My co-founder and I built Halo+, a mobile app for Grand Canyon University's learning platform. It reached 3,582 downloads, 14% of on-ground students, within three weeks and with no marketing budget. The university's own team had been working on a mobile app for two years. When the university reviewed our system, its CISO called the security decisions “well thought out.”
- 01Co-founded a mobile app for a university learning platform that had no app, no push notifications, and no public API.
- 02Estimated API calls and outbound data before writing code: about $0.02 per student a month.
- 03Designed around the missing API: polling from a computer on campus, and student passwords never touched our servers.
- 04Reached 3,582 downloads, 14% of on-ground students, in three weeks with no ad spend.
- 05The university's CISO called the security model “well thought out.” The university asked us to stop offering it, and I deleted the database in that meeting.
Timeline
Apr 2024 → Oct 2024
Role
Co-founder · Design, frontend & architecture
Technology
Flutter, Firebase, Cloud Functions, Chrome extension
Platform
iOS & Android
14%
Of the student body, 3 weeks
55.6%
App Store conversion
$0.02
Per user / month, modeled up front
The Outcome
How students found it
We spent nothing on ads. Students heard about Halo+ through campus posters, a Discord community, and conversations; I talked with more than 300 students myself. Within weeks, university IT was getting support tickets about Halo+ from students who assumed it was the official app.
Daily downloadsRunning total
App Store Connect · daily downloads
Sep 183,582 totalOct 31
Sep 20342 downloads in one dayTHIRD DAY LIVE
Oct 11Shut downDATABASE DELETED IN THE REVIEW MEETING
- 3,582
- Total downloads
- zero marketing spend
- 698
- Peak daily actives
- 19.5% DAU ratio
- 55.6%
- App Store conversion
- page view → install
- 3 wks
- Launch to peak usage
- word of mouth only
- 6 mo
- To ship
- vs. 2+ years internal
- <$5K
- Total cost
- two-person team
Go-to-Market
Launch materials
I also designed the launch: campus posters that each promoted one feature, the logo, a marketing site, and the App Store listing.
The Problem
GCU's learning platform had no mobile app
Halo, GCU's learning management system, had no mobile app, no push notifications, and no public API. Students managed deadlines, grades, and professor messages through a website that didn't work well on phones.
We built a deadline dashboard with overdue alerts, reminders that could be set anywhere from seven days to six hours ahead, a full gradebook, professor messaging, and a class hub. It ran on iOS and Android from one Flutter codebase. I was responsible for design, frontend, architecture decisions, and go-to-market; my co-founder John handled backend infrastructure and API integration.
The Product
The app's main screens
Onboarding, session sync, student ID, classes, course overview, topic detail, and the deadline view, which students requested more than any other feature.
Cost Modeling
Estimating costs before writing code
Before writing any code, I estimated API calls and outbound data per user for best, average, and worst-case usage. The estimate came to about $0.02 per user per month, so the system would stay affordable even if the whole student body signed up.
Try It
Run the numbers
The same model, made adjustable. Set how many students use the app, how often they refresh, and how much each session pulls, and see what the monthly bill would come to.
3,582
Refreshes a day
Each session
41 API calls · 325 KB per refresh
API calls a month66,087,900
The free 2M calls cover 3%, or about 108 students at this usage.
Outbound data a month524 GB
Monthly bill
$87.93
$0.025 per student
- Calls past free tier
- $25.64
- Data past free tier
- $62.30
Per-refresh figures are from the sketch above. Prices are Cloud Functions list prices: $0.40 per million calls after the first 2 million each month, and $0.12 per GB of outbound data after the first 5 GB. Compute time isn't included, as it wasn't in the original estimate.
Architecture
Working without an API
Halo rate-limited outside traffic but not traffic from the campus network, so we ran the polling from a mini PC on campus. Student passwords never reached our servers, and the frontend was kept separate from the backend so the university could replace our backend with its own and keep the app.
ClientServerlessStorageOn-campusUniversity systems
Request path
- Flutter appiOS & Android
- Cloud FunctionsGateway · JWT auth
Validates the session and shapes responses for mobile.
- HaloGCU systems
Fetched per request, held in memory, then discarded.
Notification path
- Campus serverMini PC · 15-min poll
Throttle queue, 5 concurrent across 2,500+ users.
- HaloGrades · deadlines
- Cloud FunctionsChange detection
- PushFCM → device
Session path
- Chrome extensionSecure session sync
Copies the session token from a signed-in Halo login, so no password is stored.
- FirestoreTokens only
Push tokens and auth refresh tokens only. No academic data.
Security Review
The university's security review
The fast adoption drew the university's attention, and I presented the full system to GCU's senior leadership, including the CISO, the Halo product team, and technology executives. Their main question was what data the app kept about students. It had been designed from the start to keep almost none.
Security model · as presented to the CISO
Stored
Push notification tokens
to deliver reminders
Auth refresh tokens
to keep sessions alive
Never stored
Grades & assignments
Professor messages
Passwords
Any academic record
Safeguards
Fetched per request
held in memory, then discarded
Rate-limited access
5 concurrent, on a throttle queue
Tokenized sessions
synced by extension, no password
No FERPA violation, no breach
GCU's security and legal teams found no FERPA violation, and no data was ever breached. The university still treated redistributing its data outside its official partner as a protected-data risk, so it asked us to stop offering Halo+. I deleted the database during that meeting, and the service ended that day. GCU's Assistant Vice President of Campus Technology said he believed it should become the university's official mobile app.
Validation
“Well thought out.”
He said we had avoided the mistakes he usually finds in projects like this, pointing to the tokenized storage, atomic operations, and rate limiting. He also asked for my resume.
The Stack
What it ran on
One Flutter codebase for both platforms, a serverless backend on Firebase, and a small computer on campus for the polling the cloud couldn't do.
- Flutter
- iOS & Android client
- Firebase
- Auth, Firestore, FCM
- Cloud Functions
- Gateway & notifications
- Chrome extension
- Secure session sync
- React
- Marketing site
- Figma
- Product & brand design
Working Together
If you depend on a system without an API
Many organizations rely on a core system that has no API and no mobile app. On a project like that, I would estimate costs before building, design the security so it holds up when the system's owners review it, and keep the architecture easy to hand over.
Start a project or email william@piehsoft.com