Building PrivacyVault: A Cross-Platform SaaS for Personal Data Privacy (Next.js + Expo/React Native)
Most privacy tools solve one piece of the problem. Password managers do not scan app permissions. VPNs do not tell you when your email shows up in a breach. So I built PrivacyVault, a full-stack SaaS that does all three in one place: scans for trackers, stores sensitive data, and alerts you to breaches.
It runs as a Next.js web dashboard and an Expo React Native mobile app that share auth logic and theming. This is the full write-up, from the idea through to a working MVP.
The problem I wanted to solve
Three things happen to the average person's data every day, and almost nobody has visibility into any of them:
- Installed apps hold permissions for location, microphone, and contacts long after the feature that needed them was used once.
- Third-party trackers, pixels and embedded SDKs follow you across unrelated sites.
- Credentials leak in breaches, and most people find out months later, if at all.
The tooling that exists is fragmented. You end up running a password manager, a VPN, and a browser extension that each see one slice and none of which talk to each other.
The goal: one product that scans, stores, alerts, and explains, on both web and mobile.
What PrivacyVault does
Web dashboard (Next.js App Router)
- Privacy analytics and reports
- Data locker viewer
- Breach history for your saved accounts
Mobile app (Expo + Expo Router)
- On-device permission scanning
- Secure offline storage
- Push alerts for new breaches
Core features
- Privacy score generator, giving a single number from permissions and breach exposure
- Permission scanner built on the mobile device APIs
- Data locker for sensitive fields
- Breach notifications designed against public breach APIs such as HaveIBeenPwned
- Inline explainers covering how tracking pixels actually work, so the app teaches rather than just scores
Planned monetisation
Free tier with one scan, Pro subscription for unlimited scans and detailed reports. Stripe integration is designed but not yet built.
The stack, and why I chose it
| Layer | Choice | Reason |
|---|---|---|
| Web frontend | Next.js 15 (App Router, Server Components), Tailwind CSS, shadcn/ui | Server rendering, good SEO defaults, fast to build against |
| Mobile | Expo SDK 55, Expo Router | One codebase for iOS and Android, and Expo Go makes device testing quick |
| Auth | Context plus AsyncStorage on mobile, JWT pattern on web | Kept deliberately simple for the MVP |
| Styling | Tailwind on web, StyleSheet plus lucide-react-native on mobile | Shared visual language across both platforms |
| Deployment | Vercel (web), Expo EAS (mobile builds) | Zero-config for both |
Being honest about MVP scope: there is no production backend yet. The MVP runs on mock data and local storage. The next build adds Prisma with PostgreSQL on Supabase or Neon for real user data and cross-device sync, at which point Auth.js or Clerk replaces the hand-rolled auth context.
The decision that saved me the most time: Expo Router uses file-based routing that mirrors the Next.js App Router almost exactly. Moving between the web and mobile codebases stopped requiring a mental context switch, and route structure could be reasoned about once instead of twice.
What was hard
Keeping auth consistent across web and mobile
The two platforms have genuinely different storage models. I settled on React Context plus AsyncStorage on mobile and a JWT-style flow on web, with the same test login working on both so I could move between them without re-authenticating constantly.
Protected routes on two routers
On mobile, Expo Router segments plus a useEffect redirect driven by auth context. On web, checking the session server-side before the route renders. Same intent, two implementations.
Making the scanner real
The mobile scanner uses the Expo permissions APIs, so it reports actual device state. The web equivalent is harder, because a page cannot inspect what a browser extension can. That is the planned route: a companion extension for cookie and tracker scanning.
Time
Roughly four to six weeks part-time. That forced ruthless ordering: auth first, then navigation, then the scanner. Anything that could be stubbed, was.
What I would build next
- Real database and cross-device sync (Supabase)
- A genuine tracker scanner using network inspection and third-party tracker lists
- Charts, Recharts on web and victory-native on mobile
- Stripe subscriptions
Try it
- Source: PrivacyVault on GitHub
- Run it locally: clone the repo,
npm install, thennpm run devfor the web app - Mobile: run
expo startand scan the QR code with Expo Go
Why this matters if you are hiring
This project covers a full delivery cycle: identifying a real problem, choosing a stack for reasons I can defend, shipping working web and mobile clients, and being clear about what is finished versus what is stubbed.
If you are building a SaaS product and need someone across React and Next.js, React Native and Expo, or privacy-focused applications, I would be glad to talk.
Comentarios
Publicar un comentario