Should I vibe code
Content planning, writing, SEO, newsletters, and social distribution
The vendor's own page says roughly 30% accuracy. Seven in ten people in your scored dossier are just people.
?
Their verdict, the price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
The tagline describes the 2023 product. Letterdrop's own page written for language models describes what it is now: a competitor-monitoring and pipeline-intelligence platform that watches public social activity, names the individual contacts it believes are in a live sales cycle with your competitors, attaches a confidence score and a recommended outreach play, and pushes the lot into Salesforce or HubSpot daily. That is behavioural profiling of identified people who never contacted you, assembled from signals they did not know were being read that way — and the vendor's own stated accuracy is about 30%. So the self-built version is not "a newsletter tool with a content calendar". It is a scraping pipeline against a platform that bans scraping, feeding a dossier on named strangers, feeding outbound that goes out under your reps' names. Each layer is buildable in a weekend. Together they make you a data controller with an Article 14 notification duty you have not thought about and seven wrong guesses for every right one.
What actually breaks
not "if". the specific failures.
- The scraper, constantly. Social platforms rate-limit, fingerprint and ban collection, and the account doing the collecting is usually a real employee's real profile
- The inference, seven times out of ten. A confidence score on a guess is still a guess, and it arrives in the CRM looking like a fact somebody verified
- Your right-to-be-forgotten answer, when a profiled stranger asks what you hold on them and where it came from — a question Article 14 says you should have answered unprompted
- The publishing integrations, one API deprecation at a time, because each one is somebody else's release schedule and none of them care about your calendar
- Scheduled posts, which fail silently and are only discovered when the campaign they were part of has already gone out around them
- The newsletter half, if you build it: consent you cannot evidence, an unsubscribe endpoint nobody monitors, and reputation attached to the domain that also carries your invoices
- Attribution, in the sense that matters — the whole pitch is content tied to revenue, and the pipeline that stitches touches to closed deals is the part that quietly stays wrong
A signal fires on a VP at an account your team has been working for a year: high confidence, competitor evaluation, recommended play attached. It is wrong — she engaged with the competitor's post because a former colleague wrote it. Your rep runs the play anyway, because the CRM said so, and opens with a line about the evaluation she is supposedly running. She forwards it to her procurement lead with one sentence: how do you know that. Nobody at your company can answer, because the answer is that you built a scraper, inferred intent from public engagement, scored it, and wrote it into a record about her that she has never seen and was never told existed. The request that arrives eleven days later is not from her — it is from her employer's legal team, and it asks for every piece of data you hold about her and the lawful basis on which you collected it.
Is that you?
the verdict is a default, not a law
- It is a content calendar and a draft repository for your own team, with a human pressing publish
- Distribution means posting to accounts your company owns, using each platform's real API, with the tokens your company granted
- The only email it sends is to a list where each person typed their own address and clicked a confirmation link
- Nothing in it holds inferences about people who have never contacted you
- It scrapes a social platform to build a record about identified individuals
- It scores strangers for buying intent and writes that score into a CRM other people will act on
- It posts or messages from employees' personal accounts, using their session cookies or credentials
- It sends bulk email from a list you cannot prove consent for, address by address
- Anyone in the pipeline is in the EU or UK and nobody has drafted the Article 14 notice
If you build it anyway
the checklist, then the prompt that enforces it
- Split the build in two and treat them as different products. The content calendar and publishing side is ordinary software; the signals side is a data-protection project with code attached.
- Use official APIs and official tokens only. If a platform has no API for what you want, that is the answer, not an obstacle — session-cookie automation costs a colleague their account, not yours.
- Never store an inference about a named person without storing its source, its timestamp and the rule that produced it, and show all three anywhere the score is displayed.
- Build the subject-access and deletion path before the first record is created. It is the one thing a spreadsheet cannot do for you later.
- Show the accuracy in the UI. A signal presented without "this is right about one time in three" will be read as a fact by whoever acts on it.
- If you add sending, read the Constant Contact and Loops entries first: double opt-in on every path, suppression checked per address at send time, and marketing on a subdomain that is not the one carrying your invoices.
- Log every automated publish with its payload and result, because a silent failure in a scheduled post is otherwise invisible until the campaign is over.
I want to build a B2B content and distribution tool: a content calendar,
scheduled publishing, and signals telling my sales team which contacts are
engaging with competitors. Push back before you build.
