When BarlaPost emails you

• A scheduled post fails. The email names the platforms it did not reach, says why in a sentence, and says what to do next. One email per attempt, not one per platform. A post you send with "Post now" does not email you: the app shows that result on screen while you are looking at it.
• A connection breaks. When the regular check finds that a platform no longer accepts BarlaPost's access — a changed password, revoked app access — you get one email, at the moment it breaks, not one per check. Temporary trouble never counts as broken: a rate limit or a platform outage does not email you that your account is disconnected, and it does not mark it disconnected either.
• LinkedIn access is about to end. LinkedIn grants personal accounts roughly 60 days of access with no way to renew it silently, so a week before the date you get an email naming it. Once per expiry date; reconnecting sets a new one.

The email goes to the person who wrote the post, or, when that is not known, to the workspace owners.

Turning them off

Every email ends with a link that turns off that kind of email and only that kind. It needs no sign-in: the page it opens asks once, and that is it. Mail apps that support one-click unsubscribe, Gmail and Apple Mail among them, show their own unsubscribe button as well.

Reasons in plain words

A platform's raw error is rarely something a person can act on. In the email it becomes one of a handful of sentences: the connection needs reconnecting, the platform is limiting how often you post, the platform is down, the platform rejected the post, or the problem is on our side.

That last one exists because of X. When X refuses a post because BarlaPost's own X API credit has run out, that is not your account's fault and reconnecting would not fix it, so the email says exactly that, and your X connection is no longer marked as broken over it.

Sign-up and password emails

The verification and password-reset emails were plain text. They now share the notification emails' design: the logo, one large code, and how many minutes it stays valid.

The verification code is also in the subject line, so you can read it off the notification without opening anything. The reset code deliberately is not, and it is kept out of the preview line too: a password-reset code on a lock screen is a code anyone holding the phone can use.

Emails in your language

Every email exists in English and Turkish and follows the language the app is in, not your phone's. The app's language travels with each request and the server remembers it, so mail it sends hours later — that 3 a.m. failure — arrives in the same language. On iPhone this works from today. On Android it arrives with the next app update.

X: ten posts a month

X bills BarlaPost for every post created through its API, and a post with a link costs about thirteen times as much as one without ($0.20 against $0.015 at X's published prices). Posting to X now comes with a monthly allowance:

• 10 posts per calendar month (UTC) for each BarlaPost account, shared by everyone in it.
• A post with a link counts as 5. X treats example.com as a link exactly as it does https://example.com, and so does the count.
• A post counts from the moment it is scheduled, so a month cannot be overbooked in advance. Failed posts and drafts do not count.
• When a post would not fit, you hear it when you press Post or Schedule, before anything is sent, with how many posts are left. Your other platforms are not affected; take X off and the rest go out as normal.

Behind that sits a ceiling across the whole service, so a sudden rush of new accounts cannot run the X bill past what BarlaPost can pay. If it is ever reached, X pauses until the month turns and the app says so in a sentence.

To keep reads within the same budget, Stats now follows an X post for seven days after it goes out, and an X account that has not posted for a week is not polled until it posts again. The numbers stay; they stop moving.

Version 1.0.7

Submitted to both stores today. Nothing on screen changes. It is the version that lets fixes and small changes reach your phone without a full store release, and the next ones will arrive that way.

Sign in with Apple

There are now three ways in: an email address and password, Google, and Apple.

Apple's is worth a note because of what it does with your address. Choosing "Hide My Email" gives BarlaPost a relay address instead of your real one, and you can revoke it from your Apple account at any time. Mail sent to a relay address only gets through if it comes from a domain registered with Apple for that purpose, so barlapost.com is registered and verified — verification codes and account mail reach you exactly as they would at any other address.

Apple also hands over your name once, on the very first sign-in, and never again. BarlaPost takes it only when the account has no name yet, so signing in with Apple to an account you already named leaves your name alone.

