Palmistica
A small, polished web app for AI palm readings grounded in real palmistry. Upload
or snap a photo of your palm, get a reading of your hand's element and the four
major lines, ask follow-up questions, and share the result via a permanent
unguessable link. No accounts.
Stack
- Next.js (App Router) + Tailwind CSS v4 — front end
- Next Route Handlers — API, deployed as Vercel Serverless Functions
- OpenRouter (OpenAI-compatible Chat Completions) — vision + chat, server-side only
- Supabase — Postgres for readings/messages, private Storage bucket for images
- Vercel — hosting
Local development
npm install
cp .env.example .env.local # then fill in the values below
npm run dev
Open http://localhost:3000.
Environment variables
| Variable | Where to get it |
|---|
OPENROUTER_API_KEY | https://openrouter.ai/keys |
OPENROUTER_MODEL | Any image-capable model id from https://openrouter.ai/models. Default inclusionai/ling-3.0-flash-vl:free (free, multimodal; reasons heavily before answering, so calls budget generous maxTokens). Swap to a paid vision model — e.g. google/gemini-2.0-flash-001 — with no code changes. |
SUPABASE_URL | Supabase → Project Settings → Data API → Project URL |
SUPABASE_SERVICE_ROLE_KEY | Supabase → Project Settings → API Keys → service_role. Server-side only. Never expose to the client. |
NEXT_PUBLIC_SITE_URL | Canonical origin for absolute share links and Open Graph images — set to https://palmistica.com in production (see Domain & Hosting below). Falls back to the Vercel URL, then the request host, if unset. |
RATE_LIMIT_SALT | Optional. Salts the IP hash used for rate limiting (lib/rateLimit.ts) so it can't be reversed even with DB read access. Any random string; has a safe built-in default if unset. |
CRON_SECRET | Optional but recommended. Vercel sends this as Authorization: Bearer <value> when it triggers the daily image-retention job; set it in Vercel too so the job can't be triggered by anyone who finds the URL. |
NEXT_PUBLIC_CONTACT_EMAIL | Optional. Shown in the footer as a fallback for anyone who lost the browser (and localStorage token) that created a reading and needs it removed manually. Omit to hide that line. |
NEXT_PUBLIC_TIP_LINK_1 / _3 / _5 | Optional. Stripe Payment Link URLs for the $1/$3/$5 support buttons (plain outbound links — no checkout code, no webhooks, no payment data ever touches this app). The tip strip only renders if at least one is set. |
Database schema
Run supabase/schema.sql against your project (or use the Supabase SQL editor).
It creates the readings, reading_messages, rate_limit_hits, and
deleted_readings tables with RLS enabled and no policies — every
read/write goes through the service role key on the server. Also create a
private Storage bucket named palm-photos.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
