HireOMate — Peer-to-Peer Rental Marketplace
Rent out the drill, the trailer, the camping gear — with deposits held rather than taken, condition photos on both ends, and a signed agreement in between.
Peer-to-peer rental fails on trust, and trust here is mostly a money-and-evidence problem. The renter has to hand over a deposit before they've met the person; the owner has to hand over a valuable item and hope it comes back. When something is damaged, both sides describe a different item and nobody can prove which version is true. Most marketplace software treats this as a payments integration, but taking a deposit as a real charge means fees on money you intend to give back, releasing it needs a refund, and every dispute becomes a manual argument with no record. Layer on outright sales and rent-to-own instalments, two-sided commission, and a platform that has to net its fee after the processor takes theirs, and the money model stops being a checkout form.
A Django marketplace covering the whole lifecycle: discovery, request, confirmation, payment, agreement, handover, return, payout, and dispute. Deposits are manual-capture authorisation holds rather than charges — the money is reserved on the card and never moves unless it's captured, so holding it costs nothing and releasing it is a void rather than a refund. Card payments apply a gross-up surcharge so the platform actually nets its fee after Stripe's cut, and commission is genuinely two-sided: a service fee from the renter and a commission from the owner's payout, both configurable in admin, both snapshotted onto the booking so a rate change never rewrites a past deal. Each party sees only their own side of the split on the booking page. Evidence is structural, not optional: both parties e-sign a generated PDF agreement before handover is permitted, the owner uploads pickup condition photos, the renter uploads return photos, and completion is gated on both existing — so a dispute is decided against a photographic record rather than two accounts of it. Deposits auto-release after a clean return via a scheduled job, or get captured, withheld or split by an admin resolving a dispute. Search runs on PostGIS for genuine near-me distance, and a Preact admin console handles verification queues, listing moderation, disputes, payout runs, and platform settings.
Outcome
Feature-complete across eleven milestones with 466 tests, a companion Flutter app built through its full feature set, and a documented store-release path. The hardening milestone found and fixed real vulnerabilities rather than ticking boxes — the throttle configuration keyed rate limits on a client-controlled header, which meant varying it produced a fresh bucket per request and no limit in the application meant anything; sign-in had no throttle of its own at all; webhooks were inheriting the anonymous limit, where a 429 reads to Stripe as a failed delivery and quietly loses money events. Content-Security-Policy uses per-response nonces so no inline or eval exemption is needed, with frame-ancestors 'none' because clickjacking a "hand it over" button is a real attack on this product specifically. The platform was subsequently ported from its VPS Docker architecture to cPanel shared hosting on a separate branch, with the scheduled money jobs moved onto cron and the VPS-only tasks documented with their reasons rather than quietly dropped.
Key features
- Peer-to-peer rentals plus outright sales and rent-to-own instalments
- PostGIS near-me search with keyword, category, price, date-availability and sort filters
- Request-to-book lifecycle with owner confirmation, reschedule, and a pricing snapshot per booking
- Deposits as manual-capture authorisation holds — reserved, never charged unless captured
- Gross-up card surcharge so the platform nets its fee after processor costs
- Bank-transfer payment path with screenshot upload and admin verification
- Two-sided commission, configurable in admin, with each party shown only their own side
- Generated PDF rental agreement with two-party e-signature, gating handover
- Condition reports at both ends — owner pickup photos and renter return photos — gating completion
- Automatic deposit release after a clean return, via a scheduled job
- Dispute flow with evidence upload and admin resolution that releases, withholds or splits the deposit
- Weekly batched payout runs via Stripe Connect, with a manual bank run for non-Connect owners
- Stripe Identity verification with an admin approval queue
- Listing moderation queue with approve and reject
- Two-sided reviews with rating aggregation
- Per-booking real-time chat with presence, over WebSockets
- Unified notification outbox across email, SMS, push and in-app
- Role-based admin console as a build-less Preact SPA over a dedicated REST layer
- Platform settings singleton wired live into pricing, plus a field-level audit log
- Rate limits scoped per endpoint, keyed correctly behind proxies, failing open rather than causing an outage
- Content-Security-Policy with per-response nonces and no inline or eval exemptions
- Object-level permission audit where booking services check role, not mere participation
- OpenAPI documentation with JWT-callable endpoints
- Flutter mobile client covering auth, discovery, booking, payments, handover, chat and push
- Dual deployment targets — Docker Compose on a VPS, and a cPanel/MySQL branch with cron-driven money jobs
Tech stack
Build something similar?
Tell us about your project. We'll share how we'd approach it.
Start a projectMore Web Application projects
Pigeon Pedigree Pro — Multi-Tenant Loft Management SaaS
Photograph a paper pedigree certificate and the birds appea…
Sisters Kitchen — Home Kitchen Ordering & Catering Website
A family takeaway kitchen's weekly menu, pre-orders and cat…
REXX — Site Job Management Platform
Work orders from the first call to the paid invoice, with t…