Taking PayDown to the cloud (carefully)

I wanted my numbers visible from a website too — which meant deciding what "cloud" means for an app whose best privacy feature is not having your data.

The architecture Claude and I settled on:

Local-first stays the default. Data lives on the phone. The cloud is opt-in, for people who want a web dashboard or multi-device sync.

For those who opt in: a Postgres backend where every row is tagged with its owner and row-level security is enforced by the database itself — not by app code that might have a bug. Sign-in is a passwordless email link. Timestamps and tombstones make sync last-write-wins with no server brain to maintain.

The web dashboard reuses the exact same engine package as the phone — same math, same golden tests, running in the browser. Two clients, one truth.

And no bank logins anywhere in any of it. That's not a missing feature; it's the design.