English and Turkish

The app is fully localised in both languages. It follows your phone's language by default; to override it, Settings has a Language row that opens its own screen — device, English, Turkish. Pick one and the app switches immediately: the screen you are on, the tab bar underneath it, and every screen behind it. No restart.

A few things stay in the language the service that produced them chose. A failure reason sent back by Bluesky or LinkedIn is passed through as written rather than guessed at in translation.

What the iPhone build includes

Everything, which is the point:

• One composer for Bluesky, Mastodon, LinkedIn, X, YouTube and TikTok, with the character counter following the strictest platform you selected.
• Up to four photos, or one video, with alt text.
• Scheduling, a calendar of what is queued, and editing or cancelling a scheduled post.
• Per-account publish results, so one platform failing never takes the rest down with it.
• Stats, rebuilt last week around real charts and a per-account view.
• Deleting your account from inside the app, which removes everything immediately.

Free, on both stores

BarlaPost is free on the App Store and on Google Play, with no paid tier. The two builds stay in step from here — a release goes to both.

Stats, rebuilt around charts

The old Stats screen had the data and spent it on 48-by-18-pixel sparklines. Every metric already arrived with its daily series, its engagement components and a next-sync timestamp; none of it was drawn.

Stats is now two screens. The overview shows the whole workspace, then each connected account as a row into its own detail screen.

The overview deliberately does not sum raw platform metrics. "Views" plus "impressions" plus "reach" is not a quantity anyone can name, so the three numbers on offer are the ones every platform can answer: reach-like impressions, interactions, and the engagement rate between them. Each account contributes whichever of its metrics plays that role — YouTube counts views, X counts impressions, Instagram counts reach.

Two derivations are worth spelling out, because the obvious implementations are both wrong:

• The engagement rate is recomputed from the totals, never averaged. Averaging per-account rates lets a small account drag the workspace figure around.
• The period-over-period delta is weighted, not averaged. The API returns only the current window's series, but each metric's delta was computed server-side as (current − previous) ÷ previous × 100, so inverting it recovers the exact previous total. Those are summed and divided. Averaging percentages is how one account going from 1 to 5 views writes "+400%" across an entire workspace.

The per-account screen is where platform-native metric names are safe to show, because inside a single platform "views" means exactly one thing. It carries a metric selector, a daily area chart you can drag across to read any day's value, a KPI grid, a horizontal breakdown of what the engagement was made of, and a ranked list of the posts that carried the window.

That last one is backed by a new mobile API endpoint, GET /api/mobile/v1/workspaces/{id}/accounts/{account_id}/analytics/posts/. It is a thin envelope around the same service function the web analytics table already used, so a post's numbers read identically on both surfaces. It is account-scoped rather than workspace-wide on purpose: post metrics are not comparable across platforms, so a single merged ranking would sort on numbers that do not mean the same thing.

Charts are drawn with react-native-svg. A single series carries no legend — the heading names what is plotted — and labels only the peak, the two ends of the range, and whatever your finger is on. The scrub gesture waits until a drag is clearly horizontal, so a vertical swipe still scrolls the page.

The download is roughly half what it was

A production iOS export went from 12.68 MB to 5.59 MB — 7.09 MB smaller, or 56%. Three separate barrel imports were responsible.

Fonts fell from 5.32 MB to 0.92 MB. Every @expo-google-fonts family's index.js calls require on every weight it ships, so importing a single weight by name bundled all of them: 36 TTF files for the seven the app actually loads. Importing each weight's own module instead drops 4.40 MB.

Lucide icons fell from 1391 KB to 30 KB. The barrel re-exports roughly 3,500 icons, and Babel compiles those re-exports to eager require calls — so importing one icon executed thousands of module factories at startup. Per-icon imports fixed both the size and that startup cost. Four of the names in use are deprecated aliases (AlertTriangle is triangle-alert, Home is house), resolved from the barrel rather than guessed.

