FreeMRR — Verified Revenue Leaderboard

Product Overview & Core Mission

FreeMRR is a zero-friction, fully verified startup revenue directory built to eliminate the self-reported revenue lies that plague existing leaderboards and startup databases. Every MRR figure displayed on the platform is cryptographically anchored to live Stripe billing data — no manual entry, no founder guesswork, no inflated vanity metrics.

The platform's core philosophy: publish first, create an account later. Founders can submit a listing and connect their Stripe account in under two minutes without hitting a login wall. Account creation remains entirely optional at launch, dramatically reducing onboarding friction compared to every competitor in the space.

Stripe Connect OAuth & MRR Verification Engine

The verification backbone is a Stripe Connect OAuth integration that grants FreeMRR read-only access to a founder's Stripe account. Once authorized, a background sync worker fetches subscription and invoice data to compute a precise, real-time Monthly Recurring Revenue figure.

MRR Computation Logic:
- Active subscriptions are summed after normalizing billing intervals (weekly, quarterly, annual → monthly equivalent).
- Trial subscriptions are excluded from the verified figure to prevent inflated numbers.
- Cancelled-but-not-yet-expired subscriptions are tracked separately and flagged in the UI.
- All figures are recalculated on a scheduled sync cadence and timestamped for auditability.

The result is a single verified MRR value the market can trust — not a number a founder typed into a form.

Zero-Friction Onboarding & Claims Token System

FreeMRR's onboarding is engineered around a three-step flow designed to reach completion in under two minutes:

1. Submit — Founder enters company name, URL, and category. No account required.
2. Connect — Stripe OAuth popup opens. Founder approves read-only access.
3. Publish — MRR is computed and the listing goes live immediately.

To allow founders to manage their listing at a later date without forcing upfront registration, the system generates a secure claims token at submission time. This token is delivered via email and can be used to claim full ownership of the listing, attach a full account, and manage updates — preserving the zero-friction entry point while leaving a clean path to account ownership.

The token is hashed in the database using bcrypt, with only the plaintext version delivered to the founder's email. Even a full database breach cannot expose claimable tokens.

Frontend Architecture & Dark UI System

The frontend is a Next.js 14 App Router application with full TypeScript coverage. The leaderboard is server-rendered for SEO and performance, with client-side hydration for interactive filtering and category navigation.

Key Frontend Decisions:
- Framer Motion powers all leaderboard animations — entry reveals, rank changes, and hover states are GPU-accelerated and timed to feel premium without being distracting.
- TailwindCSS drives the design system. A carefully tuned dark palette with neon-blue accents mirrors the aesthetic of a Bloomberg terminal — authoritative and high-signal.
- Category filters are URL-state-driven, making every filtered view shareable and crawlable by search engines.
- Optimistic UI updates ensure the leaderboard feels instant even under network latency.

The typography and spacing system is deliberately oversized — large rank numbers, bold MRR figures, and minimal surrounding chrome put the data front and center.

Database Design & Supabase Backend

The persistence layer runs on Supabase (PostgreSQL) with Row-Level Security (RLS) policies enforcing strict data isolation between founder accounts.

Core Schema:
- listings: Stores company metadata, category, verified MRR, last sync timestamp, and claim status.
- stripe_connections: Stores encrypted Stripe access tokens linked to listings. Access tokens are AES-256 encrypted at rest.
- claim_tokens: Stores bcrypt-hashed claim tokens with TTL and single-use enforcement.
- sync_logs: Audit trail of every MRR recomputation, including the raw Stripe response hash for dispute resolution.

Background sync workers run on a scheduled cadence using Supabase Edge Functions, fetching updated Stripe data and writing new MRR snapshots to the sync_logs table. This preserves a complete historical record of every startup's revenue trajectory — a data asset with significant long-term value for the platform.

Security Model & Anti-Gaming Safeguards

Verified revenue is only valuable if it cannot be gamed. FreeMRR implements several layers of protection against manipulation:

- Read-Only Stripe Scope: OAuth authorization requests only the `read_only` scope — FreeMRR can never initiate charges, issue refunds, or access payment methods.
- Stripe Account Binding: Each listing is cryptographically bound to a unique Stripe Account ID. A single Stripe account cannot be linked to multiple listings simultaneously.
- MRR Floor Validation: Listings with verified MRR below a minimum threshold are flagged as unverified until the next sync cycle confirms the figure.
- Rate-Limited Syncs: Sync requests are rate-limited per Stripe account to prevent founders from triggering artificial spikes via rapid subscription creation and cancellation.
- Claim Token Expiry: Unclaimed tokens expire after 72 hours and are rotated on each re-send to prevent token enumeration attacks.