A metal detector for salespeople. Draw a circle on a
map; it finds every local business inside it that looks like it needs what you sell, and writes each one a first
email that mentions something real about them.
Go to app.zipquarry.com. You land on a sign-in screen — there
is no password to remember.
Press Continue with Google. Google asks whether you agree to
let ZipQuarry send email as you; that permission is what puts a draft in your own outbox instead of
blasting mail from a stranger's server.
You come back signed in. The first visit walks you through what you sell, and
the postal address that has to appear at the foot of every cold email by law.
Accounts are invite-only while it is in beta. If you are not on
the list yet, the waitlist form on zipquarry.com is the way in.
There are no passwords stored anywhere. Sign-in is Auth.js with Google as
the identity provider and sessions kept in the database, so signing out on one device really does end that
session — nothing is trusted from the browser alone.
How it works
01
Draw a circle
Type a postcode and a distance. That is the whole search — a place, and how far you are
willing to drive.
02
It goes looking
It pulls every business in that circle, then scores each one on how likely it is to
actually want what you sell.
03
It writes the email
An AI drafts a personal first message from what it found. You read it, edit it, and
send it from your own inbox.
The scoring step is the point. A list of 400 businesses is not a
lead list — anyone can download a map. The work is deciding which twelve are worth an email this
week, and being able to say why.
How the pieces fit
Everything goes through the middle box. The browser never talks to
Google, Claude, Stripe or your inbox directly — it cannot, because the keys for those live
only on the server. That single choke point is also where the app checks who you are and whether your plan
still has searches left in it.
What it remembers
Read it left to right: one person runs a search, the search
turns up businesses, and each business earns at most one first email. The dashed box is the one
that matters legally — an unsubscribe is checked before every send, so a person who opted out cannot be
reached again even by a later search that rediscovers them.
Languages used
JavaScriptNode.js · the API and the tools50%
JSXReact 18 · the screens43%
SQLPostgreSQL · 28 migrations5%
CSSTailwind and design tokens2%
Roughly 37,000 lines of application code, plus a
marketing site in the same repository that is deliberately plain HTML with no build step — so a copy change
never needs a deploy pipeline to go out.
Technical skills
Frontend
JavaScript
React 18
Vite
React Router
TanStack Query
Tailwind CSS
shadcn/ui
Radix UI
Framer Motion
Recharts
Leaflet
Backend
Node.js
Serverless
REST API
Auth.js
OAuth 2.0
Cron jobs
Webhooks
Rate limiting
Data
PostgreSQL
SQL
Neon
Migrations
Multi-tenant
Zod
AI
Anthropic Claude
Prompt engineering
Structured output
Prompt evals
Lead scoring
Services
Google Places
Google Geocoding
Gmail API
Stripe
Sentry
Vercel
Practice
CI/CD
Git
Automated testing
Design systems
CASL
CAN-SPAM
By the numbers
30Database tables
38API endpoints
130React components
48Test suites
28Migrations
37kLines of code
Key achievements
01The whole product, alone — the screens, the API, the database
design, the AI prompts, the payments, the marketing site and the deployment.
02Made the AI's judgement checkable. Every score a business is
given is stored with the reasons behind it, so a number shown weeks ago can still be explained rather than
shrugged at.
03Built the unsubscribe path before the send path. Cold email is
regulated on both sides of the border; the opt-out list, the physical address requirement and the one-click
unsubscribe are enforced in code, not left to the user to remember.
04Took Google's OAuth review seriously. Sending mail as a user is
a restricted permission; the app requests the narrowest scope that does the job, and the consent screen,
privacy policy and domain were built to survive verification.
05Migrated it off a no-code platform. The product began on a
hosted builder and now runs on its own database, its own API and its own auth — without the users noticing a
gap.