PinDrop: he built the platform, I told him what he couldn't see

The short version

A friend of mine built a platform with AI. No development background, no team. Three weeks from launch to real traction, all of it off one guy posting videos.

He brought me in for a flat fee to fix the one thing he could not get past. That took a day. Three days later we did a second session on the rest of the product.

I want to be clear about what this was, because it is the whole point. I did not build PinDrop and I did not write its code. He built it, and he kept building it while I sat next to him. What he paid for was somebody from outside walking the entire thing front to back and saying what was actually wrong. His words for it were better than mine: he cannot detach himself enough to see what a new person sees.

The infrastructure was the emergency. The product direction was the work.

How it started

Shawn and I go back a long way. He has pitched me a lot of ideas over the years. This is the first one I looked at and thought, okay, that is real.

PinDrop is a map. Businesses near you show up green if they have a website and gold if they do not. Tap a gold one and it scrapes their Google listing and builds them a website in about six seconds. Then you edit it, publish it, and charge the business owner without leaving the app. There is also a mode where you drive a car around the map, which is the part that went viral.

Thirty million business records. Behavioral email sequences. Automatic payment splitting so the person who sold the site and the platform both get paid. He built all of it himself and he will tell you straight out that he is not a developer.

I want to be blunt about that, because I hear constantly that you cannot build real things this way. I was looking at a real thing, with real customers, taking real money.

Session one: the thing he actually hired me for

Custom domains were broken. Someone builds a site for Bob’s Diner, Bob wants it at bobsdiner.com, and it would not work. I quoted a flat fee, he came to my house, and we sat down and fixed it.

The problem was one setting, and it was not the one it looked like. Cloudflare sells a product for exactly this, where your customers point their own domains at your platform. He had already turned it on. Certificates were issuing. The dashboard said Active. And every custom domain still failed.

His code was set to run only on addresses ending in his own domain. A customer’s domain does not end in his domain, so his code never ran for those requests. Cloudflare took the request, went looking for somewhere to send it, found nothing, and timed out. It looked like a certificate problem. It was a routing problem. The green Active badge was telling the truth about the certificate and nothing at all about whether the thing worked.

We tested against a domain of mine and against a real customer of his whose DNS was not on Cloudflare. Both worked. The second one mattered, because it proved the fix worked for anybody rather than just people who happened to use the same provider he did. That customer had been broken since the day they signed up and started working without touching anything.

The thing nobody hired me to look for. While I was in there I noticed every website the platform published was creating its own DNS record. One per site. The account was about two thirds of the way to a hard cap on the plan he was on.

That cap is not a warning or a slowdown. Hit it and publishing stops, for everyone, and he was signing up people by the thousand. It would not have taken the platform down, but the thing his customers pay him for would have quietly stopped working in the middle of his biggest week.

Nothing surfaces that number. It is one line at the top of a page you have no reason to open.

The fix is a single wildcard record replacing all of them, and the reason that matters is that the obvious alternative is to upgrade the plan and pay for the headroom. He did not need to. Before deleting anything we proved it on one live site, removed its record, and confirmed the page still served identical content through the wildcard.

And one that only showed up once the system could report honestly. Almost every connected domain had been stuck, and it was not a code problem. Every customer was getting the same instructions no matter where their DNS lived.

A bare domain cannot be pointed at another name the way a www address can. That is a rule of DNS with no workaround. Some providers built a non-standard extension that does it anyway, sold under three different names. Most never did. So the same instruction is correct at Cloudflare, Namecheap, Porkbun and Netlify, and structurally impossible at GoDaddy, Squarespace, Wix and Route 53. Nothing in the product said which world you were in.

The answer is provider detection: look up where the domain’s DNS actually lives the moment someone types it, then give instructions that match the screen they are looking at, in that provider’s own vocabulary. Somebody hunting for “ALIAS” in a dropdown that says “ANAME” decides it is impossible and quits. I mapped out which providers can do what and why, he built it, and it went out the same night.

Eleven deploys came out of that day, between quarter to five in the afternoon and quarter past eleven at night. He pushed all of them. My job was to say what needed pushing.

Session two: where the product goes

Three hours, in person, straight through the entire thing. Signup, onboarding, the trial, checkout, the builder, the editor, the mobile app. I went through it as a new user would, from the ad link forward, which is the one thing the person who built it cannot do.

Almost none of it was infrastructure, and this is the part of the engagement that actually mattered.

Who is on the other end

Before any of the product questions, the one that governs them: who is actually buying this.

Not developers. Not people who want to learn how a website is built. Overwhelmingly people trying to make money on the side, who bought a tool because they want a result they can sell to a local business owner. That is not a criticism, it is a spec. It changes what “good enough” means, it changes how much the product should decide on their behalf rather than expose as a setting, and it changes which complaints are real signal and which are somebody who never tried.

