DPM Elevate
A planning web app — calendar, tasks, habits, goals and focus — built "privacy-first", with real Google and Microsoft calendar sync.
01 Summary
DPM Elevate brings calendar, tasks, habits, goals and focus into a single web app — deployed and working. I designed and built it solo, end to end, with real attention to security and privacy: real Google and Microsoft calendar sync, encrypted tokens, defense-in-depth authorization and self-serve Loi 25 features.
02 Problem
Productivity tools scatter calendar, tasks and habits across many apps. DPM Elevate brings them together, keeping the user's data under their control.
03 My role
Solo project: product design, architecture, development, security, tests and deployment — all me. It's my ground for pushing clean architecture and serious end-to-end security.
04 Main contribution
- Feature-sliced architecture with an end-to-end type-safe API (tRPC)
- Security: token encryption + defense-in-depth authorization (RLS)
- Real Google and Microsoft calendar sync
- A real testing strategy (unit, RLS, end-to-end Playwright)
05 Tests & quality
▸
A real testing strategy, from unit to end-to-end.
- Unit: encryption, rate limiting, chronotype, AI scheduler
- tRPC router tests
- Row-Level Security integration test (isolation between users)
- Playwright end-to-end suite (~30 scenarios: isolation, privacy, billing)
06 State & results
The results shown are technical (implemented, tested, deployed). There are no real usage metrics yet — the app is single-user.
07 Lessons
Investing early in authorization (RLS) and encryption pays off: it frames everything else. The incremental token migration (a version prefix to detect already-encrypted values) avoided a risky big-bang.