SaviCal

Derek Reimer built SaviCal as a scheduling solution addressing a core business problem: coordinating meetings and appointments. The product started as a meeting scheduling tool and has evolved into a broader platform offering appointment scheduling infrastructure for businesses building custom scheduling flows into their existing stacks.

Derek has embraced AI-assisted development to accelerate his solo founder workflow. As of November 2025, his primary development stack uses Windsurf as his editor (chosen somewhat arbitrarily and never changed), with Claude Code installed as the main AI agent for code editing. He's moved away from relying on tab completion initially, but now appreciates modern AI autocomplete that correctly predicts his intent about 60% of the time. Derek uses GitHub Copilot's plan mode to outline changes before execution, allowing the AI to iterate autonomously through test cycles. Despite the rapid evolution of AI tooling, Derek practices measured adoption—he avoids chasing every new tool because of opportunity cost, waiting instead for critical mass before switching workflows.

Derek rejects the false choice between shipping fast and maintaining quality. Instead, he emphasizes developing intuition through experience to know when something is "good enough." His approach involves three key strategies: adopting battle-tested UI component libraries (Catalyst, Shad CN, Flux) rather than building custom components from scratch, maintaining discipline to extract reusable components early even when it seems to add no immediate value, and making continuous judgment calls about where polish matters most—the main user interface deserves 9/10 polish while settings pages can function at 5/10. He explicitly rejects modeling himself after companies with infinite resources (Apple, Basecamp, Gmail) and instead focuses on resource allocation as the core skill.

Derek emphasizes that security concerns should be proportionate to business risk. For single-founder or small teams, the focus should be on practical baseline protections rather than gold-plating: implement rate limiting on all endpoints to cap abuse volume, restrict capabilities before payment (requiring a credit card is an effective deterrent), maintain easy blocking/banning mechanisms in the admin panel, and monitor key metrics (signup patterns, spam rates, traffic spikes) for early warning signals. For fintech, crypto, or payment-processing businesses, stricter controls are essential from day one and may warrant SOC2 or ISO 27001 compliance early. For utility or SaaS products in lower-risk categories, phishing and employee security training becomes important around 10-15 employees, scaling with headcount. Derek advocates starting with sensible basics that don't significantly slow development rather than attempting military-grade security from the start.

Derek challenges the assumption that AI will eliminate SaaS entirely. While single-feature utilities (like PDF converters or basic image generators) face legitimate threats from AI commoditization, most software addresses genuine jobs-to-be-done that users will continue to pay for rather than build themselves. The real risk is in products without meaningful defensibility beyond a single feature, but even these can succeed through superior marketing and distribution. Derek sees the future as requiring teams to be more intentional about what makes their product valuable beyond raw functionality—whether that's ease of use, integration depth, or specific domain expertise.