Fillout

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me a form builder that replaces Fillout — and know why this is ALMOST.

Forms with logic are a fortnight. What you are paying for is **writing a response straight into other systems** — a database product, a CRM, a spreadsheet — without maintaining an integration. Each of those is an adapter with authentication, field mapping, rate limits and a schema that changes underneath you. That maintenance is the recurring cost and the reason for the verdict.

STACK
- Node 20+ with Fastify, server-rendered HTML with a little vanilla JS
- SQLite through better-sqlite3, WAL mode
- One payment provider, hosted checkout
- Caddy in front

THE DATA MODEL
- forms: id, slug, name, version, definition_json, theme_json, status, published_at
- form_versions: id, form_id, version, definition_json, published_at — a submission records the version it answered, so an edit never rewrites what somebody said
- submissions: id, form_id, form_version, token, status, started_at, submitted_at, ip_hash, referrer_host, country, payment_id
- answers: id, submission_id, field_key, value_text, value_num, value_json
- files: id, submission_id, field_key, path, sha256, mime_detected, bytes, scan_status
- destinations: id, form_id, kind, config_encrypted, mapping_json, is_active
- deliveries: id, submission_id, destination_id, status, attempts, external_id, response_excerpt, next_attempt_at, at
- events: id, submission_id, kind, field_key, at — append-only, and where drop-off comes from

WRITING INTO OTHER SYSTEMS, THE PART THAT IS THE FEE
- A destination is an adapter with one interface: describe the target's fields, validate a mapping, write a record, and report what happened
- The mapping is explicit — this question goes to that field — validated against the target's live schema when it is saved and again before the first write. A silent mismatch means answers landing in the wrong column for a week
- Idempotent by submission id, so a retry never creates a duplicate record downstream. This is the single most important property, because retries will happen
- Retries with exponential backoff and a dead-letter list with a one-button replay
- Every attempt recorded with the response. A destination that quietly stopped working is the failure mode here, so alert on consecutive failures rather than waiting for somebody to notice
- Credentials encrypted at rest, and the adapter has a fixture and a test. Build the two you need, not twelve you do not

THE FORM
- Pages, fields, and conditional logic as an explicit expression tree over earlier answers — never evaluated code, with one evaluator used by the server and the browser so what is shown and what is accepted cannot disagree
- Calculated fields with a dependency graph, so a cycle is rejected at save time
- Field kinds: text, long text, number, email, phone, url, date, dropdown, choice, checkboxes, matrix, ranking, rating, address, signature, file upload, payment, hidden. Each with a parser, a validator, an accessible template and a CSV form
- Validated on publish: an unreachable page, an unknown reference or a jump past a required field is an error before anybody sees it

FILLING IT IN
- Every page a real POST, so back and forward work and a refresh loses nothing
- Progress saved per page and resumable by a token
- Works with JavaScript disabled apart from live calculations
- Accessible: labels tied to inputs, errors announced, a logical tab order, visible focus

UPLOADS AND PAYMENTS
- Streamed to disk with a hard limit as bytes arrive, type from content, an allow-list per field, EXIF stripped, served through signed expiring links
- Hosted checkout, and the amount computed on the server from the answers — never taken from the browser, which is the classic way a payment form is abused
- Marked paid only from a verified webhook, idempotent by event id

THE REST
- Notifications and autoresponders, conditional, with a per-recipient daily cap
- Results table, per-question summaries, and drop-off per page — which is how a long form gets shorter
- Export CSV and JSON, complete, including partials

OPERATIONS
- .env: DATABASE_PATH, STORAGE_PATH, BASE_URL, SESSION_SECRET, ENCRYPTION_KEY, HASH_SALT, SMTP_URL, PROVIDER_KEY, PROVIDER_WEBHOOK_SECRET
- Migrations on boot, each once; nightly backup off the machine, restore script
- Health endpoint reporting delivery failures per destination

WHAT MATTERS MOST
Idempotent delivery and validated mappings. A form that occasionally writes a duplicate record, or writes into the wrong field after somebody renamed a column, is worse than one that just collects answers.