Mobile app developer & product builder

The Home screen answers one question: what's my energy today and what should I do with it? A 0–100 dial, a one-line headline, and the day split into morning, afternoon and evening windows.

Peak and risk windows show the best hours to focus and the ones to be careful with, and each block loads on its own so the screen is never stuck on a spinner.

Squad turns it social: add friends, form groups and chat in real time over WebSockets.

Vibe runs one-on-one and group compatibility checks, and Me holds the personality profile and archetype card.

The readings come from a Python backend: FastAPI with PostgreSQL, Redis and Celery for the daily jobs, Swiss Ephemeris for the astrology maths, and an AI layer that writes the readings in plain language.

Subscriptions run through Razorpay and in-app purchase, with push notifications for the morning reading.

I built the app in Flutter, so one codebase runs on both Android and iPhone, with Riverpod for state and Dio for networking.

Playback streams adaptive HLS and picks the right quality for the phone and the connection, so video starts fast even on patchy mobile data.

Offline downloads are encrypted and kept in app-private storage, with a native Android layer for background downloads, so people can save episodes on Wi-Fi and watch later.

The catalogue covers movies, web series with seasons and a feed of short clips, with voice search, watch history and a wishlist.

Subscriptions run through UPI and Google Pay, SabPaisa and Cashfree on Android, and Apple in-app purchase on iPhone. Sign-in is by phone OTP.

Firebase handles push notifications, analytics and crash reporting, AppsFlyer and Branch handle attribution and deep links, and in-app updates and reviews are built in.

Behind it is a NestJS + MongoDB API with a Next.js admin panel for uploading and publishing content.

The storefront is Next.js 15 on the App Router, reading Shopify through the Storefront API and writing through the Admin API. Nothing about the catalogue is hardcoded: products, collections, blog articles and the shop's localisation all come from Shopify at request time.

Every Shopify read is wrapped in Next's use cache with a tag and a lifetime, so product and collection queries are cached for days and localisation for hours. A Shopify webhook hits /api/revalidate, which calls revalidateTag for products or collections — the client edits a price in the admin and the site follows without a deploy.

Shop filters are driven by a naming convention rather than code. Collections whose handle starts with collection- become the category filters and ones starting with family- become the olfactive families — Ambery Oud, Aromatic Woody, Floral Fruity Musk, Fruity Floral, Oriental Gourmand. Adding a sixth family is a new collection in Shopify, not a release.

Product pages are assembled from Shopify metafields and metaobjects: notes_accords, perfumer, ingredients, product_details, shipping_information, return_policy. The accordion on a product page is built from whatever metafields exist, with defaults underneath, so a product with no perfumer note renders cleanly instead of leaving a gap.

Pricing is multi-market. Middleware reads Vercel's x-vercel-ip-country header into a country cookie, the switcher writes a country_override cookie that always wins, and both feed Shopify's @inContext directive. The country list and currencies come from Shopify's Markets settings at runtime, so a new market is a dashboard change.

Markets cost cache entries, so I collapse them. Prices only vary by currency, and sending all thirty-odd countries to @inContext would multiply the product cache for identical results — pricingCountryFor picks one representative country per currency so they share an entry. The cart still uses the visitor's real country, where shipping and tax genuinely differ.

Login is email OTP through Supabase, on HEIR's own pages, and the Shopify customer is created behind it. /api/auth/complete-signup searches Shopify by email, falls back to searching by phone when Shopify rejects a duplicate number, then retries without the phone — Shopify treats customer phone numbers as unique and the signup form should not dead-end because of it.

A user_mappings table in Supabase joins the Supabase auth user to the Shopify customer id, with partial indexes on email, phone and user id filtered to is_active = true. The Shopify webhook keeps it honest: customers/create fills in the Shopify id on a pending row, customers/update syncs name and email, and customers/delete soft-deletes rather than dropping the row, so a deletion in Shopify never silently orphans a login.

The webhook verifies Shopify's HMAC-SHA256 signature against SHOPIFY_WEBHOOK_SECRET before it parses the body, and Indian phone numbers are normalised to +91 on the way in, because the same number arrives from Shopify in several shapes.

