ShortMax Clone App - White-Label Short-Drama OTT with Rewards, Referrals & Campaigns

It is the codebase itself rather than a hosted service: the Vite and React viewer application, the Next.js 14 console where the reward economics are set, the Express API carrying all 33 Mongoose models plus the seed catalog script, and the Flutter build for both stores. Ownership transfers in full, which matters here specifically because the growth surface is the part operators want to extend, whether that means attribution, an experiment framework or a payout desk. There is no runtime licence and nothing is counted per seat.

It is the same software underneath, priced identically, and we would rather say so plainly than pretend otherwise. What differs is the problem each one is configured and written around. Pick ReelShort if your question is how to price an episode. Pick DramaBox if it is how to serve several language markets without running several deployments. Pick this one if your question is what a returning viewer costs you, because that is where the rewards ladder, the referral reward and the campaign desk earn their place. Tell us which of those you are actually solving and we set the deployment up accordingly.

The Miracuves ShortMax Clone starts from $3,399 for a launch-ready white-label deployment. Final scope varies with catalog size, gateway selection, ad network and push setup, storage and CDN choices, and store publishing.

Six working days covers our part, which is rebranding the platform and deploying it to your infrastructure. Everything that lengthens the timeline sits on your side, and on a growth-led launch the usual culprits are external accounts rather than content: a merchant account per gateway you intend to run, an AdMob account if rewarded ads are live at launch, and a Firebase project if device push needs to work on day one. Brand assets, hosting access and enough catalog to be worth returning to complete the list.

It is a seven day check-in with a streak, where the coin amount for each day is configured in the console. Alongside it sit ad reward tasks bounded by a daily cap with a midnight cron resetting the counters, social follow bonuses with operator-set URLs for Instagram, Facebook and TikTok, an email bonus and a login bonus. Everything pays in coins rather than cash, and each claim is constrained so it cannot be taken twice.

Yes, with one important distinction. The campaign desk gives you reusable templates, audience selection, scheduling, cancellation and campaign stats, and a minute cron dispatches due campaigns. Every targeted viewer gets an in-app inbox row, and that works with no external service configured. Device push to the operating system is separate: it needs your own Firebase project and valid device tokens before it delivers.

On the store build, yes, through AdMob with your own unit IDs, which is an integration step. On the web surface the ad unlock is a simulated timed preview rather than a live ad network, so it demonstrates the flow without generating revenue. We state this plainly because it is the kind of thing that surprises buyers otherwise.

You get operational counts and revenue: overview charts, user analytics with search and a country filter, paid revenue monitoring over a date range, series revenue breakdown, top revenue episodes ranked, and coin economy analytics tied to the seven ledger codes. What you do not get is a growth analytics suite. There is no install attribution, no UTM tracking, no deep linking, no cohort retention curves and no A/B testing module. Those are scoped extensions, and we would rather say so than let the word analytics carry more than it should.

The claims themselves are constrained: the daily check-in is claimable once per day, ad reward tasks are bounded by a daily cap with a midnight reset, and the social and email bonuses are claimable once. The gap worth knowing about is that request rate limiting is not bundled with the platform, so applying limits at the proxy for the login, check-in and unlock endpoints is a named hardening item we complete with you before launch rather than a control that ships enabled.

The source transfers in full, every part of it. On the review question, it arrives with a VAPT reference written against the OWASP Top 10 that is unusually willing to mark its own gaps. Built controls include hosted checkout so no card number reaches the database, uploads judged on their first bytes, a demo operator the server refuses writes from, sensitive paths returning not found at the proxy, and native screenshot restriction on the store build. The backlog is named just as plainly, and one item deserves emphasis on a reward-heavy deployment: no throttling middleware is bundled, so the login, check-in and unlock endpoints should be rate limited at the proxy before you open. Alongside it sit reversibly encrypted passwords rather than slow hashes, an open CORS default, an unscoped public settings response, and role checks that stop at the console. All of it is closed with you during deployment.