Acopio Panamá

#.Overview

On October 9, 2026, an earthquake hit Panama. Collection centers opened all over the country, run by businesses, NGOs, local governments, schools, and churches. The information lived in WhatsApp forwards and social media posts. Nobody could tell which centers were still open, what they needed, or which ones were real.

Acopio Panamá answers two questions: where can I take donations, and what do they need today? It’s a national, open directory of collection centers, distribution points, community kitchens, and shelters.

As of October 13, 2026, it lists 254 centers in 10 provinces. The code is open source under the MIT license, at github.com/demogar/acopiospanama.

In an emergency, call 911. The directory doesn’t replace SINAPROC or the authorities, and it says so on every page.

#.The Problem

A disaster brings out two kinds of people. Most want to help. A few take advantage: fake centers, requests for money, donations that never reach the people affected. In Panama we call that juega vivo.

So a useful directory has to do three things at once:

• Stay current without a team checking every listing, because a center that closed yesterday wastes someone’s trip today.
• Be easy to add to, because the people running centers are busy and won’t create an account with a password.
• Resist abuse, from scams to people trying to hide legitimate centers.

#.How It Works

The community keeps it up to date:

• Anyone can publish a center with just an email address, and becomes its manager. Up to five managers can share a center, so it doesn’t depend on one person.
• Anyone can confirm “I was there and it’s still open,” or report a problem.
• Automatic rules decide what’s shown. Human moderation is the last resort, not the daily job.

The first centers came from public announcements in the press, on official sites, and on social media, loaded in batches. From then on, anyone could add more.

Each listing shows the type of center, who runs it, the exact location with Google Maps and Waze buttons, opening hours by day with “open now,” what they accept, what’s urgent, and what they no longer need. A phone number appears only if that person agreed to share it.

The home page starts from what you want to donate, with urgent needs up front. It filters by province, type, “open now,” and “near me.” “Near me” is calculated in the browser, so your location is never sent.

#.Trust and Safety

Most of the design went into rules, because a directory like this is only useful if people can trust it.

• Listings can’t ask for money. Text that mentions Yappy, bank transfers, or account numbers can’t be saved. The filter normalizes text first, so writing “Y a p p y” or swapping in look-alike letters from other alphabets doesn’t get around it. Links and HTML are blocked too.
• Reports from two different people in 72 hours mark a center “verify before you go.”
• Three serious reports (asks for money, fake, donations don’t reach people, closed) hide it, unless more people confirm it than report it. If a manager confirms after the last serious report, it comes back, marked as disputed.
• “They published my data without permission” hides the contact details immediately.
• Published means good until shown otherwise. Centers don’t expire for lack of confirmations, because few people are maintaining the directory. A center stays until its manager closes it or the community reports it.

The site also reminds people, on the home page and on every listing: use verified channels, hand donations over in person, never send money, and report anything that doesn’t add up. Visitors from abroad get a link to donate to the Panamanian Red Cross instead.

#.Privacy

People are reporting and confirming in a crisis. They shouldn’t have to give up personal data to do it.

• No passwords. Sign-in is a one-time code sent by email. It expires in 10 minutes, is tied to the browser that asked for it, and has a limit on attempts.
• Confirmations and reports store no personal data. To count distinct people without keeping IP addresses, the API stores a keyed hash (HMAC) instead.
• Data expires on its own. Unverified accounts after a day, confirmations after 30 days, reports after 90, inactive or closed centers after 180.
• Moderators need a second factor, and sensitive actions ask for it again.
• Analytics are self-hosted and cookieless (Medama), and the page loads nothing external except the map tiles.

#.How It’s Built

A NestJS API with PostgreSQL, and a Next.js web app built with Mola UI, my design system, with a Leaflet and OpenStreetMap map. Both run in Docker on a small ARM server behind Cloudflare.

It had to ship fast and keep changing safely while people were already using it. So the delivery pipeline came first:

• Every pull request runs the full CI: lint, type checks, API tests against a real PostgreSQL, the web build, a dependency audit, CodeQL, and the Docker images.
• Merging to main deploys on its own. The server never builds; it pulls the new images and checks the health endpoint. An early fix made deploys continuous, so publishing doesn’t take the site down.
• Releases are automated. Pull request titles follow Conventional Commits, and release-please writes the changelog and cuts each version. Each deploy reports its version at /api/health.
• Backups are encrypted with age.

I designed it, made the product calls, and directed the work. Most of the code was written with Claude Code, and the commits credit it.

#.Built in Public

The project is open source and built in public. Code, design, copy, testing on real phones, and spreading the word all help, and the README and contributing guide say how. Pull requests from forks run CI only after a maintainer approves them, and can’t publish or deploy. The first contributions from other people are already merged.

#.Reflections

In an emergency, speed is a feature. The useful version of this site was the one people could use right away, not the polished one a month later. CI, automatic deploys, and automated releases are what made it possible to ship that fast without breaking things for the people already using it.

Trust has to be designed in. Blocking requests for money, counting reports by distinct people, and warning about juega vivo on every page aren’t extras. Without them, a directory like this could end up helping the people it’s meant to protect against.

Let the rules do the moderating. Nobody can watch a national directory around the clock. Clear, automatic rules, with people as the last resort, scale better than a moderator, and they’re the same for everyone.