ConnectedTap the label
Hold any recent iPhone or Android near the label. The chip signs this tap with a code that can’t be reused.
Every label is a door.
A secure NFC tag in every Formhouse travel product. Tap it with any phone and the product opens its own world: where it has been, what it unlocks, who you met along the way. No app to install. Every new product joins the same world, so every purchase makes the next one more valuable.
Scan it with your phone
It opens The Passport, just like tapping the label will. No app.
or open it here
How it works
Tap. Open. Belong.
The tag is sewn in at the factory. Each tap carries a one-time code from the chip, so only the real product can open its page. Copied links do nothing.
It opens instantly
A web app, verified at the network edge in milliseconds. Nothing to download, nothing to sign up for on the first tap.
It joins your world
Miles, stamps, sleep sounds, member perks and friends live in one account. Every new product adds to it.
One ecosystem
The hoodie is the first key.
Every product that follows carries its own tag and adds to the same account. Owning more makes the whole thing more useful, which is the reason to buy the next one.
Four ways to build it
Same parts. A different heart.
All four have the tap, the travel check-ins, the in-flight sounds, share cards, trading with other owners, proof of authenticity and a way to bring people back. What changes is what sits at the centre, and so why people return.
Side by side
What each one is best at.
| 01Passport | 02Kit | 03Club | 04Crew | |
|---|---|---|---|---|
| The wow | The stamp lands and you overtake a rival | The app knows which part of the trip you’re in | You hit a new tier and an early drop unlocks | One tap recruits a friend and the crew jumps a place |
| People return because | Every trip adds to its story | It’s useful on every trip | Status and early access | Friends need them to win |
| Social reach | ||||
| Repeat purchase | ||||
| Referral built in | ||||
| Ease of build |
Where we would start
The Passport as the launch spine, because a hoodie with its own story is the idea only NFC can do. Add the Crew’s group race for the EDC moment, since a table seats a group. Put the Club’s account underneath, so every future Formhouse product plugs into the same customer. The Kit’s tools ship inside all of them.
Before we build
Six things to lock early.
The tags are sewn in at the factory, so these decisions come first. The software can move fast; the label cannot change after production.
The chip
NTAG 424 DNA with secure messaging, so every tap is signed. Formhouse owns the web address on the tag and the master key, never only the supplier.
Airplane mode
iPhones don’t read NFC tags in Airplane Mode. Sleep sounds open from the Home Screen icon and download at the gate.
Prizes
Any prize needs a free way to enter, 21+ for a table, a state-by-state rules review, and the festival’s consent.
Privacy
Location only with consent, shown at city level, private by default. Leaderboards show hoodie numbers, not names.
Washing
Textile tags rated for laundering, with the supplier’s wash-test data before the order.
Placement
Where the tag sits decides how often it’s tapped. Collar label for the story, or a cuff patch so it’s easy while wearing it.
For the deep diveUnder the hoodArchitecture, data flow and how it stays reliable.
01 · The tap
How a tap is verified, in milliseconds
The chip adds an encrypted code and a counter to its web address on every tap. The edge server checks the signature and that the counter has moved forward. A copied link fails both checks.
Swipe sideways to see the whole diagram
02 · Data flow
Every event lands once, in one ledger
Taps, check-ins, trades and purchases all go through the same door. Each carries a key that makes duplicates harmless: the tag’s ID and counter, or the store’s webhook ID. The ledger is append-only, so miles and points can always be recalculated and audited.
Swipe sideways to see the whole diagram
03 · Architecture
Cloudflare at the core, partners at the edges
One vendor for everything a tap touches, running in hundreds of cities, so a traveller in Tokyo is answered from Tokyo. Partners handle what they do best: the store, email and the Wallet pass. Google’s analytics can join later, once there is data worth analysing.
Swipe sideways to see the whole diagram
04 · Robustness
Eight rules that keep it working
The tap never fails
If anything behind it is down, the edge serves a static page for the product. The customer always sees something real.
Every event can arrive twice
Webhooks and queues retry. A unique key per event makes the second copy do nothing.
The ledger only grows
Miles and points are never edited, only added to. Any total can be rebuilt from history.
Formhouse holds the keys
One master key in secrets; each tag gets its own derived key. The supplier is never the only copy.
Cheating is expensive
Signed taps, speed checks between cities, one stamp per city per day, extra weight for verified venues.
Offline first where it matters
Sounds and the latest state are cached on the phone, so the flight works with no connection.
Private by default
Location by consent, stored at city level, never shown as an address. Names never on public boards.
We hear about problems first
Error tracking and alerts from day one, and a load test of the tap before launch day.
05 · Platform
Why Cloudflare over Google Cloud
Both can be made robust. Cloudflare fits the moment that matters most, the tap, better. Google stays the natural home for analytics later.
| ChoiceCloudflare | AlternativeGoogle Cloud | |
|---|---|---|
| A tap abroad | Answered from a nearby city | Answered from one or a few chosen regions |
| First request | No cold start | Cold starts unless instances are kept warm (cost) |
| Audio downloads | No egress fees on R2 | Pay per gigabyte served |
| Moving parts | Code, database, files, queues, secrets in one place | More services to wire and watch |
| Analytics | Basic, built in | Best in class with BigQuery: add it later |
06 · Stack
What it’s built with
| Area | Technology | Use |
|---|---|---|
| Tags | NXP NTAG 424 DNA | A fresh signed code on every tap |
| Edge | Cloudflare Workers | Tap verification and the API, close to every traveller |
| Web app | Installable web app on Workers | Opens from a tap, works offline for sounds |
| Database | Cloudflare D1 | Items, owners, check-ins and the append-only ledger |
| Files | Cloudflare R2 | Audio and images, no download fees |
| Background jobs | Cloudflare Queues | Wallet updates, email, leaderboards, retried on failure |
| Keys | Workers Secrets | The master tag key; per-tag keys derived from it |
| Accounts | Shopify customer accounts or passkeys | One identity across the store and the app |
| Comeback | Apple Wallet pass, Klaviyo | Lock-screen updates and drops by email |
| Monitoring | Sentry | Errors and alerts from day one |
| Analytics (later) | Google BigQuery | Deep analysis once there is data worth it |
07 · Twelve weeks
The factory sets the clock
Weeks 1 to 2 · criticalLock what goes into the label
Web address and link format, chip type, key ownership, tag placement and wash tests. These go to the factory.
Weeks 3 to 6The core
Tap verification, claim and account, check-ins, the ledger, Wallet pass and email capture.
Weeks 7 to 9The chosen option
Its race, club or crew logic, offline sounds, share cards, trades and resale transfer.
Weeks 10 to 12Hardening and launch
Load test the tap, alerts, prize rules and consent, then a soft launch with the first hoodies.