Marketing, accounts, and keeping financial data safe

Before going further I wanted three things nailed down: the marketing plan, whether PayDown needs accounts like Rocket Money has, and what "secure" actually means for stored financial data.

Marketing, compressed: position as the BNPL-sprawl app, not another budget app — that fight is unwinnable against incumbent ad budgets. Build in public (this blog). Seed the beta in debt-free communities with honest walkthroughs. Launch on low-competition App Store keywords like "bnpl tracker." Grow with a free payoff calculator and share cards. Zero ad spend until organic numbers prove out.

Accounts: yes, but look at why Rocket Money needs heavy account infrastructure — they hold your bank credentials. PayDown never does. Accounts here are opt-in, exist only for sync, use passwordless email links, and sit on database-enforced row-level security.

Security, plainly: data lives on your phone by default, protected by device encryption. Cloud sync is opt-in, encrypted in transit and at rest, one user per row, enforced below the application layer. No bank logins, no Plaid, no transaction feeds. Worst-case breach exposes a list of self-reported balances — bad — not credentials to anyone's bank — catastrophic. Smallest possible attack surface, as a product decision. It's all on the privacy page in plain English.