Przemysław Zalewski

From first commit to paying users

A SaaS developer who has shipped the whole thing, more than once

Founding engineer of a time-tracking SaaS on eight platforms, principal engineer of an email client that passed CASA Tier 2 and shipped to the App Store, and owner of a chat product that paid my bills for five years. Billing, tenants, SSO, stores, support. I have done each part and I know which one bites.

Book a free 30‑min call Email me instead

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
4app stores I ship to end to end: iOS, Android, macOS and Windows, plus the web
8platforms shipped for Sandtime.io as founding engineer
8,000+commits on one product, close to half of all merges
30,000concurrent users on my own chat app

Sound familiar?

SaaS problems I fix in 2026

Google wants a CASA security assessment for Gmail access?

Apps that reach Gmail or other restricted Google data through a server must pass a security assessment by a Google-approved assessor and repeat it at least every 12 months to keep those scopes (Google restricted scope verification).

I led a CASA Tier 2 assessment to a pass twice: in January 2026 and at the yearly reassessment in October 2026. On Patriot Mail I turned the CASA and OWASP ASVS controls into a Playwright suite that runs on every pull request, so the yearly renewal rests on evidence you already have. Online quotes for CASA ran to five figures a year; I found an authorized lab path for a small fraction of that.

Paying Apple’s commission on every US subscription?

Since Apple’s 1 May 2025 guideline update, apps on the US App Store storefront may include buttons and external links to purchases outside the app (Apple Developer News). The fee on those purchases is still open: in December 2025 the Ninth Circuit lifted the full ban on any commission and sent the case back to the trial court, and on 30 June 2026 the Supreme Court agreed to hear Apple’s appeal (IPWatchdog, 30 June 2026).

I add a web checkout with Stripe or Paddle next to in‑app purchase and keep one subscription state for both, so access always matches what the user paid for. I have shipped Paddle, Stripe and Mac App Store subscriptions.

Sound like you? Book a free 30‑min call →

Does the European Accessibility Act apply to my SaaS?

The European Accessibility Act has applied since 28 June 2025 to e‑commerce and other consumer services in the EU (AccessibleEU, European Commission). A consumer sign‑up or checkout that a screen reader cannot complete is now a legal risk.

On Patriot Mail, WCAG 2.2 AA sits behind an automated axe gate on every pull request, with text scaling to 200%. I set up the same gate in your app and fix what it finds, starting with sign‑up and payment.

Cyber Resilience Act: what must my app do from September 2026?

From 11 September 2026 the Cyber Resilience Act requires makers of software sold in the EU, mobile apps included, to report actively exploited vulnerabilities, and its main obligations apply from 11 December 2027 (European Commission).

I set up what lets you act on a report fast: a software bill of materials built on every release, dependency upgrades in waves you can revert and a pipeline that can ship a fix the same day. In October 2023, a year before this regulation was adopted, I set up a software bill of materials reviewed with every dependency change and checked every license.

Facing one of these? Book a free 30‑min call →

Why me

Week one has something to touch

An MVP is a vertical slice with a login, one feature and an event in PostHog, deployed. What the slice teaches us sets the order of everything after it.

Billing and tenants without drama

Paddle, Stripe, Mac App Store subscriptions, multi-tenant routing, SSO. I have shipped each of them. The boring parts of SaaS are where products stall, so I do them first and once.

Measured from day one

A tracking plan per feature before the feature is built. Activation, retention and revenue on dashboards leadership reads without asking me.

The founder’s inbox

I ran support for a product with 1.5M+ downloads myself. Users tell you what to build next if someone is listening.

Live demo

Plan your first four weeks

Pick a product type and the features you think you need. The planner lays them into four weeks, with something users can touch in week one, a PostHog event plan per feature and a Definition of Done. Copy it as Markdown and bring it to the call.

Demo loading…

Whatever can wait past week four lands in “after launch”. That is the point. Walk me through your plan on a free 30‑minute call.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Patriot Mail: an AI email client through CASA Tier 2 and onto the App Store

The problem
A greenfield AI‑native email client for web, iOS and macOS, built at Sanddev, needed Google’s CASA Tier 2 security assessment before it could read Gmail, and it had to work for older people.
What I did
I was the principal engineer at Sanddev. I wrote the delivery plan, shaped the product vision and treated prompt injection through untrusted email as a design constraint before any model touched a mailbox. CASA and OWASP ASVS controls became a Playwright suite that runs on every pull request. WCAG 2.2 AA sits behind an automated axe gate.
Result
I led CASA Tier 2 to a pass in January 2026, with third-party pentest findings fixed, and led the yearly reassessment, validated in October 2026; the questionnaire turned into a check on every PR. Live on the App Store on iOS and macOS since April 2026. Text scaling to 200% and a calm‑email mode shipped for older users. At that reassessment five items came back for missing evidence; I fixed the code first, then resubmitted updated evidence, and all five were accepted on 27 October.

CASA Tier 2 iOS + macOS WCAG 2.2 AA Open ↗

See also: Mobile & desktop apps · AI & agents

Offer: From an AI‑built MVP to a product people pay for

Sandtime.io, built at Sanddev: founding engineer, eight platforms, one codebase

The problem
A time-tracking SaaS had to live where people work: desktop tray, browser, phone and app stores.
What I did
I authored the original product vision and architecture in 2018 and made the first commit. React Native wrappers for iOS and Android, Electron for macOS, Windows and Linux, a Chrome extension, multi-tenant routing, SSO, Dockerized services, Paddle and Mac App Store subscriptions, CI/CD.
Result
Eight platforms shipped and run in production. The only engineer active in every year of the product, 8,000+ commits and close to half of all merges to trunk. In 2026 alone: 270+ tagged releases in ten months, about 99% of support answered by me, and a vulnerability disclosure program with a public Hall of Fame.

