

You cannot prove that an app is accessible from a preview or a contrast score. You can, however, remove a surprising number of barriers before formal testing begins.Mobile app accessibility extends well beyond color contrast. Typography, spacing, navigation, touch targets, labels, motion, media and assistive-technology behavior all affect whether someone can complete a task.WCAG is written for web content. The W3C's WCAG2Mobile guidance explains how WCAG 2.2 Level A and AA criteria can be applied to native, web and hybrid mobile apps. That document is informative rather than a separate normative mobile standard, and it is not sufficient on its own to establish that an app is accessible.This checklist separates what can be configured centrally from what still has to be verified in the published product:Accessibility areaFirst checkWhat to configure or testColor contrastText, backgrounds, controls and statesSet global colors and verify each contrast pairTypography and spacingReadable defaults, wrapping and enlargementConfigure the global type hierarchy and marginsNavigationClear destinations and labelsConfigure the app structure, labels and navigationTouch targetsControls are easy to operateVerify the generated app on devicesScreen readersNames, roles, states and focus orderTest the generated iOS and Android appsMotionEffects remain useful and optionalConfigure animations and haptics, then test system preferencesMediaCaptions, transcripts and text alternativesAdd alternatives during content creation and editorial reviewPWA interactionKeyboard, zoom, focus and responsive layoutsTest the published PWA in browsers

  9 min read

Mobile app privacy checklist: what to prepare before submission

Imagine a fitness coach app with member accounts, optional location, an email form and analytics. That is already four separate data paths. Change one feature and the privacy picture changes with it.The difficult part is not producing one legal page. It is making three surfaces describe the same app:SurfaceWhat it must reflectThe app itselfThe data, permissions and third-party services actually usedThe privacy policyWhat is collected, why, by whom, for how long and what users can do about itThe store declarationsApple App Privacy and Google Play Data safety answers based on the current appIf one surface says “no location data” while the submitted app requests location access, the problem is inconsistency.A large part of privacy preparation is a consistency exercise: the app, the policy and the store listing must tell the same story. Consistency is necessary, but it does not replace compliance with the stores’ underlying privacy and user-data rules.This article helps you prepare that story. It is not legal advice; applicable requirements vary by country, audience and type of data.

  5 min read

Your app's MCP server now speaks the latest version of the protocol

Every GoodBarber app comes with its own MCP server. It is the secure doorway that lets an AI assistant, with your permission, read and manage your app: write and schedule articles, update products, check your stats, prepare push notifications. You connect the assistant once, it authenticates through OAuth, and it only ever sees your app.If you are discovering this, two good starting points: our MCP page explains how to connect an assistant to your app, and this article explains what makes an application MCP server different.

  15 min read

The production checklist AI-built apps fail (7 things that break after the demo)

The short version. An AI-built app that shines in a demo has proven it can render, not that it can run. Production is decided by seven boring things: accounts, empty states, store review, push delivery, the stack bill, the first update, and week-to-week operation. Run the seven checks below before you announce a launch date. On GoodBarber, the platform carries the first six, some pre-built, some as a service, and the seventh comes with an AI agent connection.You built an app with an AI app builder, or vibe-coded it prompt by prompt over a few evenings. It works. But look at the conditions under which it works: your phone, your Wi-Fi, your account, data you typed in yourself, a build generated an hour ago. A demo is an app tested exclusively under friendly conditions.Production ready means the opposite: the app keeps working once the friendly conditions are gone. Strangers instead of you, a reviewer instead of an audience, months instead of an afternoon.We have already written about why this gap exists: our article on the seven walls between a prototype and the stores maps the structural distance, and our piece on building an app versus running one names the work that starts after launch. Those articles end in questions worth asking yourself. This one turns the questions into experiments: seven checks, each with a concrete procedure and a pass condition you cannot argue with, all of them runnable this week. If a check feels boring, that is the point. Production is where the boring bugs live.

  3 min read

New Classic Themes to Launch Your App Faster

The hardest part of a content app is rarely the content. It is making everything look intentional, screen after screen, when design is not your job. A theme solves that by handing you a complete visual direction: colors, typography, imagery style, and layout already working together. You bring your content and your brand; the theme brings the polish. And because every theme runs on Smart Design, the result stays consistent however far you customize it.

  8 min read

Will your app still work in three years?

What happens to an app in the three years after launch: what moves around it, what the platform absorbs on your behalf, and the short list of what stays in your name.

  13 min read

GoodBarber vs Replit

Replit has been building browser-based development tools since 2016. In early 2026 it added a mobile offer, under a page titled "Idea to Mobile App in Minutes" — which puts it, for the first time, on the same ground as an app builder.So we ran our standard brief through it — AURORA, the same luxury travel guide app we build on every tool in this series. Not a feature checklist: an actual app that has to reach the stores, get updated every week, and be operated by someone who does not write code.What comes out of Replit is real. It is also, unmistakably, a codebase — a React Native project, a metered cloud, and a development console. That is the whole comparison in one sentence: Replit answers you in plain language, then hands you something that behaves like an engineering project. Whether that is a gift or a problem depends entirely on who is going to run the app next Tuesday.