diff --git a/PROJECT.md b/PROJECT.md
index da4b91e..c965520 100644
--- a/PROJECT.md
+++ b/PROJECT.md
@@ -1,25 +1,26 @@
-# Canteen Asset Tracker — Project Structure
+# Canteen Asset Tracker — Project Structure (v3)
 
-Two projects, one API contract.
+Three projects, shared DB.
 
 ## Repositories
 
 ```
-~/projects/canteen-asset-tracker/           ← Web app (Python/FastAPI backend + SPA frontend)
+~/projects/canteen-asset-tracker/           ← Main app (technician-facing: scan, check-in, assets, map, nav)
 ~/projects/canteen-asset-tracker-android/   ← Android app (Kotlin, Jetpack Compose)
+~/projects/canteen-admin-server/            ← Admin app (users, customers, settings, exports, activity)
 ```
 
 ## Web App (`canteen-asset-tracker`)
 
 ```
 canteen-asset-tracker/
-├── server.py              FastAPI backend — all 78 API routes + DB logic
+├── server.py              FastAPI backend — core technician API routes (assets, checkins, visits, auth, OCR, upload)
 ├── openapi.yaml           **Shared API contract** — source of truth for both projects
 ├── assets.db              SQLite database (WAL mode, foreign keys on)
 ├── static/
-│   └── index.html         Single-page frontend (276 KB, self-contained)
-├── tests/                 pytest test suite (319 tests)
-├── uploads/               User-uploaded photos/icons
+│   └── index.html         Single-page frontend (technician UI: scan, assets, map, nav)
+├── tests/                 pytest test suite
+├── uploads/               User-uploaded photos
 ├── cert.pem / key.pem     Self-signed TLS certs
 ├── requirements.txt       Python deps (fastapi, uvicorn, pytesseract, pillow)
 ├── start.sh               Launch script (production)
@@ -28,10 +29,26 @@ canteen-asset-tracker/
 
 - **Port:** 8901 (HTTPS)
 - **URL:** https://canteen.ourpad.casa (NPMPlus reverse proxy → backend :8901)
-- **Admin URL:** https://admin.canteen.ourpad.casa (NPMPlus proxy ID 20, same backend :8901 — admin user login)
-- **Frontend:** Single HTML file — no build step, no npm. All JS/CSS/HTML in one file (~284KB).
-- **Backend:** FastAPI with SQLite (WAL mode). Auth via Bearer tokens. OCR via Tesseract.
-- **Tests:** pytest test suite + Playwright E2E browser tests.
+- **Frontend:** Single HTML file — no build step, no npm (~200KB, technician-focused).
+- **Backend:** FastAPI with SQLite (WAL mode). Auth via Bearer tokens. OCR via Tesseract. EXIF GPS extraction via PIL.
+
+## Admin App (`canteen-admin-server`)
+
+```
+canteen-admin-server/
+├── admin_server.py        FastAPI backend — admin-only API routes (users, customers, locations, rooms, settings, activity, stats, exports, geofences)
+├── static/
+│   └── index.html         Single-page admin frontend (settings, user mgmt, activity, reports)
+├── requirements.txt       Python deps (fastapi, uvicorn)
+└── run.sh                 Launch script (port 8900)
+```
+
+Admin functions separated into their own project:
+- **Port:** 8900
+- **URL:** https://admin.canteen.ourpad.casa (NPMPlus proxy → backend)
+- **Shared DB:** Uses same `assets.db` via `CANTEEN_DB_PATH` env var
+- **Auth:** Same login system as main app (admin role required for admin endpoints)
+- **Frontend:** Standalone SPA with Dashboard, Settings, Users, Customers/Locations, Activity Log, CSV Exports, DB Reset
 
 ## Android App (`canteen-asset-tracker-android`)
 
@@ -130,10 +147,11 @@ cd ~/projects/canteen-asset-tracker-android
 ./gradlew test                      # run unit tests
 ```
 
-## Recent Changes (May 2026)
+## Recent Changes (May 2026 — v3)
 
+- **v3 admin separation** — Admin functionality extracted to separate project `~/projects/canteen-admin-server/` (port 8900). Main `server.py` reduced from 3005→1946 lines by removing admin routes. Main `index.html` reduced from 7645→4228 lines by removing admin UI panels. Admin app live at https://admin.canteen.ourpad.casa.
+- **EXIF GPS extraction** — `/api/ocr` and `/api/upload/photo` now extract GPS coordinates from image EXIF data server-side (PIL getexif()) and return `{exif_gps: {lat, lng}}` alongside results. Raw file bytes preserved — no re-compression, no EXIF stripping.
 - **OCR fix** — Now extracts only the last 5 digits from Connect ID (e.g., `05912-095330` → `95330`). Added `raw_match` field to response for debugging.
 - **Barcode scanner fix** — Switched from `decodeFromVideoElement` to `decodeFromVideoDevice` with 1D-only format hints (Code 128, Code 39, EAN/UPC, ITF, Codabar). Added `TRY_HARDER` hint and 50ms scan interval for fast, reliable detection.
 - **Auto check-in** — New assets automatically check in with GPS on creation (all three entry modes: barcode, OCR, manual). Best-effort: silently skips if GPS unavailable.
 - **Service stability** — Added NPMPlus reverse proxy. Service runs as background process on port 8901.
-- **Admin password** — Updated to `Brett85!@`.
diff --git a/uploads/photos/32e6022eaa0245efb587c08451229499.jpg b/uploads/photos/32e6022eaa0245efb587c08451229499.jpg
new file mode 100644
index 0000000..c195631
Binary files /dev/null and b/uploads/photos/32e6022eaa0245efb587c08451229499.jpg differ
diff --git a/uploads/photos/39e4ba232cb64f3598ea6da760f55994.jpg b/uploads/photos/39e4ba232cb64f3598ea6da760f55994.jpg
new file mode 100644
index 0000000..77780fc
Binary files /dev/null and b/uploads/photos/39e4ba232cb64f3598ea6da760f55994.jpg differ
diff --git a/uploads/photos/90b47fb7e08b4585aed84098a79c8055.png b/uploads/photos/90b47fb7e08b4585aed84098a79c8055.png
new file mode 100644
index 0000000..2adf23d
Binary files /dev/null and b/uploads/photos/90b47fb7e08b4585aed84098a79c8055.png differ
diff --git a/uploads/photos/c94fd88435a94a6f9ec3e4f59aeefe38.jpg b/uploads/photos/c94fd88435a94a6f9ec3e4f59aeefe38.jpg
new file mode 100644
index 0000000..081cf6f
Binary files /dev/null and b/uploads/photos/c94fd88435a94a6f9ec3e4f59aeefe38.jpg differ