OrbitCubs CRM — a project by Ahsan Mahmood
A three-surface CRM (web, Android, browser extension) for tracking contacts, deals, and pipelines for solo operators and small teams.
A CRM is only as good as the moment somebody actually updates it.
Everything else is downstream of that. The pipeline view, the reporting, the reminder that a deal has gone quiet: all of it assumes the record is current, and the record is current only if updating it was easier than not bothering. Most customer relationship software loses at exactly that point rather than at any of the ones its feature list is about.
So this one is three surfaces rather than one.
There is a web application. There is an Android build. And there is a browser extension that captures contacts and notes from whatever page is open.
They are not three products. They share one core of services, so how a deal is stored is decided once and every surface inherits it, which is the only version of this arrangement that does not end in reconciliation work.
The extension is the surface that answers the update problem.
A contact usually appears while you are reading something else. A profile, a company page, an email in a browser tab. A CRM that requires leaving that page, finding the right screen and retyping what is already on screen is a CRM updated at the end of the week, from memory, badly. Capturing in place removes the switch, and the switch is the whole cost.
What each surface is for differs, and pretending otherwise would waste them.
The extension captures. The phone is for checking something between two meetings. The web application is where pipeline work actually happens, because that is work with a keyboard and a wide screen behind it. Building the same interface three times would have produced three mediocre versions of one.
Underneath sits a client-side architecture with no serverless functions.
Firebase holds authentication and the database, uploads go to FilesHub rather than cloud storage, and device state uses the platform's own preferences. The client talks to the database directly, under its rules.
That choice moves the security boundary somewhere specific and it is worth being explicit about where.
With no trusted middle layer, the database rules are the boundary. There is no server-side code to check a caller's intent afterwards, so a rule that filters instead of refusing, or a list query that does not prove its own permission from its own filters, is not a subtle flaw. It is the whole gate. Building this way is cheaper to run and less forgiving of a careless query, and the second half of that sentence is the part that matters.
There is a documentation repository beside the product, which is less common than it should be.
A CRM built for solo operators and small teams gets handed over, or picked up again after six months away. Both are the same problem: somebody needs to understand a system nobody is available to explain. Documentation written while the thing is being built is documentation that matches it. Written afterwards, it describes what somebody remembers.
What it cost is confirmation.
The web application is live. The record does not confirm that either the Android listing or the extension listing has been published, and this page will not fill that in on the record's behalf. Three surfaces built is a different claim from three surfaces shipped, and the difference is exactly the kind a portfolio blurs when nobody is checking.
What it does, and what that costs to build
- Contact tracking and management
- Deal and sales pipeline tracking
- Browser extension to capture contacts and notes from any web page
- Capacitor Android build with feature parity
- Firebase Auth sign-in across surfaces
- Client-side architecture with FilesHub for uploads
- Form handling with react-hook-form and zod validation
- Shared core services across web, mobile, and extension
Built with
- React 19
- TypeScript
- Vite
- Firebase
- Firestore
- TanStack Router
- TanStack Query
- Zustand
- Radix UI
- Tailwind CSS
- Capacitor
- WXT
Worth knowing
- crm
- contact-management
- pipeline
- browser-extension
- capacitor
- firebase
- react
- sales
Who built OrbitCubs CRM?
Ahsan Mahmood built it alone, and the web application is at orbitcubs.aoneahsan.com. One person wrote the shared service layer, the web interface over it, the Android packaging and the browser extension that captures contacts from a page. There is a separate documentation repository as well. Building three surfaces over one core is a decision that only pays off if the same person holds all three, because the moment they diverge somebody has to reconcile them.
What does the browser extension actually do?
It captures a contact or a note from whatever page you are looking at, without leaving it. That is the whole argument for the extension existing: a CRM that requires you to switch tabs and retype what you just read is a CRM that gets updated later, which usually means never. Whether any given site's markup gives up something useful is a question about that site rather than about this extension, and no claim is made here on their behalf.
Are all three surfaces the same application?
They share the same core services rather than the same interface. The web app, the Android build and the extension each read and write through one service layer, so a change to how a deal is stored happens once instead of three times. What differs is what each surface is good for. The extension captures, the phone checks something between meetings, and the web application is where actual pipeline work gets done.
Where is the data and what holds the files?
Firebase holds authentication and the database, and uploads go to FilesHub rather than to cloud storage. There are no serverless functions in the architecture, so the client talks to the database directly under its rules rather than through a trusted middle layer. Local storage on device uses the platform's own preferences store. That is a client-side design with the constraints a client-side design brings, and the security rules are where the boundary actually lives.
Does OrbitCubs CRM work on iPhone?
No, there is no iOS build. The web application opens in a phone browser and the packaged build is Android through Capacitor, because there is no Apple Developer account here and nothing I build has shipped to the App Store. The record also does not confirm that either the Play listing or the extension store listing has been published, so the web address is the one surface this page can point at with confidence.
https://aoneahsan.com/projects/com.aoneahsan.orbitcubs