Soft-launch an AI-built app before paid ads

Who this is for

You already ran a harden pass, or you are close. Auth works for a second account. Money rows are not a public table. You can name a live host that is not a builder preview. You have not opened Meta Ads Manager, Google Ads, or Apple Ads with a card on a campaign.

You are not this page if the app still lives only on a laptop, if only the founder can log in, or if you cannot take the live URL down tonight. Those are harden jobs. Open what “production-ready” means after vibe coding for the operating contract. Open rewrite vs harden if a door will not close. Open hire a developer for an AI-built app if the people list is blank.

You are also not this page if you already buy taps. A live campaign is not a soft launch. Pause the spend. Finish the gates. Then decide whether the same campaign can come back.

A minimum viable product (MVP) can look done and still fail a stranger. Soft launch is how you find that out with people you can text, not with a card that keeps charging.

What “soft” means

Soft is four facts you can write on one card. If any fact is missing, you are not soft launching. You are hoping.

• Invite list. Named people. Email or phone you can reach tonight. Not a public link. Not “anyone with the Slack.”
• Spend cap $0 paid. No Meta, Google, Apple Search Ads, TikTok, or other bought tap. A TestFlight invite is not a paid campaign.
• Cohort size. Small enough that you can watch every session. Large enough that a second person, not you, hits sign-in, reset, and a money path.
• Time box. A start date and an end date. One to two weeks is enough to see a crash, a support mail, and a rollback. An open-ended “beta” is a stall.

CodeCross planning guidance for a first friends-and-family week is 8 to 25 named people you can text the same day. That is a planning range, not a measured study. On both Apple and Google, an internal test list can hold up to 100 testers. TestFlight internal groups take up to 100 App Store Connect users. Those testers can download builds for 90 days. Play internal testing also caps an internal list at 100 testers per app. Start far below those caps. A list of 100 people you cannot call is not a cohort. It is a leak.

Apple is clear that a beta is not a store listing and not a paid job. App Store Review Guideline 2.2 says demos, betas, and trial versions do not belong on the App Store. Use TestFlight instead. Apps on TestFlight cannot be given to testers in exchange for compensation of any kind. That line is why a TestFlight group is a soft path. It is also why you must not treat it as an ad campaign.

Play draws a similar line. An internal test can start before the app is fully configured. Google says those internal builds might not get the standard Play policy or security reviews. An open test can show up on Google Play. Soft launch stays on the invite list. It does not graduate to “anyone who can find the listing.”

Proof gates before any paid click

Paid clicks are strangers. Google Ads destination requirements reject destinations that do not function, return an error to AdsBot, or are under construction. Meta Advertising Standards require the product in the ad to match the product on the landing page. Apple Advertising Policies say you must also meet App Store rules. If you break those rules, the app is not eligible for Apple’s ad services. A soft launch is how you prove the destination before those reviews meet a stranger.

Walk six gates. Do not buy a tap while any gate is red.

Auth. Create a second account on a second device. Reset the password. Confirm the magic link or code does not print localhost. Confirm the session dies on logout. If only the founder login works, the cohort is theater.

Data. Sign in as tester B. Try to open tester A’s order by changing an id in the URL. Try the same on a shared list. If B can read A, stop. Paid traffic will do this in the first hour. This is the trust line, not a polish pass.

Crash. Put a reporter on the live build. Firebase Crashlytics is a realtime crash reporter for Apple, Android, Flutter, and Unity. It groups crashes, can alert when an issue grows, and on Android can filter reports by Google Play track. Apple’s Guideline 2.1 rejects incomplete bundles and binaries that crash or show obvious technical problems. A week with no reporter is a week you cannot describe.

Support path. Name a company inbox. Write it in the app. Write who opens it on Saturday. A founder Gmail that also pays Stripe is not a support path. Testers will mail the first broken reset. If nobody answers, they will tell the next stranger.

Kill switch. Name the person and the click. Host halt. Store track halt. Feature flag. The click must work after you quit the builder. If the only “stop” is “ask the chat to unpublish,” you do not have a switch. You have a hope.

Analytics. Put Google Analytics 4 on the live host or app stream under a company property. Google says data collection may take up to 30 minutes to begin. Use the Realtime report to prove a tester session arrived. A tag that only fires on the founder laptop is not a gate. Keep Administrator on a company inbox. Invite the studio as Editor or Analyst later — not as the property owner.

Treat those bars as time you set aside, not a quote. The short bars are the week. The long bar is the miss: a card buying taps while the reset mail still points at localhost.

Cohort runbook

Run the week as a loop. Invite. Observe. Triage. Decide. Do not add a new feature in the middle unless a gate is blocked without it.

Day zero, before the first invite: write the list, the live URL, the support inbox, the halt click, and the end date. Send testers three tasks, not a tour. Sign in. Reset. Complete the one path that makes the product real — a booking, a file, a payment in test mode. Ask them to mail the inbox when any of those fail.

