React Router 7
Shopify App Bridge
Shopify Admin GraphQL
Prisma
Postgres (Supabase)
Vercel
Status
In build, not yet submitted. The app is registered, the install and authentication flow is in place, merchant data is isolated in its own schema, and the mandatory privacy webhooks are implemented and tested.
Still ahead: the three reports rebuilt against Shopify's embedded UI, Shopify-native billing, and App Store submission.
Role
Product designer & engineer
Year
2026
Industry
E-commerce operations · SaaS product
Stack
React Router 7 · Shopify App Bridge · Shopify Admin GraphQL · Prisma · Postgres · Vercel
Links
The Problem
Pulse solved a problem that is not unique to Avnzor — but I had built it as though it were.
The internal dashboard reads Avnzor's Shopify store, but it also reads a MySQL warehouse database, a consignment supplier's stock feed, in-transit purchase orders, weather data and competitor prices. That mix is exactly what makes it sharp for one merchant and impossible for any other merchant to install.
Every Shopify merchant holding inventory has the same four questions Pulse was built to answer. The work here is separating the part of the system that only needs Shopify from the part that needs Avnzor — and turning the first half into something a stranger can install in two clicks.
In build: OAuth and embedded session handling, per-merchant data isolation, the mandatory privacy webhooks, and Shopify-native billing.
Key Decisions
Ship a wedge, not the dashboard. Three reports — Stock Risk, Sell-Through, Top Sellers — instead of twenty-eight pages. One clear job, a small support surface, and room to learn what merchants actually ask for before building more.
Adopt Shopify's own app framework rather than porting the Next.js build. I had already hand-written OAuth, token encryption and webhook verification. Shopify's React Router template provides all of it, plus embedded session tokens and the Billing API, as maintained library code. Those are the parts that are fiddly, security-sensitive, and where App Store reviews fail. Throwing away working code was the cheaper decision.
Isolate merchant data at the schema level. Every merchant-scoped table carries a tenant reference with a cascading delete, so an erasure request is a single statement that cannot silently miss a table.
Treat compliance as build work. The three privacy webhooks are tested code with an audit trail, not a checkbox — reviewers probe them with a deliberately invalid signature.
More Projects