8 platforms 8,000+ commits since 2018 Open ↗

See also: Mobile & desktop apps · Maintenance & CI/CD

Offer: Your company tool, sold to other companies (SaaS)

A portfolio of AI tools, reported honestly

The problem
An email-marketing client had a portfolio of small AI tools and needed to know which ones were worth more money.
What I did
I measured real use instead of opinions: traffic, sign‑ups and a fake‑door test for a newsletter feature, then presented the results as they were, including what to stop.
Result
The fake‑door test showed negligible conversion and one tool had no real traffic, so I said so in the client deck and recommended exploring briefly, then focusing hard on what showed promise. The free invoice tool I had built was shut down on the same evidence.

fake‑door test stop what fails

Facing something similar? Book a free call →

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week SaaS & MVP code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

No product manager? Fine.

Where there is no PM I set priorities directly with the people using the software and answer support myself.

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Good to know

SaaS money facts founders find out late

Apple’s 30 percent drops to 15 after a paid year

Apple keeps 30 percent in a subscriber’s first paid year and 15 percent after that. Free trials do not count, and a gap of more than 60 days resets the count (Apple subscriptions).

The Small Business Program needs enrollment

Apple’s 15 percent rate is not automatic, and the 1 million USD cap includes associated developer accounts (Apple).

Google takes 15 percent on subscriptions from day one

Google Play charges 15 percent on auto-renewing subscriptions from the first day (Play Console Help).

OSS needs a return even with zero sales

EU VAT One Stop Shop returns are quarterly, due by the end of the next month, and a nil return is required when nothing was sold (European Commission).

Under 10,000 EUR, home VAT can apply

An EU seller under 10,000 EUR a year of cross-border consumer e‑services may charge home-country VAT; above it, the customer’s rate applies (Your Europe).

Stripe Tax does not register you

Stripe Tax calculates tax only where you are already registered. Registration and filing are separate, and Billing adds 0.7 percent of volume on top of card fees (Stripe Tax, Stripe Billing).

FAQ

Questions people ask before they book

An agency quoted us. Can you check the quote first?
Yes. 4 to 8 hours, $180⁠–⁠360 excl. VAT: the estimate line by line, the risks nobody priced, what can leave the MVP and whether the team plan matches the scope, in writing. Book the call and bring the quote.
How do you handle billing webhooks and tenant isolation?
Every webhook gets a verified signature and an idempotency key, and the billing provider stays the source of truth, so subscription state can always be pulled again. For tenants I prefer isolation at the database level over query filters alone; I have shipped both.
Should I validate the idea before building?
Yes, and cheaply. Run it through the free business idea validator: ten rubrics, a verdict from a fixed rule and three experiments you can do in two weeks without code. Bring the report to the call; it becomes the scope discussion. For a price range and start date, use the engagement configurator.
How long does an MVP take, and what does it cost?
The first shipped slice takes three weeks full time: $3,672⁠–⁠$7,452 excl. VAT for 102⁠–⁠138 h, priced before it starts. Details on pricing. The rest depends on scope. An email client with AI features went through CASA Tier 2 and App Store review.
Billing: Stripe, Paddle or the app stores?
Stripe for most web products, Paddle when you want the merchant of record to handle tax, app store subscriptions when the product lives in the stores. I have shipped all three and the receipt-matching bugs that come with them. Store specifics are on the mobile and desktop apps page.
Multi-tenant from the start?
Yes, cheaply: a tenant column, scoped queries, a routing rule. Retrofitting tenants into a live product means migrating every table and every query at once.
What happens after launch?
The dashboards tell us. Activation first, then retention, then revenue. I stay on as the engineer or hand over to your team with docs that match the product.
How soon can you start?
From 3 November 2026. Book the call and bring the four‑week plan from the demo.
Does Apple really take 30 percent of subscriptions?
Only in a subscriber’s first paid year, then 15 percent, and trials do not count (Apple subscriptions). Small developers enrolled in the Small Business Program pay 15 percent from the start (Apple).
Do I need Paddle, or can Stripe handle EU VAT?
Stripe Tax calculates VAT, but you register for OSS and file quarterly yourself, nil returns included (Stripe Tax, European Commission). Paddle as merchant of record carries that for 5 percent plus 50 cents per transaction (Paddle pricing).
Google wants a CASA security assessment for Gmail access?
Apps that reach Gmail or other restricted Google data through a server must pass a security assessment by a Google-approved assessor and repeat it at least every 12 months to keep those scopes (Google restricted scope verification). I led a CASA Tier 2 assessment to a pass twice: in January 2026 and at the yearly reassessment in October 2026. On Patriot Mail I turned the CASA and OWASP ASVS controls into a Playwright suite that runs on every pull request, so the yearly renewal rests on evidence you already have. Online quotes for CASA ran to five figures a year; I found an authorized lab path for a small fraction of that.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why did the SaaS founder bring a ladder to the meeting?Punchline

To reach the next pricing tier. Ba‑dum‑tss.

What did the MVP say to the investor?Punchline

“I’m minimum, but I’m viable.” Ba‑dum‑tss.

Why don’t SaaS founders swim in the sea?Punchline

Too much churn. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

Full‑stack & custom softwareScope to production, solo or as fractional tech lead.Live demo PostHog & product analyticsTracking plans, first‑party proxy, dashboards leadership reads.Live demo Mobile & desktop appsReact Native, Electron, PWA, every store that matters.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack