EarlyBird, Next.js Waitlist App

Editorial, no noise. One thing to do on the page.

No feature list, no roadmap, no social proof from a product that has not launched. A waitlist page arguing hard for a product nobody can evaluate is asking to be distrusted.

One email when something ships. No drip campaigns. One click unsubscribe.

This is the actual product. The form is trivial, the commitment is not, and stating it explicitly is what makes someone give a real address rather than a throwaway one.

Putting it on the page also constrains what the product can become later, which is the point of writing it down.

Abuse prevention without retaining identifiable data.

This is the trade most signup forms get wrong in the other direction: they log the raw address indefinitely because it was easier, and then hold a table of IPs they never intended to keep. A salted hash supports rate limiting and duplicate detection without storing anything that identifies a person.

Partly to show range beyond PHP into the React and serverless stack.

Mostly because the decisions in it are small and defensible: store the minimum, enforce the boundary at the database, say what you will do with the address, and then do only that.

Each signup is a single Supabase row with row level security enabled.

The data boundary is enforced at the database rather than in application code. A query that forgets a condition returns nothing rather than returning the list, which is the correct failure mode for a table of email addresses.

One row, no profile, no enrichment, no tracking. There is nothing to leak beyond the address the person knowingly gave.