respondaja.click — Case Study
back- PHP 7.4
- Anthropic API
- Stripe
- HMAC
The question
A one-star review lands on a Sunday night. The right reply is not hard to write — thank them, acknowledge the problem briefly, invite them to continue in private, stay under eighty words, never admit liability. It is just that it takes twenty minutes, it comes out the same every time, and the person who runs a restaurant is not a copywriter. So why twenty minutes?
What I built
Paste the review — Google, iFood, TripAdvisor, anywhere — choose one of three tones, and get three replies in about ten seconds. Edit and publish wherever it came from. Five a month for free with no account at all; unlimited on a Pro tier at R$ 29 a month through Stripe. Portuguese and English. The market is Brazil.
- Three options rather than one, because the useful part is choosing
- The rules of the trade live in the prompt: thank, acknowledge, take it offline, under eighty words, never admit liability, never offer compensation the review did not ask for
- The free tier runs in the browser with no signup screen anywhere
- Pro cancels from Stripe’s own portal — no cancellation flow to build, and none to make deliberately hard
Technical decisions
No account on the free tier — what kills a tool like this is the signup screen, not the price. The free path never asks for an email, so the distance between pasting a review and having three replies is one click.
The key never reaches the browser — generation happens server-side. That is also the only reason a quota can exist at all: anything counted in the browser is a suggestion, not a limit.
Pro is a signed token, not a user table — after checkout the server verifies the session with Stripe and issues an HMAC-signed licence with an expiry. No accounts, no passwords, no personal data to protect, nothing to leak. The signature is compared with hash_equals, so a wrong one takes exactly as long to reject as a right one takes to accept.
The free count is client-side on purpose, and the code says so — an abused free call costs about a tenth of a cent, so per-IP hardening was priced and postponed rather than pretended. That reasoning is a comment in the repository, not a secret.
What I learned
It is finished. The payment path runs end to end — checkout, verification, licence, renewal — and it has never taken a single payment, because I never told anyone it existed. Building was the easy half, and it is the half I am good at. The lesson is not about code: from the outside, a product nobody has heard of and a product that does not work look exactly the same.