I dont think anyone will read this. I built a group chat app with vanilla JS and Firebase, no build step

I made Flami for my friends: group chat with voice notes, calls, party games and watch parties, all in the browser. The frontend is plain JavaScript, no bundler, no build step. Free Firebase plan.

Live: https://flami-7ea7b.web.app
Source (MIT): https://github.com/exodusssss7/flami

Firebase loads as ES modules straight from a CDN. Edit the file, refresh, done. The tradeoff: no JSX, no hot reload, and one big app.js I have to keep tidy myself. For this size it's worth it.

Firestore rules are the whole backend

There is no server, so the security rules are the only thing between users and each other's data. Chats and media are readable only by members, writes are size-capped, and you can only edit your ownn messages. Firebase web API keys aren't secrets,,, so test your rules like code.

Watch party sync
The host's player is the source of truth, with a heartbeat every 3 seconds. Viewers fix small drift by nudging playbackRate to 1.06 or 0.94 instead of seeking. Google Drive links don't work (the browser blocks the stream), so use Dropbox or a direct mp4.

What it doesnt do

• No end-to-end encryption
• Calls only ring while the app is open
• Free-tier limits (calls use a free relay capped at about 500 MB a month)

Full list: https://github.com/exodusssss7/flami/blob/main/SECURITY.md

If you've built realtime sync or WebRTC on Firebase free tier, I'd like to hear what broke for you.