Product Requirements Document

Zippi

A hybrid commerce + mobility super-app. Customers shop from multi-vendor stores and book rides 24/7 in one app; vendors run their storefronts, drivers accept deliveries and rides, and an admin panel governs the whole platform. Built on React Native, React and Node.js with real-time tracking, secure payments and full operational control. This document specifies the customer app, vendor dashboard, driver app and admin panel.

Version 1.0 · DraftDate July 2026Status For reviewClassification Confidential

1. Overview

1.1 Purpose

Zippi is a single app for two everyday needs — shopping and getting around. Customers browse multi-vendor product catalogues, pay securely and track delivery, and in the same app book a bike, auto or cab with live driver tracking. Behind them, vendors manage products, stock, orders and discounts; drivers accept deliveries and rides and track earnings; and an admin oversees vendors, drivers, payments, disputes, promotions and reporting. This document covers all four surfaces.

1.2 Product vision

One trusted app that moves both goods and people — combining a multi-vendor marketplace and an on-demand ride network on a shared payments, wallet, notifications and identity layer, so every customer, vendor and driver lives in one ecosystem.

1.3 Surfaces

Four products ship together: the Customer app (shop + ride), the Vendor dashboard (web), the Driver app (deliveries + rides), and the Admin panel (web) with full operational control.

1.4 Scope

In scope: OTP/social auth; multi-vendor catalogue, cart, checkout & delivery tracking with OTP; ride booking, driver matching & live tracking; wallet, coupons & loyalty; ratings/reviews; vendor product/stock/order management; driver job management & earnings; the admin panel; and the platform's security, DevOps, infra and analytics posture. Payments via gateway + wallet.

2. User Personas

PersonaDescriptionPrimary goals
CustomerShops products and books rides; manages wallet.Fast checkout, reliable delivery, quick rides, one wallet, fair prices.
VendorSells products on the marketplace.List products, manage stock, fulfil orders, run discounts, get paid.
DriverFulfils deliveries and rides.Accept jobs, navigate, update status, maximise & track earnings.
AdminOperates the platform.Approve vendors/drivers, oversee payments & disputes, run promos & reports.

3. Functional Modules

The platform is built from shared modules across the four surfaces:

Auth

OTP + social login, roles for customer / vendor / driver / admin.

Catalogue & Cart

Browse, search, filter, sort; cart, coupons, checkout.

Delivery

Live status, OTP on delivery, driver matching & tracking.

Ride

Map booking, fare estimate, driver matching, live tracking, SOS.

Payments & Wallet

Gateway + wallet, refunds, coupons & loyalty.

Admin & Vendor

User/role management, product & stock, real-time ops control.

4. E-Commerce User Journey

The shopping flow is end-to-end: onboarding (register, verify phone/email); discovery (categories, search, filter, sort); product detail (photos, price, specs, reviews, variants); cart (quantities, coupon codes, delivery estimate); checkout (addresses, payment method, confirm); order tracking (live status, contact support); delivery (OTP verification on hand-over, review the driver, download invoice); and post-order (returns, refunds, issue reporting, rating). See the shop flow play out in the demo →

5. Transportation User Journey

The ride flow mirrors it for mobility: onboarding (register, KYC, vehicle-type preference); booking (pick pickup/drop on the map, fare estimate, choose vehicle type — bike / auto / cab); confirm (payment method, coupon, confirm); ride progress (live driver location, ETA updates, SOS button); end of ride (fare summary, invoice, review); and ride history (past bookings, receipts, issues).

6. Order & Booking Lifecycle

FlowStates
Order (commerce)New → Confirmed → Packed → Out for Delivery → Delivered → Completed → Return/Refund
Booking (ride)New → Driver Assigned → Picked Up → On Trip → Completed → (Cancelled)

Each transition is event-driven, pushes a notification to the customer, and is reflected on the driver, vendor and admin surfaces in real time.

7. Vendor Dashboard

Vendors run their store from a web dashboard: add & maintain products (photos, specs, variants, price), manage stock & availability, accept/reject & fulfil orders (pack → dispatch), set store discounts & coupons, and view earnings & settlement reports. Onboarding requires KYC and admin approval before a store goes live.

8. Driver App

Drivers work both networks from one app: go online, receive delivery or ride requests, accept or reject, navigate to pickup/drop, and advance the job through its status (Assigned → Picked up → On trip / Out for delivery → Completed), verifying delivery with the customer's OTP. They track earnings by day/week and manage vehicle & KYC documents.

9. Admin Panel

The admin panel is the operations command centre with role-based permissions: vendor approval, driver/KYC approval, order & booking oversight and override, refund handling, dispute resolution, commission & payment reconciliation, promotions, broadcast notifications, and reporting dashboards with exports and audit logs.

10. Payments & Wallet

A shared money layer spans commerce and mobility: a payment gateway (UPI / card / netbanking), an in-app wallet (top-up, pay, refunds), coupons & loyalty, commission splits to vendors and drivers, and surge pricing for rides. All flows are reconciled and invoiced, with refunds handled from the admin panel.

11. Security Architecture (OWASP Top 10)

Injection & XSS

Parameterized queries, input validation & output encoding against SQLi/XSS.

Auth & sessions

JWT + refresh, bcrypt password hashing, secure session handling, CSRF protection.

Access control

Role-based access (RBAC), least privilege across the four roles.

Rate limiting

Per IP/user/role limits backed by Redis; bot & abuse protection.

Transport & storage

TLS in transit, encryption at rest, secrets in a managed vault.

