One Quiet Year: Building Simple Money Tracker Night by Night

If you have been here since the early days, thank you. If you just arrived, welcome. This is not a feature announcement. It is a letter — from me to you — about a year of building Simple Money Tracker mostly alone, often late at night, one screen and one function at a time.

I am Do Xuan Bac. On July 15, 2025, version 1.0.0 went live with a simple idea: a quiet place to write down what you spent, without noise. Today we sit at Milestone 83 and version 4.24.0. The git history counts more than four thousand commits. Behind those numbers are many nights when the only light on the desk was the editor — polishing a layout, fixing a race, rethinking how a key is stored so that your data never has to be readable on our servers.

Where we started: plain text and first principles

The first milestone was humble on purpose. Next.js, ShadCN, a green-and-beige palette, PT Sans. Email and Google sign-in. Firestore models for users, expenses, budgets, and debts. Full CRUD on a few core pages. Data was stored as ordinary fields — readable if you had the right access. That was honest for a prototype. It was not where I wanted to leave you.

Within days came a dashboard with charts, CSV import and export, a currency converter, notes, and the first AI Financial Coach. The product could already help you see a month at a glance. But the deeper question was already forming: if this tool is about your life, not only your ledger, how do we treat that trust with the seriousness it deserves?

Four major eras — not just version numbers

Looking back, the year folds into four large movements. Each one felt like rebuilding the house while still living in it.

• v1 — Foundation (summer 2025): authentication, core finance modules, dashboard, feedback loops, admin tools, and a public face for the product.
• v2 — Growth & craft (late 2025 into early 2026): Groups and Simple Message, billing and Pro tiers, 2FA, FCM push, Simple Storage, My Mood, AI natural expense input, fourteen languages, security audits, and a long stretch of UI nights — mobile cards, calendars, sidebars, and the feeling of an app that cares about touch and rhythm.
• v3 — Architecture (February–March 2026): end-to-end encryption at the field level, single-session login, delta sync and cache guards, category and session refactors, Telegram bot for natural-language logging, SEO and brand work — the “slow down to speed up” winter turning into structural roots.
• v4 — Zero-Knowledge & polish (April 2026 onward): the vault with KEK/DEK, twelve-word recovery, full module migration to ZK, Telegram and Storage and Messages and Groups under true client-side secrecy, passkeys, Security Playground, 3D and custom icons, API hardening, and the quiet reliability work you only notice when something does not break.

The nights you never see

Milestones look clean in a log. Reality was messier and more human. There were evenings spent only on spacing in a dialog. Weeks on notification jobs so a reminder arrives in your timezone, not mine. Whole phases named in the development log — ZK Phase after ZK Phase — because encrypting every personal module without losing multi-device sync is not a weekend toggle; it is a migration of trust.

I care about icons and empty states the same way I care about rate limits and ownership checks. A new 2D and 3D icon set, module headers, landing redesigns around FAST–SECURE–SMART — those are not decoration for decoration’s sake. They are how a serious tool still feels warm when you open it after a long day. Security without humanity is cold. Beauty without integrity is hollow. I have been trying, night after night, to hold both.

From readable fields to Zero-Knowledge

Early on, encrypted fields were the exception. Then came the February 2026 pivot: encryption across expenses, messages, groups, investments, goals, lending, contacts, moods, subscriptions — decrypting only on the client. That was the bridge.

April’s v4.0.0 vault changed the contract completely. Master password and DEK stay off the server. PBKDF2 and AES-GCM, mnemonic recovery, RAM-only session keys, device-bound cache. Then every personal module moved to that standard — expenses, budgets, debts, lendings, goals, subscriptions, investments, contacts, notes, linked storage — followed by Telegram, Simple Storage, ECDH private messages, emotion notes, and group member data. AI features were taught to work on sanitized insight, not raw PII. The Security Playground exists so you can feel the crypto with your own hands, not only read a claim on a marketing page.

Security is still a practice, not a score. We audit APIs, tighten ownership, close IDOR classes, and admit residuals. Encryption does not replace careful authorization. It does mean that even if someone held a database dump, your life’s numbers should remain sealed without your keys.

Two promises that will not change

Features will keep evolving. Interfaces will keep getting refined. The roadmap is never “finished.” Two commitments, however, are not experiments.

• No ads — ever. The interface stays clean and focused. Your attention is not inventory. Free and Pro exist so the product can stay independent without selling your eyes or your story to advertisers.
• Zero-Knowledge for your personal financial data — the server is not meant to read what only you should read. Vault, keys, and client-side crypto are not a temporary marketing phase; they are the architecture we continue to harden.

I wrote about the no-ads path when the product was younger. I write it again now that we have lived a full year with it: those promises are the same on a quiet Tuesday night as they are on a launch day.

What this year taught me

Building alone teaches patience. Users teach priority. A birthday gift of Pro trial, a soft-delete grace period, a passkey that unlocks the vault, a language pack that loads only when needed — each came from wanting the product to feel like it was made by someone who uses it, not by a committee optimizing engagement.

There will be more milestones. More nights. More small icons and large migrations. If Simple Money Tracker has become part of how you understand your money — and maybe a little of how you understand your year — then the quiet work was worth it.

Thank you for trusting an independent project with something as personal as your finances. I will keep showing up for the craft: clean screens, honest security, and a tool that stays on your side.

— Bac