Why this one
Most starter kits optimise for the feature list. TanBase Mobile optimises for the week after you buy it.
- Zero-config first run. CI builds the repo on Android and iOS with no credentials at all — the exact state you're in after cloning. Every integration is optional and degrades gracefully instead of crashing. You get a setup checklist screen, not a stack trace.
- App Store compliance built in. In-app account deletion (guideline 5.1.1(v)), terms and privacy reachable from the paywall (3.1.2), native Sign in with Apple (4.8). These are the rejections that cost you a review cycle.
- Server-side entitlement gating. The paywall gates the UI; an
entitlementstable synced by a RevenueCat webhook gates your data with Postgres row-level security. A patched client can fake a paywall — it can't fake a policy. - RTL-verified i18n. English, Spanish and Arabic ship translated, with a live language switcher and widget tests that pump the app in Arabic and fail on layout breakage. Any kit can claim "i18n-ready"; this one proves it.
- Comments explain why. PKCE double-handling, FCM token conflicts, webhook idempotency, fail-open version gating — the tricky decisions are documented where they live.
How it compares
| flutter create | Typical starter kit | TanBase Mobile | |
|---|---|---|---|
| Email + Google + Apple auth (native sheets) | — | yes | yes |
| Password reset, deep links | — | partial | end-to-end |
| Subscriptions + paywall | — | yes | yes, plus server-side RLS gating |
| Push notifications | — | client only | incl. edge-function sender, multi-device |
| In-app notification inbox + live badge | — | — | yes, over Supabase Realtime |
| Account deletion (App Store 5.1.1(v)) | — | rare | yes |
| i18n | — | scaffold only | EN/ES/AR shipped, RTL-verified |
| Analytics | — | hardcoded vendor | swappable service + screen tracking |
| Force-update gate | — | — | yes, Supabase-backed, fail-open |
| Builds with zero config | yes | rarely | enforced by CI on both platforms |
| Backend included | — | varies | 9 migrations, RLS, 3 edge functions |
What's included
Auth — email and password with the full reset flow (email to deep link to new password), native Google Sign-In, native Apple Sign-In on iOS, recovery-link routing. Analytics events on every auth action.
Monetisation — a RevenueCat paywall (offerings, purchase, restore), a subscription-management screen, a requireEntitlement() gating recipe, entitlements synced to Postgres through a secured webhook, and a sandbox-testing guide. Optional: no keys, no crash.
Notifications — FCM push end-to-end, with an edge function using FCM v1 and a service-account JWT, foreground display, tap-to-route, and multi-device tokens with stale-token pruning. Plus an in-app inbox with a realtime unread badge, so a push lands in both places and users can turn pushes off in Settings.
App shell — onboarding, a four-tab shell, a home dashboard example, infinite-scroll Explore built on PaginatedNotifier<T>, a profile with avatar upload, and settings covering theme, language, notification preferences, subscription, legal and account deletion.
Compliance and hardening — an account-deletion edge function that clears storage, auth and cascades; privacy and terms screens; a force-update gate; an in-app review prompt with sane trigger rules; and universal-links templates with routing.
i18n — gen-l10n with 118 keys across three locales, a persisted language override, RTL-correct layouts, and CI that fails on untranslated keys.
Analytics and crash reporting — an AnalyticsService interface you can point at another vendor in one file, a typed event taxonomy, router screen tracking, and Crashlytics wired to both error channels.
Supabase backend — nine migrations covering profiles, RLS, storage, device tokens, notifications, entitlements and app config, with policies that explain themselves. Three edge functions: push sender, account deletion, RevenueCat webhook. Seed file and full CLI config, so supabase start just works.
Developer experience — a setup screen instead of first-run crashes, a rename.sh that rewrites display name, bundle ID, Dart package, deep-link scheme and notification channel in one command, --dart-define credential hygiene with gitignored script copies, 51 tests, and a 12-widget component library on a three-file design-token layer.
Stack
| Layer | Choice |
|---|---|
| Backend | Supabase — Auth, Postgres with RLS, Storage, Edge Functions, Realtime |
| State | Riverpod 3, manual notifiers, no codegen |
| Navigation | go_router 17 |
| Monetisation | RevenueCat via purchases_flutter 10 — optional |
| Push, crashes, analytics | Firebase FCM, Crashlytics, Analytics — optional |
| i18n | flutter_localizations + gen-l10n, EN/ES/AR |
| Fonts | Inter, bundled, no runtime fetching |
Twenty-two direct dependencies, all earning their place. No build_runner, no codegen, no dead weight.
What's not included, on purpose
Honesty saves us both a refund. There is no CMS or admin dashboard, no chat or social feed, no AI integration, no web or desktop target — Android and iOS only — and no phone-OTP auth. The legal screens are structured placeholders; bring your own policy. If your app is mostly one of those things, this isn't your kit.
Roadmap
Buyers get these as free updates: an AI service layer built on a secure edge-function LLM proxy with streaming and rate limiting, phone-OTP auth, and more languages.