Runtime SVG parsing cost about 470 KB, plus a visible glitch. Platform badges used LocalSvg from react-native-svg/css, which reads the file over the bridge and parses XML and CSS on every mount with no cache — which is why badges appeared after the row around them had already drawn. It also pulled css-tree, entities and css-select into the bundle for ten logos. SVG now compiles to a React component at build time through react-native-svg-transformer; those three packages are gone entirely and nothing is parsed at runtime.

Moti cost about 512 KB. Moti is a declarative layer over Reanimated that ships framer-motion with it. All 19 animations in the app were either mount-time entrances or press scales, both of which Reanimated expresses natively as layout animations and shared values.

Total modules in the production bundle fell from 4,330 to 2,124.

Pages stopped shifting under you

Tab switching goes through a route replace, so every screen remounts on every visit — and replayed its whole staggered entrance. What read as an entrance on first launch read as the page sliding up and down each time you moved between tabs.

Screen blocks no longer animate in. What animates now is only what a deliberate action triggers: opening a dialog, toggling the calendar's search tray, stepping to another month.

Every request has a deadline

The fetch API has no timeout of its own, so a stalled connection — a captive portal, a phone that moved out of range mid-request, a server that accepted the socket and went quiet — left the promise pending forever and the screen spinning with no way back but killing the app.

Requests now fail after 20 seconds. Publishing gets its own 120, because it waits on the platforms themselves, several in a row, uploading media as it goes — but it is bounded, which is the point. An abort raises the same error every other transport failure does: a request that never answered and one that could not be sent are the same thing to the person waiting. File uploads are deliberately exempt, since their duration is set by the file's size and the phone's uplink.

The API serves four times as many requests at once

Gunicorn ran two workers of two threads, so the whole API served four requests concurrently and a fifth queued. Publishing is synchronous — it uploads media and talks to each platform in turn — so one publish can hold its thread for most of a minute. Four people posting a video simultaneously was enough to make the service unresponsive for everyone.

It now runs eight threads per worker: sixteen in flight. Threads rather than more workers, because the work is almost entirely waiting on PostgreSQL, object storage and the platforms' APIs; threads share the process's memory and, with persistent database connections disabled, idle ones hold no connections. The worker timeout was also raised to match the app's publish deadline — the default was below how long a legitimate publish takes — and access logs now reach stdout, which is the only way to notice abuse at all.

The Stats endpoint asks the database half as much

The overview walks every connected account's snapshot history, so its cost grows with the workspace. It was also asking for far more than it needed: one query per metric for the post-derived series, and one platform-configuration read per account, neither of which varies within a request.

Batched into a single scan per account and one configuration read per request, seven connected accounts went from 33 queries to 16. The per-metric freshness comparison is preserved — taking a single maximum across metrics would let one metric's fresh rows override another's newer ones.

The API moved to api.barlapost.com, behind Cloudflare

The mobile API now answers on a dedicated hostname served through Cloudflare, with WAF rate limiting in front of it. The previous hostname keeps working, so apps that have not updated are unaffected.

This surfaced a correctness bug that predated the migration. Every IP-keyed throttle trusts a fixed number of X-Forwarded-For entries counted from the right. Measured against the live deployment, a request arrives carrying the caller's address followed by the platform edge's own: the edge writes the caller first and a second internal hop appends itself. Trusting one entry from the right therefore returned the edge — the same value for every caller, and rotating between edge nodes request to request — so IP-keyed limiting was both shared and erratic. Behind Cloudflare the client address is read from CF-Connecting-IP instead, and only for requests that prove they arrived through the CDN.

Read endpoints are now throttled too. Analytics is the heaviest read the API serves and was the only surface without a limit, while every write endpoint already had one.

Platform availability

Connecting TikTok and Threads is temporarily unavailable. A connect flow builds its OAuth redirect URI from the host it was called on, and neither provider has the new callback registered yet. TikTok's is deliberate rather than pending: its content-posting audit is still open, changing an app's settings mid-review risks resetting it, and posting there is private-only until that clears. Accounts already connected keep publishing — that path uses stored tokens and never touches a redirect URI. Bluesky, Mastodon, LinkedIn, X and YouTube are unaffected.