Each day, open four tabs: crash reporter, analytics Realtime, the support inbox, and the host. Write what you saw in one dated note. If a tester goes silent, that is a fact. A silent list is not a pass. Text two people and ask them to try the reset again.

Triage is three buckets. Halt if a tester can read another row, if money moves in a way you cannot reverse, or if you cannot take the host down. Fix this week if sign-in, reset, or the core path fails for a stranger and you can ship a patch inside the box. Park if the ask is polish, a second platform, or a rewrite debate. Parked work does not extend the box.

On the end date, decide in writing. Ads. Harden more. Hire. A fourth option — “keep the beta open” — is how weeks become months with the same red gates.

What fails a soft launch

Most failed weeks look busy. Invites went out. A group chat lit up. The founder demoed on a call. The four facts were still missing.

Preview links fail first. Testers bookmark a builder host. You later buy ads against a custom domain. The two origins disagree on cookies, magic links, and which database they hit. Google Ads wants a destination that works and matches the ad. A leftover `*.lovable.app` or a tunnel is not that destination.

Shared founder logins fail second. Every tester is the same user. You never prove row rules. You never prove reset. You never prove a second device. The week looks calm because nobody could be a stranger.

No support inbox fails third. The first real bug lands in a text thread. The thread dies. The tester tells a friend the app is dead. You learn about it when you later buy ads and the same friend sees the creative.

No rollback fails last and worst. A bad build ships on Thursday. The builder chat is rate-limited. The store track still serves the binary. You cannot halt. That is the moment people open an ad account “to get more testers,” and the week stops being soft.

When to stop soft and buy ads — or wait

Stop the box on the end date. Pick one door. Write it down.

Buy ads when a second person signed in, stayed in their row, completed the core path, and you halted the host once on purpose. Keep the first paid week small. The destination you advertise must be the destination you just ran. Google will refuse a destination that does not work. Meta will refuse an ad that does not match the page. Apple Ads will refuse an app that fails App Store policy. Play’s Developer Program Policy (effective 30 September 2026) and the Play Policy Center still apply when a paid click lands in a store listing. Internal-track exemptions do not follow you into production ads.

Harden more when a tester read another row, when reset failed, when you could not halt, or when the crash list is a blank page. Stay on the invite list. Do not “add a small Meta campaign to get more signal.” That is paid traffic on a red gate.

Hire when the missing piece is a person, not a patch. Nobody can export the database. The store owner is a contractor. The halt click lives in a freelancer inbox. Finish the access list on the hire checklist before a paid sprint starts. A hired engineer cannot invent an Account Holder on Monday.

Next steps

Write the four facts. Walk the six gates. Run the loop to the end date. Decide in writing. Keep paid spend at zero until the destination you will advertise is the destination you just watched.

CodeCross is a product studio. The week before ads is a named list, a live host, a support inbox, and a halt you have already pressed. If a gate is still red and you want a second pair of eyes, book a conversation.

FAQ

How large should a first friends-and-family list be?

CodeCross planning guidance is 8 to 25 named people you can text the same day. That is a planning range, not a measured study. TestFlight and Play internal testing each cap an internal list at 100. Start far below that. A list you cannot call is not a cohort.

Why is a builder preview URL a bad invite for the cohort?

Testers bookmark it. Ads later point at a different host. Cookies, magic links, and the database can disagree. Google Ads destination requirements need a destination that works and matches the ad. Invite the live origin you will advertise, or do not invite yet.

If only the founder can sign in as every tester, is the cohort valid?

No. A shared founder login proves nothing about row rules, password reset, or a second device. Each tester needs a seat. If you cannot create a second account without the founder password, the auth gate is red. Stay off paid taps.

Whose inbox must answer a Saturday support mail?

A company inbox written in the app, with one named person and a backup. A personal Gmail that also pays Stripe is not a path. TestFlight already asks for an email so you can watch tester feedback. The same idea applies on web: someone has to answer when the reset fails.

A crash-free week still failed the gate — what was missing?

A reporter. A week with no Crashlytics — or no other crash list — is a week you cannot describe. Testers may have force-quit and said nothing. Apple Guideline 2.1 still rejects binaries that crash. Silence is not a pass.

After a clean cohort, what still blocks a Meta or Google click?

A destination that does not match the ad, a host that errors for AdsBot, or an App Store / Play policy the listing still fails. Meta wants the product in the ad to match the page. Google wants a working, crawlable destination. Apple Ads also requires App Store policy. Internal Play tests can skip standard reviews. Production ads do not.

Should a TestFlight or Play internal track be treated as paid traffic?

No. Those tracks are invite lists. Apple says TestFlight testers cannot be paid. Play says an internal test can start before the app is fully configured and might skip standard reviews. Paid traffic is a stranger who arrives because you bought a tap. Keep the spend at zero until the six gates are green on the origin you will advertise.