You cannot design this thing the way you would if you were selling to a developer of ten years. Most of the specific calls below fall out of that one.

Templates are the wrong bet

The builder was template-first: pick a look, then adjust it with a sidebar of toggles. That is the shape almost everyone in this category has copied.

We went and looked at what the leader in the space actually did over time, and the history is the argument. They started prompt-only. They added a full visual editing panel, the click-an-element-and-change-a-setting kind. Then in June they killed it and replaced it with a preview toolbar where you select an element and describe the change in plain language. The panel of toggles is not the future of this. It is the thing the company furthest ahead already tried and walked back.

So the recommendation was to add a genuinely bespoke, prompt-driven path alongside the templates. He asked me straight out to choose between a contained version he could ship in a week and a real one that would take several. I told him the real one, and why, and what the risk is: you are handing your users a model, so if you do not put hard guardrails in the system prompt they will hit strange output and blame your product, not the model. The counter is that when someone prompts their own site, the result being off is partly theirs. That is not true of a template you shipped.

He was building it before I left. The first generation came back in forty nine seconds and cost six cents.

A few calls that came out of that. Keep the click-to-select behaviour, because clicking supplies precision that describing in words does not. Default the prompt-built sites to preview mode rather than open editing, because if the pitch is that you talk to it, you do not want people poking at toggles by reflex. Do not inherit the old template editor wholesale onto the new path. And run a pass after generation that tags every text as text and every image as image, or the bespoke path loses the editor that makes PinDrop PinDrop.

Two rules that quietly cost you a year

Both came up because the product was breaking them.

Choosing how something looks must never change what you are able to do. Some templates supported adding a section and others did not, so the same editor did different things depending on a cosmetic choice made earlier. That is the trap early WordPress themes fell into and never climbed out of.

A control that toggles between two views of the same information must only change the presentation. Same information, shown differently, is the entire contract of that control. If it also changes functionality, you have taught people they cannot trust it.

The funnel, walked as a stranger

Going through signup and checkout cold surfaces things nobody inside the product sees, because they never take that path. A handful were structural rather than cosmetic: pages that report the wrong outcome to the systems reading them, moments where the product says something the user was not expecting and gives them no way to act on it, and copy written by somebody who already knows how the product works. Small fixes, disproportionate effect, and all of them invisible from the inside.

Pricing, and what is actually defensible

Generation costs about six cents. That is the fact everything else hangs off.

At that marginal cost, promotional mechanics get cheap and interesting: timed credit discounts, randomized, announced by email and on the dashboard. And if somebody wants to sit in the editor and iterate all afternoon, charge the markup. There is no reason to design around the cost.

The bigger one is defensibility. A pure prompt-to-website product is not defensible on its own, because it is a wrapper around a model whose maker will eventually ship the same wrapper. We looked at one doing real revenue and the honest read is that it is renting a position. What PinDrop has that they do not is the line: find the lead, build the site, sell it, host it, split the payment. Nobody upstream is going to string that together. The builder is not the moat. The chain is.

We also agreed on something not to do. Handling customers’ own API keys and integrations is available and tempting, and the day you take it on you become an infrastructure company with a security surface you did not sign up for. Not now.

The actual constraint

The longest conversation of the day was not about a feature.

He has around thirty open items and an endless supply of new ones, and he can now build nearly any of them in an afternoon. Execution has stopped being the constraint. Choosing has become the whole job, and nothing in his process was ranking the list.

You can spend a week shipping the fifteen least important things you have written down. The cost is not the wasted week. It is the people who left while you were polishing something nobody was blocked on.

What he needs is not a bigger list. It is something that re-ranks the list every time it changes, against a clearly stated mission, with a human accepting or rejecting the re-rank. Not mass changes made on his behalf. An ongoing audit that keeps the top of the list honest.

What is still open

One thing I could not solve, and I am not going to pretend otherwise.

If a customer’s domain is at a provider like GoDaddy and they want the bare domain with no www, there is no clean way to do it. That is a limitation of DNS, not something you code around. Cloudflare sells a fix and it is an enterprise product. For now the answer is a subdomain, or forwarding at the registrar. Both work. Neither is elegant.

I wrote it up as an open constraint rather than burying it, because the next person on this will hit it and should not have to rediscover it.

What it added up to

The product was fine. Sites generated, people paid, marketing worked. What was wrong sat underneath it, and every layer was quiet. The record limit does not warn you. The status badge said Live. The certificate just never issued.

That is almost always where it is. Not in the thing that is visibly broken, in the thing that is confidently reporting success.

But the infrastructure was the easy half. Anybody good would have found it. The harder question was the one he could not ask himself, because he is inside it: given who is actually buying this, and given that building is no longer the bottleneck, what should this product be next. That is the part you only get to once somebody trusts you enough to ask.