Reviews are Judge.me, read server-side by product handle and folded into the product page's Product JSON-LD as aggregateRating, but only when there is at least one review — Google drops the whole rich result for an empty rating. ATLAS currently shows 4.8. Customers can upload up to five photos per review; those go to a Supabase storage bucket behind a login check and a rate limit.

Public endpoints sit behind Upstash Redis sliding windows, tightest on the unauthenticated user-check route, because it is the one an attacker could use to enumerate phone numbers and every attempt costs a database query. If Upstash is not configured the limiters return null and the site still runs, which keeps local development simple.

Two Vercel cron jobs: /api/reconcile at 02:00 daily counts failed events and pending or failed customer mappings so drift is visible instead of discovered by a customer, and /api/keep-alive on Mondays and Thursdays pings Supabase so the project is not paused for inactivity. The admin monitor page at /account/admin reads the same failed-events table, gated on a single ADMIN_EMAIL match.

The whole site could be locked pre-launch. Setting SITE_PASSWORD makes middleware redirect everything except the unlock route to /site-locked, so HEIR could share the real domain with photographers and the perfumer before the collection was public. Unsetting it opens the site.

I built the storefront as a headless Next.js 15 app on Vercel reading the Shopify Storefront API, and left Shopify as the till, the catalogue and the admin. The tradeoff is that I own every page — a theme would have given me a product page for free — but a theme's product page is exactly the part that could not stay standard here.

Add to Cart does not add on the first press. It opens a measurement sheet with eight fields — chest, waist, hip, inseam, shoulder, sleeve length, bottom, armhole — pre-filled from the chosen size, and only finishes the add once she saves. Measurements are the order, so they are collected while she is still looking at the garment rather than chased over email a week later.

Those values travel as cart line attributes named with a measurement. prefix, which the server action filters on and Shopify shows as labelled rows against the order line. It also fixes a real bug: most pieces are a single Shopify variant with the size carried in the attributes, so without them the cart folds two sizes of one kurta into one line of quantity two while the order Shopify records has them as two.

"Visit store (book an appointment)" goes to an in-app route under the product, not to an external calendar. It carries the handle and the chosen size through, so the booking page shows that garment, prices the variant she actually picked rather than the cheapest one, and then mounts a Cal.com inline embed for ishikaajain/personal-appointment. The whole route is noindex — a booking flow tied to one product has no business in search results.

"Customise it" is a wa.me link with the message already written: "Hi, I'd like to customise: <garment name>". The number lives in one exported constant shared by the footer, the mobile menu and this button, because the way a customer ends up messaging a dead number is three copies of it drifting apart. It lands in the Interakt business inbox, not on someone's personal phone.

Every piece of merchandising copy lives in a Shopify metaobject rather than in the code: the announcement bar, the signup offer, the collection launch modal, the Instagram reel row, and contact form submissions. Each one has a setup script that sets access.storefront to PUBLIC_READ and turns on the publishable capability — the first because a metaobject is invisible to the Storefront API without it and fails silently, the second because Active/Draft then doubles as the on/off switch with no custom boolean and no deploy.

The launch modal's copy can contain {collection} and {discount} tokens, resolved at render from the referenced collection and the live Shopify discount. Neither is stored as text, so renaming a collection or dropping a discount from 10% to 5% cannot leave the popup promising something checkout then refuses.

Navigation filters by tag, not by collection. A piece is women's and a kurta set and georgette and party wear all at once, and a collection per combination would be unmanageable, so the mega menu composes queries like tag:"women" AND tag:"kurta-set". Each tag is quoted because Shopify's search syntax reads a bare hyphen as an operator and hyphenated tags are the norm here.

The client had already filled a Google Sheets workbook with one tab per product, labels down column A. Rewriting 24 tabs into my flat CSV template was the other option; meeting their format was the cheaper side to bend, so the importer reads both and dispatches on file extension. It tolerates "Rs 35000", "Rs. 60,000" and "Rs 1,52,000" by stripping every separator instead of interpreting it, because that last one is Indian grouping for 152000 and naive parsing reads it as 1.52. Each product goes in as one productSet call, which upserts on handle, so the corrected sheet the client always sends after the first pass updates the products instead of duplicating them.