Also in this release

• Six exported functions nothing imported, a screen no route could reach, and a duplicated component were removed. Every module in the app is now reachable from a route.
• The backend's lint and format tooling is pinned to one version across CI and local development; a floating range meant a developer on a newer release reformatted files that CI's older copy then rejected.
• Development and test dependencies no longer ship in the production container image.

Delete a scheduled post from the calendar

Until now a post you had scheduled could be edited but not removed - the only way out was a hidden long-press. Every scheduled post on the calendar now has a delete button. Tapping it asks once ("Delete this post?"), then takes the post off the schedule. A post that is already being sent can't be deleted, and the calendar tells you so instead of failing quietly.

Nothing gets lost without asking

Closing the composer used to throw away whatever you had written. Now, if there is a caption or a photo in it, closing - with the X, the back button, the hardware back button or a swipe - asks "Discard this post?" first. Choosing Discard really does clear everything, including any photos already uploaded for it, so a discarded draft leaves nothing behind. Editing a scheduled post gets the same check, but only when something actually changed. Saved drafts are next on the list.

The schedule sheet behaves

• The bottom sheet now has a grabber and swipes down to close - the time drums still scroll, so the swipe lives on the top half of the sheet.
• Tapping "Schedule" with the keyboard open no longer hides the caption behind the sheet. The sheet drops to the bottom edge the moment it opens, and the caption stays reachable above it.
• Picked a time and want a different one? Tap the amber "Goes out" block and the picker reopens with your date and time already selected.
• The in-app emoji picker is gone. Your keyboard's own emoji panel is one tap away and better than anything we could fit into a sheet.

Dialogs that look like BarlaPost

Disconnecting an account, deleting a scheduled post and discarding a post all used the operating system's default alert. They now use the app's own dialog - the same paper block, mark and pill buttons as the rest of the screen - with a clear destructive action and a way to back out. A failed request stays in the dialog with the reason, one tap from a retry.

Sign-up and passwords

• Signing up with an email address that already has a BarlaPost account now says so under the field, instead of showing a "we sent you a code" screen that would never get a code. Password reset keeps its existing privacy behaviour and never reveals whether an address is registered.
• Passwords need at least 8 characters, an upper-case letter, a lower-case letter, a number and a symbol such as . ! or @. The rules appear as a checklist under the field and tick off as you type, on sign-up and on password reset. The server enforces the same rules, and it understands letters beyond A-Z, so a Turkish Ş counts as an upper-case letter.

Small things

• The "Something broke" button in Send feedback no longer spills past its edge; the two feedback kinds are now tiles with the icon above the label.

This update makes cross-platform publishing much safer. No more wondering if your post will be truncated on one platform while being fine on another. Each character limit is shown as you type, with a clear indicator for each connected account.

What's included

• Real-time per-platform character counting
• Visual indicators for each platform's limit
• Countdown display for long-form content
• Warnings before you hit platform-specific limits

LinkedIn is one of the most important platforms for professional networking. Now you can share the same content you're posting to Bluesky and Mastodon with your LinkedIn audience, all from one place.

What's included

• OAuth-based secure connection
• Support for text posts and images
• Per-platform visibility controls
• LinkedIn-specific character limits respected

This gives you much better control and visibility when cross-posting. You can see exactly which platforms succeeded and which failed, then retry only the failed ones.

What's included

• Independent status tracking per platform
• Selective retry for failed publishes
• Clear success/failure indicators
• No duplicate posts on successful platforms

Mastodon is a decentralized social network where you can host your own instance or join a public one. Now you can manage your Mastodon presence alongside other platforms.

What's included

• Support for any Mastodon instance
• OAuth authentication (no password storage)
• Dynamic app registration
• Full cross-posting support

This marks the beginning of BarlaPost's journey to make social media management simple and unified across all your accounts.

What's included

• Bluesky account connection via app passwords
• Mobile-first composer
• Post publishing with media support
• Account authentication and management