AnotherSchedulr

Multi-tenant booking platform for service businesses: white-labeled booking pages, deposits, no-show protection and intake forms.

Next.js
Prisma
PostgreSQL
Square

A full booking product for solo operators and small service businesses. Each tenant gets a branded booking page on their own subdomain, a calendar with real availability rules, deposits or saved-card no-show protection, intake forms, reminders and reports. One flat plan instead of per-seat pricing.

Problem

The problem

Lash techs, salons, coaches and consultants need a booking page, a calendar, deposits and no-show protection, and they end up paying per-seat prices for tools like Acuity to get it. Most of them are one person. They need the whole flow to work without a setup consultant.

Solution

The solution

A Next.js App Router monolith over PostgreSQL with Prisma. A middleware layer rewrites tenant subdomains to the public booking route, applies a per-request-nonce Content Security Policy and rate-limits traffic. Two surfaces share the codebase: a sessionless public booking flow (service, add-ons, availability, intake form, payment) and an authenticated dashboard for calendar, services, clients, email templates and reports. Reminders and follow-ups run on scheduled jobs.

Highlights

Interesting details

Processor-agnostic payment layer with three modes: percentage or fixed deposit, full payment, or save-card, where the card is vaulted at booking and a capped no-show fee can be charged later. Connected-processor tokens are encrypted at rest, keeping PCI scope at SAQ A.
Availability engine built around practitioners as calendars, with rule and override models and a strict wall-clock versus timezone separation so slots render correctly in the visitor's zone.
Test pyramid: Vitest unit and integration projects (integration refuses to run without an explicit test database flag) plus 17 Playwright end-to-end specs including axe accessibility and Lighthouse checks.
Defense in depth: 34 Prisma models scoped by owner on every query, row-level security enabled on every public table, nonce plus strict-dynamic CSP in production and distributed rate limiting.
Scheduled reminders driven by Postgres cron posting to a secret-protected route, transactional email through AWS SES with a rich-text template editor.
Private intake file uploads through signed URLs with server-side object verification and an orphan sweep.

Tech stack

Built with

Next.js 16
React 19
TypeScript
Tailwind CSS v4
Prisma 7
PostgreSQL / Supabase
NextAuth
Square SDK
Stripe Connect
AWS SES
Upstash Redis
Sentry
Vitest
Playwright
Vercel