Where the workbook was thin, I derived rather than invented. Gender and garment type come out of fixed positions in the SKU (IJ-MTO-W-3PC-001-GL-XS → women, and 3PC broken by the title because five are kurta sets and one is a skirt set), fabric from words in the free text, occasion from the category. All of it is written into a flat review sheet marked as derived, so a wrong guess is a cell the client corrects rather than a bug I have to chase.

The Admin API credentials are a Dev Dashboard app, which is issued a token that expires in 24 hours rather than a long-lived shpat_ one. So the token is exchanged with the client credentials grant, cached with a 60-second margin so a request cannot pick one up mid-expiry, and guarded by a single in-flight promise so a cold instance does not fire one exchange per concurrent caller.

Indexing is gated on purpose. The canonical origin comes from one environment variable that every canonical URL, OG image, JSON-LD @id and the sitemap derive from, so moving the site to its own domain is a dashboard change rather than a release. While the flag is off, robots.txt still allows crawling but publishes no sitemap — a blocked page can never be read, so Google would never see the noindex and could index the bare URL anyway.

The storefront is its own Next.js App Router app on Vercel, reading products, collections and articles through Shopify's Storefront API. Nothing about the layout is decided by a theme, and the brand's product photography gets to run full width.

Shopify keeps the parts worth not rebuilding: inventory, orders, payments, taxes, discount codes and the hosted checkout. The compare-at pricing behind every bottle — coconut oil at ₹665 down from ₹850, sesame at ₹475 from ₹600, safflower at ₹465 from ₹800 — is Shopify's own pricing, read through the API, so a sale is a price change in the admin rather than a deploy.

The collection page carries a filter drawer, a sort control and a grid-density switch. The range fits on one screen, so the useful action is not paging through results but comparing them side by side: the density switch lets someone go wide to read labels or tighten the grid to see all seven at once.

Product pages lead with the bottle, then give the size switch for 1L and 5L, the discount against the compare-at price, and the smoke point. The smoke point is the fact that decides whether an oil survives what you are about to cook, so it sits on the page rather than three paragraphs into a description.

Each product carries short, plain-language tags — Nutrient-Dense, Cold-Pressed, Gut-Friendly — instead of a nutrition table. The tradeoff is accepted deliberately: a tag is less precise than a panel, but it is read, and the detail still lives in the accordions underneath.

Reviews run on Judge.me, with the rating shown on the product page and on the cards in the grid, and a write-a-review form that accepts photos. Review images upload to Supabase storage rather than being posted straight to a third party, so a failed submission is recoverable.

Customer accounts run on Supabase with email OTP: no password to set, lose or reset, which suits a store people buy from every few months. The account area covers profile, order history and saved addresses, with orders read back from Shopify so the admin stays the single source of truth.

Merchandising the brand changes often is read from Shopify rather than written in code — the ₹999 free-shipping announcement bar, the home page's featured collections, the newsletter sign-up and the trust strip. The founders edit those in the Shopify admin they already use; the cost is one more place to look when something on the page is wrong.

Writes go through Shopify's Admin API behind the app's own API routes, never from the browser, and Shopify webhooks all land on one HMAC-verified endpoint that busts the matching Next.js cache tag. One URL and one secret to configure means a price edit in the admin reaches the live page without waiting out a cache.

A scheduled reconcile job re-checks what a dropped webhook would have missed, and an admin page lists failed events so a sync problem is visible instead of silent. Upstash Redis rate-limits the public API routes, because contact, newsletter and review endpoints are the ones that get hammered.

The contact page is a real form rather than a mailto link: name, email, an enquiry category and up to five image attachments, which matters for a food product where the complaint is usually a photo of a bottle. It sits beside a WhatsApp link, the brand's phone number and its Telangana plant address, and the submission is stored through Shopify metaobjects so nothing depends on an inbox.

The blog is Shopify-backed, with a load-more endpoint instead of numbered pages, and carries the cooking and oil-guide posts the brand uses to bring people in from search. Every page's metadata is generated from the Shopify data, so a new product or article is indexable the day it is published.