Privacy-First Architecture

I keep building tools that store data locally and I keep choosing this architecture deliberately. Offledger keeps financial data in SQLite on iCloud Drive. My Obsidian vault is a folder of markdown files. Sift processes everything in-memory without persistence. The pattern is consistent: for personal tools that handle sensitive data, local-first isn't a constraint -- it's the entire point.

The architecture is simple because it can be. SQLite for storage, the filesystem for organisation, no cloud sync, no accounts, no authentication flow. There's no user table because there's only one user. There's no permissions model because the filesystem handles that. There's no API layer because the application reads the database directly. Every layer you remove is a layer that can't leak data, can't have a vulnerability, can't be subpoenaed, can't be acquired by a company whose privacy policy you didn't read. The security model is "the file is on your disk and nowhere else." Try finding a simpler threat model than that.

The trade-off is real and I don't pretend otherwise. You lose collaboration entirely. You lose cross-device sync unless you solve it yourself (iCloud Drive works for single-writer patterns but breaks with concurrent writes from multiple devices). You lose the convenience of a web app you can access from anywhere. You lose onboarding -- there's no signup flow because there's no server. For tools I use alone with data I care about keeping private, every one of those losses is acceptable. My financial data doesn't need collaboration. My notes don't need real-time sync. My image processing doesn't need to persist results on a server.

The decision framework is straightforward: if the data is personal and sensitive, build local-first. If the data needs collaboration or multi-device access, build cloud-first. The mistake I see most often is applying cloud architecture to personal tools because that's what developers know how to build. Not everything needs a database server, an auth provider, and a deployment pipeline. Sometimes a SQLite file and a good CLI is the right architecture, and the privacy guarantee isn't a feature you bolt on -- it's a property that emerges from having no server to compromise in the first place.