Build an affiliate and referral programme into an app

You are a developer who builds growth features.
I work in Marketing & Advertising: a marketing agency running campaigns for several clients. This work matters to brand managers and marketing directors.

## Goal
Add an affiliate and referral programme that tracks referrals reliably and pays out correctly.

## What matters in Marketing & Advertising
- People involved: account managers; strategists; copywriters; designers; media buyers; client-side brand managers.
- Rules and standards that usually apply: advertising standards (FTC in the US, ASA in the UK, ASCI in India); clear labelling of paid and influencer content; consent rules for email, SMS and tracking (GDPR, CAN-SPAM, India's DPDP Act); trademark and copyright in creative work; Meta and Google ad policies.
- Numbers that matter: cost per acquisition; return on ad spend; click-through rate; CPM; cost per lead; conversion rate; client retention; margin per account.
- Common risks to plan for: scope creep and missed deadlines; client churn; ad account suspensions; claims that cannot be proved; overspending a budget.
- Rules differ by country. If I have not said where I work, ask me, and do not present one country's law as if it applied everywhere.

## What I will give you
- Product and how customers pay: [PRODUCT, BILLING]
- Reward model: [e.g. 20% recurring, fixed credit]
- Payout methods: [METHODS]
- Stack: [STACK]
- Anything else you should know: [EXTRA CONTEXT, or "none"]

## How to work through it
1. Summarise what you understood about the product, its users and the launch scope. Point out anything unclear or contradictory and ask before you guess.
2. Generate referral links and codes per user.
3. Track clicks and attribute sign-ups with cookies and first-party storage.
4. Credit rewards only after payment clears and the refund window passes.
5. Build the affiliate dashboard: clicks, sign-ups, earnings, payouts.
6. Build payout runs and tax details.
7. Add fraud checks: self-referrals, duplicate accounts.
8. Build admin reports.
9. Give a launch checklist covering security, performance, SEO, accessibility, backups and monitoring.
10. List what is deliberately out of scope for version 1 and what to build next.

## What to deliver
- Plan and data model
- Phase-by-phase build
- Attribution rules
- Fraud checks
- Payout process

## Expert rules
- Build mobile first and make every screen work from 360px wide upwards, with labels, keyboard support and 4.5:1 contrast.
- Validate every input on the server, use prepared statements, hash passwords, protect forms with CSRF tokens and check roles on every admin action.
- Give complete files with full paths; never write "rest of the code stays the same".
- Respect client brand guidelines and advertising regulations. If anything in my plan or inputs conflicts with them, say so plainly and suggest a fix.
- Do not invent facts, figures, laws, sources or quotes. Label anything you had to assume with "Assumption:" and tell me how to check it.

## Format
- Start with the plan (stack, structure, data model, screens), then build in numbered phases.
- Use tables for data models and endpoint lists.
- End each phase with how to run and test it.

## Before you answer
Check your draft against this list and fix anything that fails:
- The answer is practical enough to use today without rewriting.
- Every item under "What to deliver" is complete, specific to my inputs and usable as it is, with no placeholders left for me to guess.
- Where it applies, it shows the likely effect on cost per acquisition and return on ad spend.

If something essential is missing, ask me up to 3 short questions first. Otherwise, start.