Harrigan Home Barbados multi-vendor retail group Live

Harrigan Home loyalty platform

Installable PWA where partner stores publish deals and coupons, members earn points and tiers, and a live event mode runs bus-tour days with QR check-ins, AI-scored receipt challenges, realtime leaderboards and sponsor lead capture.

Web appapp.harriganhome.comNext.js 16 + Supabase PWA (members, vendors, admin)
Websiteharriganhome.comAstro 6 marketing + tour registration
app.harriganhome.com
Harrigan Home loyalty platform, desktop

Challenge

Harrigan Home wanted a loyalty programme that could survive a real event day: people signing up on their phones mid-shop, live check-ins at partner stores, receipt challenges, and a points balance nobody could cheat.

Approach

The app is an installable PWA on Postgres with row-level security throughout. Database triggers guard the points economy, so even someone holding the public API key cannot mint points. Event mode adds QR check-ins, receipt challenges scored by a vision model, and a live leaderboard. Before launch we attacked our own build in review passes and fixed the holes we found.

Outcome

The brief goes back to May, but we built the working app in a concentrated push of about three to four weeks, live for the Goods Tour on 25 July. That day 71 people joined, and the platform handled 220 check-ins, 56 AI-scored receipts and 13,110 points.

Numbers, with their dates

72
members (71 joined on event day)
Aug 2026
220
QR check-ins, 49 unique members on site
Jul 2026
56
receipts scanned and scored by vision AI
Jul 2026
13,110
points awarded under database guard triggers
Jul 2026
Web appapp.harriganhome.comNext.js 16 + Supabase PWA (members, vendors, admin)
Websiteharriganhome.comAstro 6 marketing + tour registration

Inside the product

Architecture

Next.js PWAmember · vendor · admin
SupabasePostgres · auth · RLS · realtime
AI servicesvision receipt scoring
VercelCI · hosting
member and vendor clients → application layer → row-level-secured data with guard triggers → realtime channels and notification fan-out

Security & standards

  • RLS throughout with adversarial review passes that found and closed real vulnerabilities before launch
  • DB trigger guards so points and approvals cannot be forged even with the public API key
  • Passwordless magic-link auth, branded SMTP
  • RFC 8058 one-click unsubscribe
  • 147 unit tests + CI

Stage & handover

Live Live public event day 25 July 2026; the working app was built in a concentrated push of about three to four weeks.. In production and in active development under agreement; 147 unit tests and CI gate every deploy.