How to build an internal tool or CRM for free

Build it with

The stack

Every pick has a free plan you can launch a business on, unless it says otherwise. Free tiers checked 2026-10-27.

Start from open source

Worth studying before you prompt, or self-host one instead of building from scratch.

UI kit and libraries

AI skills and MCP servers

Guides and connections that make your AI builder produce better code.

• Lovable: Prompting best practicesService

  Plan the product and key user action first, build UI one component at a time, use real copy and style keywords, ask questions in Plan mode.

• Bolt: Prompt effectivelyService

  Plan the app and first prompt, use Enhance prompt, and make small one-at-a-time changes.

• v0: How to prompt v0 + Vibecoding GuideService

  Describe the product surface, context of use, and constraints and taste (2025-12-15); the Academy guide adds patterns and starter prompts.

• AGENTS.mdMIT

  Open 'README for agents’ format stewarded by the Agentic AI Foundation (Linux Foundation); used by 60k+ open-source projects.

  Add an AGENTS.md file at the repository root

The plan

1. 1

   Write down the plan

   30 minutes
   • Name the people who use it and the one job it does for them.
   • List the screens: Team login with roles; Tables with search, filters and sorting for each record type; Forms to add and edit records, with validation.
   • Sketch them on paper or in Excalidraw. Rough is fine.
   • Download this kit as AGENTS.md and keep it in your project: it’s the brief your AI tool reads first.
2. 2

   Set up the foundation

   Day 1
   • Start a new Lovable project and paste the prompt below.
   • Connect Supabase from Lovable’s integrations, then turn on email and Google login.
   • Publish it and open it on your phone to check it works.
   • Connect the project to GitHub so you own the code.
   Prompt for Lovable

   Build an internal tool or CRM: an internal tool or CRM (a CRM for a small agency)
   The main screens: Team login with roles; Tables with search, filters and sorting for each record type; Forms to add and edit records, with validation.
   Use Supabase for the database and login (email and Google). Turn on row-level security on every table so people only see their own data.
   Use shadcn/ui components, a clean light design, and make every screen work on a phone.
   Don’t add payments yet. Start with sample data so I can click through it.

3. 3

   Build the core

   Days 2–7
   • Team login with roles
   • Tables with search, filters and sorting for each record type
   • Forms to add and edit records, with validation
   • Import from your current spreadsheet (CSV)
   • A dashboard with the numbers the team checks every day
   Prompt for Lovable

   Now build these, one at a time, and let me test each before the next:
   1. Team login with roles
   2. Tables with search, filters and sorting for each record type
   3. Forms to add and edit records, with validation
   4. Import from your current spreadsheet (CSV)
   5. A dashboard with the numbers the team checks every day
   Add search with Postgres full-text search.

4. 4

   Get it ready to launch

   Week 2–3
   • Add PostHog and track the one action that means it’s working (a booking, a sale, a sign-up).
   • Add Sentry so errors reach you before users complain.
   • Go through the launch checklist below.
   • Add a privacy policy and terms, then connect your own domain.
   • Show it to ten people who have the problem, and watch them use it.
   Prompt for Lovable

   Review the whole app for security and launch problems before I go live:
   - every table has row-level security (or server-side checks) and I can’t read another user’s data,
   - no secret keys in the browser bundle or the repo,
   - inputs are validated on the server, and sign-up, login and forms are rate-limited,
   - error pages and empty states exist for every screen,
   - it works on a phone and with the keyboard.
   List what you find, fix the serious ones, and tell me what’s left.

Before you launch

• Row-level security (or server checks) on every Supabase table, tested with two accounts.
• No secret keys in browser code or in git. Rotate any that leaked.
• Server-side validation for every form, plus rate limits on sign-up and login.
• Your sending domain verified (SPF, DKIM), so emails reach the inbox.
• Backups: know how to restore your data (free database plans often have none).
• Privacy policy, terms, and a way for people to contact you.
• Error alerts on, and an uptime check on the home page.
• Tested on a phone, with a keyboard only, and with a slow connection.

Risks to plan for

• A spreadsheet or Airtable may already do the job: check Buildict's Airtable verdict.
• Decide early who can see and change what.
• Keep a CSV export so the team is never stuck.

Building something close to airtable? There’s a step-by-step Build Blueprint with the full database schema.