Skip to content
SYS–04Case studyFounderIn production · single-user

DPM Elevate

A planning web app — calendar, tasks, habits, goals and focus — built "privacy-first", with real Google and Microsoft calendar sync.

Type
Personal product · SaaS architecture
Domain
Productivity
Status
In production · single-user
Period
2025 · present
Role
Founder · Developer (solo)
Team
Solo
Market
Personal today · multi-tenant architecture ready
Platforms
Web (responsive)
Next.js 14TypeScripttRPC v11Prisma · PostgreSQLNextAuth v5Tailwind · RadixVitest · PlaywrightVercel

01 Summary

DPM Elevate brings calendar, tasks, habits, goals and focus into a single web app — deployed and working. I designed and built it solo, end to end, with real attention to security and privacy: real Google and Microsoft calendar sync, encrypted tokens, defense-in-depth authorization and self-serve Loi 25 features.

02 Problem

Productivity tools scatter calendar, tasks and habits across many apps. DPM Elevate brings them together, keeping the user's data under their control.

03 My role

Solo project: product design, architecture, development, security, tests and deployment — all me. It's my ground for pushing clean architecture and serious end-to-end security.

04 Main contribution

  • Feature-sliced architecture with an end-to-end type-safe API (tRPC)
  • Security: token encryption + defense-in-depth authorization (RLS)
  • Real Google and Microsoft calendar sync
  • A real testing strategy (unit, RLS, end-to-end Playwright)

05 Tests & quality

A real testing strategy, from unit to end-to-end.

  • Unit: encryption, rate limiting, chronotype, AI scheduler
  • tRPC router tests
  • Row-Level Security integration test (isolation between users)
  • Playwright end-to-end suite (~30 scenarios: isolation, privacy, billing)

06 State & results

The results shown are technical (implemented, tested, deployed). There are no real usage metrics yet — the app is single-user.

32Implemented
tRPC routers (feature-sliced)
55Implemented
data models · 15 migrations
53Tested
test files (unit · RLS · e2e)
AES-256Implemented
OAuth token encryption
5Implemented
auth providers (NextAuth v5)
Implemented
Loi 25 · self-serve export + deletion

07 Lessons

Investing early in authorization (RLS) and encryption pays off: it frames everything else. The incremental token migration (a version prefix to detect already-encrypted values) avoided a risky big-bang.