BoxSpot is a peer-to-peer parcel drop-off network operating in Tanger, Morocco. Senders leave packages at participating cafés, shops, and bookstores. Receivers collect them on their schedule. The premise is simple. The execution is anything but.
The founders had a working prototype when they came to us in early 2025. The app worked. The pricing worked. The partner cafés did not work — every café we visited had a polite version of the same question: what happens if I lose someone's package and that person is angry?
What we did
The first decision was technical-as-trust-architecture. We built a double-QR handoff system: one QR generated at deposit (sender → café), a second generated at pickup (café → receiver). Both QRs must scan to close the loop. The café has a tamper-evident proof for every parcel it has ever handled.
The operator app is a React Native build on Supabase. Every parcel has a complete audit trail: photo at deposit, photo at handover, timestamps from both QR scans, locker placement code, and a chat thread between sender and café manager if anything goes off-script.
We spent four weeks on the QR flow alone. We rebuilt it three times. The first version was technically correct and operationally hostile — the café managers were asked to scan, photograph, and confirm before handing over the parcel, and that was a forty-five second interaction with a customer waiting for coffee. The third version is sub-ten seconds, runs offline if needed, and prints the receipt as an optional shareable image.
What changed
Ten partner locations live in the first six months, including some of the most-trafficked cafés in central Tanger. Zero lost parcels in the first three hundred drops. The Tanger municipal logistics inspectorate has used the BoxSpot audit trail as the reference implementation for two pilot ordinances on micro-mobility deliveries.
The metric the founders care most about is one we did not target: partner café NPS at month four was seventy-eight, three points higher than the receivers. Cafés feel ownership of the experience. Several have asked to put up BoxSpot signage inside their venue — unprompted, unpaid.
What's next
Expansion to Rabat is being scoped for Q2 2026. The technical scaling is straightforward — Supabase + the existing React Native build handle multi-region out of the box. The harder work, again, is the trust work: every Rabat partner will require a city-specific onboarding script, a city-specific liability clarification, and a physical visit from the founder. We will not skip that step. The product is the trust.
We continue to ship weekly. We run the production stack 24/7 on a fifteen-minute P1 SLA. The cloud bill is down twenty-eight percent from the founder's original AWS estimate.
“The double-QR system isn't a tech win — it's the moment a partner café felt safe handing a bag back to a stranger.”