KitDesk

Who’s got the laptop, which site is it at, and when is it coming back. Schools and small organisations mostly answer that with a spreadsheet and a person who remembers. KitDesk answers it with a database and a QR code.

It’s been live on its own domain for over a year and it went through Google Play review in August 2026, wrapped with Capacitor rather than rewritten native.

One build, every customer

Product name, colours, feature flags and the wording for every object in the system live in a single JSON file that the React app fetches at runtime. Not baked in at build time. Fetched.

That means one deployment serves a school calling them “assets” and a production company calling them “kit”, and onboarding a new customer is a config file rather than a branch, a rebuild and a second thing to keep patched. The rebuild-per-customer approach works fine for two customers. It becomes the whole job at ten.

Scanning things that don’t want to be scanned

Every asset carries a QR code and you check it in and out with the device camera. Nobody types serial numbers, because people typing serial numbers is where inventory data goes to die.

Getting a camera to read a code reliably across every device a school owns took three layers. The browser’s built-in BarcodeDetector where it exists, which is fast and costs nothing. jsQR as the fallback, which is what iOS gets. Then typed entry when the camera is blocked outright, because a locked-down device with camera permissions denied by policy is not an edge case in a school. It’s Tuesday.

The unglamorous half

I provisioned the VPS it runs on, and I still maintain it. The production database, the nginx config, the certificates, the deployments, the backups. Rate limiting on login and on the kiosk PIN went in during August 2026 after I sat and thought about how I’d attack it myself.

Being the person who gets the call when it’s down changes how you write things. You stop being clever.