# NFC writing operations

This is a **fulfillment process**, not code. When a customer's TAPLY profile is
ready to ship on a physical card, follow the steps below to write the profile
URL to the NFC tag.

## What the tag stores

Each NFC tag stores **one URL** — the canonical public profile URL:

```
https://{your-domain}/u/{slug}
```

That URL is the same as what the in-app QR code (at
`https://{your-domain}/u/{slug}/qr.svg`) encodes. Verify the slug from
`/dashboard/profiles` before writing.

## Recommended tag

- **NTAG215** — 504 bytes of writable storage. Vastly more than we need for a
  URL, but it's the de-facto consumer standard, well-supported by both
  Android NFC apps and iOS Shortcuts, and cheap.
- NTAG213 also works (137 bytes — still plenty for our URLs).
- Avoid pre-locked tags from sketchy resellers; the lock bit can't be undone.

## Android workflow (recommended for batch writing)

1. Install **NFC Tools** (Wakdev) from Play Store.
2. Open the app → **Write** → **Add a record** → **URL/URI**.
3. Paste `https://{your-domain}/u/{slug}` and tap **OK**.
4. Tap **Write** and hold the tag against the phone until the success
   confirmation appears.
5. (Recommended) Go to **Other → Lock tag**. This makes the tag read-only
   permanently — required to prevent the customer (or a third party who
   gets physical access) from rewriting it.
6. Test the tag with the same phone before packing it: tap → phone should
   open the profile URL.

## iOS workflow

1. Open the **Shortcuts** app.
2. Create a new Automation → **NFC** → **Scan** the blank tag (assigns it).
3. Add an action: **URLs** → set the URL to the profile URL.
4. Save. iOS does not support locking tags from Shortcuts — for that you
   need an Android device with NFC Tools.

## Re-writes

Re-writing a locked tag is **physically impossible** — the customer would
need a new tag. Plan for this:

- If a slug changes (admin renamed it via `/dashboard/profiles`), the old tag
  still works only if you set up a redirect from the old slug. We don't do
  that automatically in MVP.
- Treat slug edits as a customer-support escalation: only do it if the
  customer is OK with re-shipping their card, or if the card hasn't been
  shipped yet.

## QA checklist before shipping

- [ ] The tag opens `https://{your-domain}/u/{slug}` on Android and iOS.
- [ ] The profile loads (no 404, no draft notice for paid customers — admin
      must have flipped publish on).
- [ ] The Save Contact button on the profile downloads a valid `.vcf`.
- [ ] The tag is locked.