DeenFit

For a practising Muslim the day is already structured — by five prayers. Mainstream fitness apps ignore that, prescribing a 60-minute session that collides with Maghrib and forces a rushed or skipped prayer. "Islamic fitness" apps usually bolt a workout list onto a prayer clock, or put Islamic artwork on a generic gym app.

Neither respects the audience: demonstrations in immodest dress, guilt-driven streak mechanics, paywalled Qur'an access, and an online-only experience on the modest hardware and metered data much of this audience uses.

DeenFit is built around one mechanic no other category has: the scheduler understands what time Maghrib is.

Given the day's prayer times, it finds the real gaps and sizes the workout to the gap. A 47-minute Asr-to-Maghrib window gets a ~30-minute session plus a buffer to stop, change and reach the prayer unrushed — and every recommendation explains itself in plain language.

Around that engine:
• Today, Train, Deen and Progress in a five-destination app where Deen is its own section — someone who opens the app only for Qur'an and prayer never routes through a fitness screen.
• A public website, a full user web panel and an admin panel sharing one design system with the app.
• Everything free. Offline is the default, not a fallback.

The engine takes the day's prayer times, derives the free windows between them, and sizes a session to each window with a buffer to stop, change and walk to prayer. It never schedules work that overlaps a prayer, and every suggestion carries a human-readable reason.

It exists twice by design: in Dart on the device, so scheduling works completely offline, and in PHP on the server, so the web panel and notifications agree with the phone. Both implementations are covered by tests asserting the same numbers — including the documented 47-minute Asr-to-Maghrib case — because a user must never see two different answers on two devices.

Flutter app (lib/)
Feature modules — today, train, exercises, programs, scheduler, deen, habits, progress, onboarding, profile — over core layers for network, storage, notifications, theme and media. Content ships bundled; packs download on demand.

API (server/)
Core: autoloader, PDO layer, router, validator, security, rate limiter, logger and migrator. Domain: PrayerTimes, SchedulingEngine, Streaks and the Animator. HTTP: controllers and middleware, plus a server-rendered public site. public_html is the only web-reachable directory; the front controller also serves static files itself, with a realpath check that blocks path traversal on hosts that ignore .htaccess.

Panels (panel/)
Vite-built user web panel (today, train, workout player, exercise, deen, report, plan, settings) and admin panel from a single build, sharing design tokens with the app.

API contract
{"data": …} or {"error": {message, code, fields}}. Bearer tokens stored SHA-256 hashed, so a database leak yields no usable sessions. Public catalogue and all deen reference content; authenticated today, sync, profile, reports and prayer/habit logging; reviewer and admin realms above.

One palette, defined in three places and kept identical: warm cream and parchment, deep sage for training, antique gold for Islamic surfaces, dusty mauve for the main action, with the eight-point khatam star as the recurring ornament.

• Never guilt. No red, no warning icons and no shame copy near the habit checklist; reminders invite, never reprimand, and never count what someone failed to do.

• Consistency is not religious standing. The Progress ring says so on screen, and the API returns that sentence in its payload.

• Prayer times, Qibla and Qur'an are never paywalled — in fact nothing is.

• Offline is the default. Scheduling, prayer times, the exercise library and reminders all work without a connection.

• The scheduler explains itself. Every recommendation carries a plain-language reason.

• Intention-framed language: the body is an amanah, a trust — not "shred" or "get ripped".

• Fitness content seeds as draft and deen content as in-review, regardless of command-line flags. Only a reviewer or admin can publish, and the reviewer is recorded against each row.

• Scripture and hadith are imported from source with provenance recorded for every fetch; the importer stops on a failed fetch rather than filling gaps, and gradings the source did not state are stored as null.

• Player thumbs-down votes surface on the admin dashboard once an exercise has three or more, so weak instructions get found.

• Bearer tokens are stored SHA-256 hashed; .env is kept outside the web root; the static-file server blocks path traversal.

• The backend test suite runs through the real router, middleware and controllers, with a security section covering SQL injection, token hijacking, cross-user data access, expired and revoked tokens, error leakage and Arabic round-tripping.