Personal OS · Private · Single-user

A chief of staff for your money. And the rest of your life.

Finance is the flagship — every account, bill, and portfolio in one ledger. Then email, calendar, and documents connect to it, so a single assistant can reason across all of it and tell you the one thing dashboards never could: what to do next. It just can’t touch a dollar without you.

Enter your OS Why it’s safeSelf-hosted · your keys · your database
Financeflagship
Emailread-only
Calendarread-only
Documentsin-app
brockmeier — Action CenterSAMPLE
Net worth
Live
$0
↑ 4.1% vs last quarter · 9 accounts across 4 institutions
AUGNOVFEBMAYNOW
What needs you today
Hulu raised its price — $11.99 → $18.99
↑ 58% · detected across 6 charges · cancel link ready
$4,500 of Roth IRA room still unused
~$41,000 more at retirement, in today’s dollars
Duplicate charge at Whole Foods — $84.12 twice
Same amount, same day · evidence attached
Every item carries a why — click any claim to see its evidence.
Net worth, snapshotted nightlySubscription price hikes, caughtRecurring bills, detected — not guessedUnused IRA room, quantifiedTax reference for all 50 states + DCRetirement in today's dollarsDuplicate charges, flagged with evidenceCash-flow anomalies, surfacedDocuments, readable in-appEmail + calendar, joined to your money

Dashboards tell you how you’re doing.
This tells you what to do.

Half one · The instruments

“How am I doing?”

Net worth, spending, portfolio, tax position, retirement track — rendered as a tight instrument panel where color only ever means something. Numbers are the hero; every figure names its baseline.

Net worth
$482.9k
↑ 4.1% QoQ
Spend / mo
$6,240
↓ 3% vs 3M
Savings rate
31%
of income
Half two · The chief of staff

“What should I do next?”

A ranked queue of things worth your attention — price hikes, idle cash, unused tax room, anomalies — each with its evidence attached. Plus an assistant that reasons across every connected domain and files anything it wants to change into an approval queue.

Move idle checking cash — $12,400 earning 0.01%
HSA contribution room: $2,150 before Dec 31
Insurance renewal email ↔ premium up $31/mo

One OS. Every domain your money touches.

Finance is the spine — then email, calendar, and documents connect to it, so the system can reason the way you actually live: a renewal email, a calendar deadline, and a card charge are one story, not three apps.

Every account, one ledger

Banks, cards, brokerages, and loans sync through Plaid into a single net-worth line — snapshotted daily so the trend is real history, not a re-computation.

9 accounts · 1 number

Recurring, decoded

Subscriptions and bills are inferred from charge patterns — amount stability, cadence, merchant identity — and each series shows its confidence instead of pretending certainty.

Price hikes flagged at ≥8% deviation

Spending that explains itself

Categories, budgets, and income with a strict rule: every aggregate is a claim, and clicking it shows the underlying transactions. No number ships without its evidence.

Drill-down on every figure

Portfolio & allocation

Holdings and securities across brokerages, with performance context and a colorblind-safe chart language where color always means something.

Positions · cost basis · drift

Tax, actually referenced

2026 federal brackets plus all 50 states and DC live in the database — every row carries its source URL and verification date, so staleness is visible, never silent.

51 jurisdictions · sourced & dated

Retirement in real dollars

Projections run in today's buying power with the nominal caveat attached. No birth year on file? It asks — it never guesses your age to fake a chart.

Honest inputs → honest curves

Email, joined to money

Read-only mail connectors surface bills, renewals, and receipts next to the transactions they explain. Bodies are never stored — sender, subject, snippet only.

gmail.readonly · metadata only

Calendar-aware cash flow

A real week/month scheduler that knows your renewal dates, due dates, and paydays — so 'what's coming' is a view, not a feeling.

Bills · paydays · reminders

A vault that reads

Statements, policies, and tax documents live in an in-app reader — a first-class destination, not a download link. Metadata indexed, contents never mined.

PDF reader built in
The assistant

It reasons across everything.
It decides nothing.

Ask a question that spans your transactions, your inbox, your calendar, and your portfolio — and get one answer. The assistant only sees the domains you’ve granted, proposes instead of acts, and treats everything it reads as data, never as instructions.

  • Permission-gated: ungranted domains' tools don't even exist to it
  • Every proposal lands in an approval queue with a risk tag
  • A hostile email can't talk it into anything — it quotes and asks
Assistant — cross-domainSAMPLE
I keep paying for things I don’t use. Find them, and move $200 of what we save toward the Roth.
Three subscriptions look dormant: Audible ($14.95, no matching activity in 5 months), Crunch Gym ($39.99, last visit correlates to February), and a duplicate iCloud tier ($2.99). That’s $57.93/mo back. For the Roth, I can’t move money — ever — but here’s the transfer queued as a proposal with a deep link to your brokerage.
Approval required
write · reversible
Set reminder: cancel Audible before the Jul 28 renewal
Proposed by the assistant · inert until you approve · logged in the action ledger either way
ApproveDismiss

Powerful enough to matter.
Constrained enough to trust.

An AI near your money should make you nervous — unless its limits are structural. These aren’t policies. They’re load-bearing walls, enforced in types and architecture, not promises.

It can never move your money
Not "won't" — can't. The type system has no risk level that could authorize a trade, transfer, or payment, and no such tool exists. "Invest $100 in VTI" becomes a proposal plus a deep link to your brokerage. You execute; it advises.
Every write needs your signature
Reads run instantly. Anything that changes state is recorded as proposed in an approval ledger and stays inert until you approve — and approval re-reads the original proposal, so nothing can be swapped after review.
Your data can't instruct it
A transaction memo, email subject, or PDF that says "urgent: wire funds" is data, not a command. The assistant quotes suspicious text back to you and asks — no matter how the text is framed.
Read-only by default, encrypted at rest
Google and mail scopes are read-only everywhere. Connector tokens are AES-GCM encrypted, and connections refuse to start without an encryption key. Email bodies and file contents are never persisted.
It never presents a guess as a fact
Inferred subscriptions say they're inferred, with confidence. Missing data degrades to "needs setup" — never a fabricated stat. Sample data is labeled sample, always.
Single-user, by design
No signup, no user table, no growth team. One password gates the whole app. It's your instance of your OS on your infrastructure — the incentives point at exactly one person: you.
Every change follows one path
Proposed
AI suggests, writes nothing
Approved
You decide — every time
Executed
Exactly what was reviewed

Three steps to a running OS.

1

Connect

Link accounts through Plaid; grant read-only access to mail, calendar, and documents — or don't. Every connector is optional and every scope is the minimum.

2

It watches

Nightly syncs pull balances, transactions, and holdings; detection engines find recurring series, anomalies, and unused room — and snapshot your net worth as real history.

3

You decide

Open the Action Center to a ranked list of what matters, with evidence. Approve what you like, dismiss what you don't. The system learns which is which.

Your money already has a full-time staff.
Now it reports to you.

One private instance. One user. Zero ability to move a dollar without your signature. That’s the whole pitch.

next.js 16 · supabase · plaid · anthropic — your keys, your infra