Logging & monitoring

Audit logs, anomaly alerts, dependency & vulnerability scanning.

12. DevOps & CI/CD

Development runs on GitHub (the client is invited as a collaborator to review code), with a clear PR/merge strategy and protected branches. GitHub Actions pipelines run unit, integration and E2E tests, build Docker images to a registry, and auto-deploy the whole platform to AWS — blue-green / canary releases with automated alerts and rollbacks.

13. Infrastructure, Scale & DR

Infra: managed Kubernetes (EKS) with VPC isolation, auto-scaling groups, NGINX ingress load balancing, database failover, and S3 for static/media. Scale & HA: read replicas, partitioning/sharding, CDN, Redis caching, and queue-based background jobs. Disaster recovery: defined RTO/RPO targets, automated backup snapshots, a failover strategy and an emergency contact tree.

14. Analytics & Monetization

Analytics: KPIs for orders, rides, refunds, top sellers, customer churn, delivery SLAs and sales trends with seasonal breakdowns. Monetization: vendor & driver commission structures, platform fees, promotions & upsell campaigns, and surge pricing for transport — all configurable from the admin panel.

15. Compliance, Testing & Support

Compliance: GDPR & data-retention policy, cookie policy, PCI-DSS-aligned payments, KYC for driver onboarding, and clear refund policies. Testing: a test-case matrix spanning UAT, regression, performance and security testing. Support & delivery: 12 months of maintenance, full handover documentation, vendor-team training and a helpdesk setup.

16. Open Questions

  1. Database — MongoDB vs PostgreSQL (or both: Postgres for transactions, Mongo for catalogue/geo)?
  2. Launch cities & categories — which product categories and which ride vehicle types at launch?
  3. Payments & escrow — gateway choice, wallet KYC limits, and payout cadence to vendors/drivers.
  4. Maps & matching — provider (Google/Mapbox) and the driver-matching & surge algorithms.
  5. Delivery model — platform drivers only, or vendor-arranged + 3PL for commerce orders?
  6. Phasing — ship commerce first, mobility second, or both together for the MVP?
Interactive demo

Shop it. Ride it. Run it.

Four surfaces, one platform. Switch between the customer app (shop & ride), the vendor dashboard, the driver app and the admin panel — and click the flows through end to end.

Delivery timeline

A proposed 18-week build.

Six phases across four tracks, on a week scale. Commerce and mobility are built on a shared foundation, then vendor, driver and admin tooling, then hardening on AWS.

Customer App Vendor & Admin (Web) Driver App Backend & DevOps Milestone
Weeks 1–4

Phase 1 · Foundation & Commerce core

Architecture, auth (OTP/social), catalogue, cart, checkout, Node.js API + DB, GitHub & CI/CD to AWS.

Weeks 4–8

Phase 2 · Mobility & Payments

Ride booking, maps & driver matching, live tracking, payment gateway + wallet, coupons.

Weeks 8–11

Phase 3 · Vendor Dashboard

Product/stock management, order fulfilment, discounts, earnings & settlement.

Weeks 10–13

Phase 4 · Driver App

Online status, job matching, navigation, status & OTP, earnings, KYC.

Weeks 13–16

Phase 5 · Admin Panel

Vendor/driver approval, disputes, refunds, commission, promotions, reports & audit logs.

Weeks 16–18

Phase 6 · Hardening & Launch

Security (OWASP), load & E2E testing, blue-green deploy, store submission & go-live.

Technology

React Native, React, Node.js — on AWS.

Two React Native apps for customers and drivers, React web for vendors and admin, a Node.js backend, and a GitHub → AWS CI/CD pipeline you're invited to review.

Customer & Driver apps

React Native

iOS + Android from one codebase per app — shop, ride, wallet for customers; jobs, navigation, earnings for drivers.

  • React Native (Android 7+ / iOS 13+)
  • Maps & live location
  • Push notifications (FCM)
  • In-app payments & wallet
Backend & Web

Node.js + React

A Node.js API powering all four surfaces, with React web dashboards for vendors and admin.

  • Node.js (Express / NestJS) REST + WebSocket
  • React vendor & admin dashboards
  • MongoDB or PostgreSQL + Redis
  • Role-based access & audit logs
Cloud & DevOps

AWS + GitHub CI/CD

Deployed to AWS via a GitHub Actions pipeline you're invited to review.

  • GitHub repo (client invited) + PR flow
  • CI/CD → AWS (blue-green / canary)
  • EKS, S3, NGINX ingress, auto-scaling
  • Razorpay/Stripe, Maps, FCM

System architecture

Customer AppReact Native
Driver AppReact Native
HTTPS · REST · WebSocket
Node.js APIauth · realtime · jobs
Services
Auth & RBAC
Catalogue & Orders
Ride & Matching
Delivery & Tracking
Payments & Wallet
Notifications
Promotions
Admin & Reports
MongoDB / PostgreSQLCore data
Rediscache · queues · geo
S3media & static
Outbound adapters
Razorpay / Stripepayments
Mapsgeo · routing
FCMpush
AWSEKS · S3 · CI/CD

Why this stack

React Native for both apps

One codebase per app to iOS + Android, with native maps, location and payments — fast to ship and staff.

Node.js for realtime

Event-driven Node with WebSockets fits live tracking, driver matching and order status across all surfaces.

Transparent delivery

You're invited to the GitHub repo to review code, with CI/CD auto-deploying to AWS on every merge.

Built to scale

EKS, read replicas, sharding, CDN, Redis caching and queue-based jobs for growth and high availability.