medienkundig
An interactive media-literacy startup helping adults roughly 45-80 recognize and respond to digital deception — phishing, scam calls, AI-cloned voices, and fake messages — in everyday situations. The product began in Design Science Research and is now in its funding phase.
Two-person startup team · My scope: target-group research, persona and scenario work, requirements derivation, product direction, and the brand & design system — logo, mascot, color, typography.
30-SECOND PROJECT READ
The project at a glance.
- Challenge
- Help adults roughly 45–80 recognise digital scams and practise what to do when a suspicious message or call arrives.
- My role
- Target-group research, requirements, product direction, persona and scenario work, brand and design system.
- Team
- Two-person startup team, supported by participant research and two police expert interviews.
- Timeline
- Startup · Funding phase · 2026
- What shipped
- A working MVP with onboarding, scenario-based measurement and guided learning exercises.
- Outcome
- The product has moved from its research origin into a startup funding phase; 241 usable survey responses and a field test reaching roughly 206 people inform the next stage.
Real people told us where to start
An open survey (241 usable responses, July 2026) plus two written expert interviews with Berlin police officers surfaced near-verbatim recurring scam openers, including the "grandchild trick" via SMS/WhatsApp, and a documented case of an AI-cloned family-member voice used in a "shock call."
“Respondents themselves named the actual barrier: not lack of knowledge, but lack of routine, time pressure, and fear of "doing something wrong" in the moment.”
Kapitel 4.2, bachelorarbeit-04-methode.mdWhat did I think would happen?
A MoSCoW requirements catalog — sorting each feature into must-have, should-have, and could-have — ties every requirement to an explicit rationale. Some of these were finalized once the field-test evidence came in, not before it.
Low-friction entry, no signup wall
Field test shows high first-time activation but a hard break at registration.
Frame signup as "save your progress"
The word "Konto" (account) triggered fear of data theft; the sign-up flow wasn’t understood.
Tinti, the octopus
The mascot came from real survey data, not a mood board. 40% of respondents wanted no companion figure at all. Of the remaining 60%, animal figures were preferred, and a follow-up survey testing specific animals found the octopus won 39% of all mentions (31 of 79) and was picked by 8 of 10 respondents at least once. Because of that 40% rejection rate, Tinti appears only sparingly, at onboarding and feedback moments, never persistently.
What did we use and why?
A pnpm monorepo: Astro marketing site plus a React/Vite webapp, 6 shared packages. Supabase (Postgres, row-level security, auth incl. anonymous sessions, storage, edge functions) was a deliberate call to skip building a custom app server. Docker Compose and Caddy locally; a Hetzner VPS via Coolify in production. Resend for email, Cloudflare Turnstile for bot protection, Sentry and PostHog for observability. Playwright, axe-core, and a custom design-system lint script, bundled as `pnpm verify` in CI. 52 SQL migrations · 13 exercise types defined, 7 functional at time of writing.
“AI delivers suggestions very fast and is sometimes convincingly wrong; as a sparring partner it’s extremely helpful, but architecture, tests and final decisions stayed our own responsibility throughout.”
Kapitel 6.3 — on building with Claude Code ("Vibe Coding")Every annotation traces back to shipped code
Real screenshots from the marketing site, annotated at the actual interactive elements — pulled straight from the repo, not invented placeholder syntax.
What we actually tested
Framed around ISO 9241-11 (effectiveness, efficiency, satisfaction), with a full planned method mix — moderated usability testing, think-aloud, eye-tracking, SUS, UEQ, plus PostHog/Sentry field telemetry.
Moderated usability test
Think-aloud, 2–4 participants, convenience sample from personal contacts.
Unmoderated field test
~206 people reached via WhatsApp / personal referral — no partner channel.
Eye-tracking, SUS, UEQ
Scoped out during the original thesis phase given the team size and research timeline.
Crunching some painful numbers
“The steep drop between the 86% who engaged with the onboarding questions and the 2% who registered is explained by qualitative feedback: the word "Konto" immediately triggered fear of data theft for part of the older target group.”
Kapitel 7.2.6, kapitel-7-evaluation-und-schluss.mdThis is a small, unmoderated field test with no partner channel — not a general conversion rate, and not an argument against the planned partner-channel (B2B2C) model.
What I would do differently
Get a second researcher
I both proposed the product and led the target-group research — a confirmation-bias risk I named but couldn’t fully rule out solo during the original thesis phase.
Test business logic, not just UI
A large share of the code was AI-supported — automated tests for business logic are still missing, and more urgent because of that, not less.
Ship the accessibility audit
ARIA and focus-ring work happened throughout, but a formal WCAG 2.2 / EN 301 549 audit still hasn’t — for this target group, that should have come earlier.
Only 7 of 13 planned exercise types are functional. A placement test is fully built but never wired up. An XP counter is computed correctly server-side but never rendered — a dead-wiring bug the team found itself. Supabase is a conscious single-vendor tradeoff, not an oversight.
Digital-Kompass / BAGSO and the police’s "Sicher Handeln" program are identified as viable partnership entry points. Banks and insurers are flagged explicitly as having no documented partnership precedent yet — a real open question, not an assumed yes.