Proxy-first user research
2026 · Implemented MVP · pre-production
Temptare
Making public-web research faster without pretending every target is safe
I designed and built an open-source research system that launches consent-first tests against compatible public sites, captures privacy-safe behavioral evidence, and keeps each result traceable to the event that produced it.
Quick scan
TL;DR
The shortest version: what changed, what shipped, what was verified, and where the proof stops.
Overview
Problem
Competitive studies usually require target-site instrumentation or a patchwork of survey, session, analytics, and reporting tools.
Move
Narrowed a broad proxy concept into authorized, compatibility-tested public-web research with consent, redaction, safe fallback, and source-linked evidence.
Outcome
Completed an end-to-end MVP that creates studies and one-use links, runs consented sessions, and reconstructs task outcomes, journeys, normalized heatmaps, and exports.
Scope
Independent product strategy, UX architecture, full-stack implementation, proxy security, event analytics, data-platform design, and release verification.
Proof
- Browser proof
- End-to-end MVPA local browser run completed study creation, consent, proxy capture, task completion, and evidence review.
- Captured evidence
- 20-event journeyThe verified fixture produced a source-linked task result and four normalized heatmap points.
- Verification
- 126 testsThe implementation journal records 126 tests and all eight production builds passing at the MVP checkpoint.
- Privacy check
- Raw input excludedThe verified synthetic email was stored only as redaction metadata, not as captured text.
01 · Context
The opportunity was a faster path from study idea to observable behavior.
Research teams often assemble participant links, surveys, interaction capture, analysis, and reports across separate systems. Studying a public product flow adds another dependency: the target normally has to install an SDK or expose a prototype the researcher controls.
Temptare began as a proxy-first alternative. A researcher would define a task against a public URL, share one link, and review what the participant did alongside what they reported—without modifying the target site. That promise was useful, but the browser made it impossible to offer honestly without a narrower boundary.
02 · The decision
Turn compatibility and authorization into product states, not fine print.
Define the study. Validate the target. Obtain consent. Capture only what the study permits.
The original idea implied that a proxy could test any URL. Source review and browser research showed otherwise: authentication, cookies, CSP, redirects, WebSockets, service workers, storage, and origin assumptions all make compatibility target-dependent.
I reframed the MVP around authorized public-web flows that pass a compatibility check. The researcher declares the target policy before recruitment, the participant sees disclosure before any target content loads, and unsupported experiences move to an explained manual flow instead of failing invisibly.
Engineering noteThe proxy fails closed around server-authoritative context.
A participant receives opaque credentials rather than target policy or bridge secrets. The Worker resolves session context through an internal API before proxying a target, then revalidates redirects and constrains any security-header rewriting to owner-authorized studies.
- Participant links are expiring and revocable; one-use redemption is protected by a row lock.
- The proxy enforces allowed origins, redirect policy, safe headers, and a signed runtime bridge.
- Temptare does not bypass authentication, paywalls, access controls, bot protection, or private applications.
03 · What shipped
A complete study loop from invitation to traceable evidence.
Researchers can create API-backed studies, define tasks and target policy, issue opaque one-use links, inspect sessions, and open result views. Participants enter through a separate surface, review disclosure, consent, and complete the task in an instrumented proxy session or an explicit fallback mode.
The runtime batches normalized clicks, scrolls, route changes, redacted input metadata, task events, and structural snapshots. Results reconnect those events into task outcomes, an ordered journey, percent-based heatmaps, session reports, and branded CSV or PDF exports with source event references.
A later data-platform pass added a transactional outbox, partitioned raw telemetry, at-least-once stream delivery, idempotent incremental projections, Parquet object exports, ClickHouse projection, lineage, quality findings, dead letters, and bounded backfill. The original Postgres read path remains in place while that warehouse path matures.
Engineering noteTelemetry is modeled as evidence, not a screen recording.
Capture intentionally excludes raw form values and pixel-perfect video. Derived results retain source event IDs, while structural context is redacted before it leaves the browser.
- Consent scope is validated at event ingestion and withdrawn consent rejects later capture.
- Heatmap coordinates are normalized so evidence remains comparable across viewport sizes.
- The verified browser fixture stored a synthetic email only as redaction metadata with no value.
Data-platform noteDelivery guarantees stop at the edge of the evidence.
Accepted events and their outbox records are written together, then replay-safe consumers update operational and analytical projections without adding stream availability to participant-facing latency.
- PostgreSQL remains the transactional source of truth and compatibility read model.
- Redpanda delivery is at least once; consumer checkpoints and projections are idempotent.
- Container-backed warehouse and production-scale throughput validation remain open release work.
04 · Evidence
The working fixture proves the loop; it does not prove universal compatibility.
The recorded end-to-end browser run created a study and one-use link, accepted participant consent, loaded an authorized local target through the Worker, completed a task, and rendered a 20-event journey, an evidence-linked task result, and a normalized four-point heatmap. Inspection confirmed that the synthetic email entered during the run was not stored as a value.
At that checkpoint, the journal records 126 passing tests and all eight production builds passing. A later data-platform verification records passing tests, type checks, builds, and Docker Compose validation after the outbox and warehouse path were added.
The repository is explicit that Temptare is not yet production-ready. DNS resolution and pinning, production identity, quotas, expanded retention and audit coverage, broader browser fixtures, and container-backed data-platform validation remain release gates. No usage, revenue, adoption, or research-outcome analytics were found, so none are claimed here.
05 · Reflection
A credible constraint became the clearest product feature.
The most important product decision was giving up the universal promise. Treating authorization, compatibility, consent, and fallback as visible stages made the research flow more defensible and made failure legible before a participant was recruited.
The implementation reinforced a second lesson: an analytics number is only useful when its lineage survives retries, aggregation, and export. Source event IDs, normalized coordinates, replay-safe consumers, and explicit quality records turn telemetry into inspectable research evidence rather than decorative dashboard output.
The next proof is outside the controlled fixture. Temptare needs a bounded real-target compatibility matrix, production infrastructure validation, and researcher studies measuring time to first session and time to first defensible finding before it can claim broader product impact.