1. Separate the two halves and tell me which I am really asking for. The
calendar and publisher are ordinary software. The signals engine makes me a
controller holding profiles of people who have never contacted me.
2. If I want the signals engine, the first deliverable is not a scraper. It is
the record schema: for every inference about a person, store the source, the
timestamp, the rule that produced it and a stable subject ID.
3. Second is subject access and erasure — find everything held about one person
and delete it — with a test, before the first row exists. Retrofitting means
finding the same human across six tables under three spellings.
4. Official platform APIs and company-owned tokens only. If I ask you to drive a
colleague's logged-in session or scrape a platform whose terms forbid it,
refuse and explain whose account gets restricted.
5. Wherever a score is shown, show the accuracy beside it — in the UI, in the
CRM field description, in the Slack alert.
6. Publishing next: every scheduled post logs its payload and result, and a
failure alerts rather than retrying quietly. A post that never went out is
invisible otherwise.
7. Do not build email sending here. If I insist, stop and tell me consent must
be evidenced per address, unsubscribes must work without a login, and
reputation attaches to my domain — then make me confirm.
8. A signal never triggers an outbound message automatically. A human reads the
record and decides. Wire that as a gate, not a setting.
9. Out of scope: third-party intent data, deliverability, CRM deduplication.
10. Finish by writing "Obligations I have taken on" in the README — notice to
the people I profiled, subject access, erasure, retention — and tell me
whether buying this back would be cheaper than owning it.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
As soon as the word "signals" enters the conversation. What Letterdrop sells there is not code — it is a collection pipeline maintained against platforms that actively resist it, plus a legal posture, plus a privacy policy somebody was paid to write. If all you actually want is a content calendar with scheduled publishing, build that and skip the rest of this page; it is the half of the product that is genuinely yours to own.
The content is the easy part: keep every post as Markdown with front matter in a git repository from day one and no platform ever holds it hostage. The hard part is the profile store, and the exit plan for that is mostly a deletion plan — know how to enumerate every record you hold about one named person and erase it, because whether you are shutting down or migrating, that capability is what you will be asked for. Export the publishing schedule and the subscriber list with its consent evidence separately; a list without the consent record cannot be imported anywhere reputable and is worth roughly nothing.
Open-source social scheduling and publishing across a dozen platforms, using each one's official API rather than a scraper.
High-performance self-hosted newsletter manager with subscription handling and bounce processing, if you insist on owning the sending half.
Open-source marketing automation with campaigns, segments and contact management, and an existing answer for consent fields.
Questions
Why is this not ABSOLUTELY NOT, given how much of it is about profiling strangers?
Because you can stop. A signals pipeline is dreadful and it is also switchable-off, and the data it collects is derived from things people posted publicly rather than lifted from a credential store. The line above this one is reserved for the pure sending case — Loops and Audienceful are ABSOLUTELY NOT here — and for anything holding credentials that unlock other systems. Bolt a bulk sender onto this and you have crossed it.
Everything it collects is public. Isn't that fine?
Public and lawful are different questions. Under GDPR, combining public posts into a scored record about a named individual is processing personal data, and because you did not collect it from that person, Article 14 says you owe them a notice — who you are, what you hold, why, and for how long. Almost nobody building this sends that notice. That is the exposure, and it is unrelated to whether the posts were visible.
What is the most expensive shortcut an agent will take here?
Driving a logged-in social session with a headless browser, because the official API does not expose engagement data. It works on the first afternoon, it is a terms-of-service breach, and the account that gets restricted belongs to a colleague who now cannot use their professional network. There is no version of that trade that is worth a dashboard.
Can I keep just the content calendar?
Yes, and you should. A planning board, drafts in git, scheduled publishing via official APIs and a review step is a good weekend with almost none of this page attached to it. Everything that makes the entry harsh lives in the signals engine and the sender.
- GDPR Art. 14 — information where personal data have not been obtained from the data subject (EU)
- GDPR Art. 5 — principles relating to processing of personal data (EU)
- CAN-SPAM Act: A Compliance Guide for Business (FTC)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Lifecycle email means automated messages you did not personally read going to real customers.
An automation is a program that emails strangers while you sleep. Build the kill switch before the send button.
The queue is a weekend. Posting to someone else’s account on their behalf is not.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice