About this project

FED-SPA is a static, no-backend directory of licensed massage establishments in Florida, verified against the Florida Department of Health Medical Quality Assurance (MQA) portal. The current release (2026.2, data as of 2026-09-11) contains 47 licensed records and 44 watchlist entries, covering establishments along the US-1 / Federal Hwy corridor from Fort Pierce to Homestead across 5 counties; the README notes 283 corridor listings remain unchecked for a future pass. The project is built around three stated constraints: no backend (static files only, updated once a year), no third-party code (Python stdlib, Node native crypto, vanilla JS/CSS, androidx core + appcompat, SwiftUI + CryptoKit), and an annual refresh cadence. Data ships in two tiers: a public licensed list in plaintext JSON (also exported as CSV) that anyone can audit or fork, and a subscriber-only watchlist of establishments where a documented MQA search found no license match, encrypted at rest with PBKDF2-SHA256 key derivation and AES-256-GCM and decrypted client-side only after entering a shared code. Each watchlist entry records the exact search terms and date, and the project stresses that a 'no license found' result is a prompt for questions, not a verdict. A single source dataset is fanned out to six surfaces by a generation script so the platforms cannot drift: an installable offline-capable web PWA, a Chrome Manifest V3 extension with a domain badge and quick popup, an Android app with deep links and a home-screen widget, an Android Auto surface, a wrist watch app, and an iOS SwiftUI app. Android Auto and the watch deliberately show licensed data only, a data-minimization decision documented in the project wiki. The annual refresh is a human workflow: a maintainer re-checks records against the MQA portal, edits the source JSON, validates against a schema, re-encrypts the watchlist, re-runs the fan-out script, and tags a release. Admin scripts include an MQA scraper, an encryption tool, a schema validator, and a public-file generator. Every record carries verified_by (the portal URL), last_checked, and data_as_of fields, and data corrections are accepted through issue templates. Privacy posture: no server, no accounts, no analytics, no tracking; the subscriber code is never transmitted and exists only in the browser session, opt-in local storage, or the device keychain equivalent. Code is MIT-licensed and the dataset is ODbL 1.0. The project is independent and unaffiliated with the State of Florida, and the data is a snapshot rather than a live feed — users are directed to re-verify on the MQA portal before making any decision.