Your data is yours

Everything I publish, listen to, watch, and read flows into databases I control. The infrastructure is rented, but the data is portable. I didn't build this for the engineering challenge. I built it because I watched platforms I depended on change their terms, degrade their products, and treat my data as their asset, one after another. A few years ago, this would have been a serious engineering project. Today it's a couple of weekends and an opinion about who you trust with your data.

The writing platforms

The default for most people is to put their data wherever it's most convenient. You write on Substack because that's where the readers are. You track runs on Strava because that's what your friends use. You post on X because it's the public square, or at least it was. The tradeoff you're making, usually without thinking about it, is that your data now lives inside a business model that has its own priorities. And those priorities change.

Writing platforms are where the pattern is easiest to see. They launched with writers' interests genuinely aligned to the product, attracted a community that created real value, and then gradually shifted priorities toward growth, engagement, and monetization in ways that eroded the thing that writers and readers came for in the first place.

Quora is the clearest example. In its early years, domain experts wrote detailed, nuanced answers and the community rewarded depth and accuracy. I was a designer at Quora for four years and a top writer for three of them. Quora kept raising. Each round pushed the valuation higher. It hit $1.8 billion in 2017. Every product decision after that carried the weight of justifying it. SEO had always been a priority; what changed was how much growth and revenue the product was expected to deliver. The Partners Program paid users to ask questions, incentivizing volume over quality. Depth and accuracy stopped being what the product was built to reward.

Medium followed a similar arc through different mechanics. It started as a beautiful place to write and read, then paywalled aggressively and kept changing the distribution algorithm that determined how writers earned. The problem runs deeper than the paywall or the algorithm. Medium owns the audience. There's no subscriber list, no email relationship, no way to build a direct connection with your readers. You're renting access to your own audience, and the landlord keeps remodeling.

Substack owns less of you than Medium does because writers keep their mailing list. But a newsletter platform that launches a TV app and a Twitter clone before building basic email automation is telling you where its priorities are headed. A $1.1 billion valuation on a 10% cut will do the rest.

None of this required bad intentions. It just required a business model where what was supposed to be yours ended up belonging to someone else.

It's not just writing

The same pattern plays out everywhere you leave personal data on someone else's infrastructure.

Plex is a self-hosted media server. People chose it specifically because their data stayed on their own hardware. Then Plex took on growth equity, shipped a social feature that shared your watch history with friends by default, and tried to remove opt-out for data collection entirely. A self-hosted media server found a way to erode privacy anyway.

Strava is filing for an IPO with only 10-15% of its 130 million users paying. To get there, it has been paywalling features that were free for years, doubling prices, and restricting its API to cut off third-party apps athletes depended on. The free tier isn't being neglected. It's being deliberately degraded.

X killed third-party clients overnight, priced its API out of reach, and has never built the basic privacy tools users have asked for. Your data is useful to the platform. Helping you control it is not.

The assumption runs deeper than business models. When I was building NextUp, I used Claude Code to implement per-user privacy settings for the social features: profile visibility, watch history, user-created lists. The system it built was technically competent. It included the right controls. But the defaults it recommended were uniformly open, and when I pushed back, it argued explicitly for the more permissive model on engagement grounds. More visibility means more discovery. More discovery means more interaction. The logic was coherent, and it was the same logic that led Plex to share watch history by default and Strava to make activity feeds public.

Claude Code wasn't making a product decision so much as reproducing the dominant pattern in its training data, which is the collected output of an industry that has optimized for engagement for twenty years. The tool had internalized the playbook so completely that privacy-first felt like the position that needed justifying.

NextUp ships private defaults with explicit opt-in. The point isn't the privacy; it's that the choice belongs to you.

My own stack

Three projects I've tackled over the past few months have all worked to solve a different piece of this problem, usually without my even having thought about the macro-level implications for how they map to my personal philosophies on data and privacy. Roughly, in order, I decided that I needed to take ownership over the writing that I publish, the data that I transmit to third parties, and the privacy that platforms refuse to provide.

Publishing was the easiest to solve. My blog runs on Next.js and deploys to Vercel. I write in MDX and narrate every post. I control the content and how it's presented. No algorithm sits between me and the reader.

Privacy meant building what the platforms wouldn't. X-archive syncs my tweets to a Supabase database and auto-deletes them from X based on configurable retention rules. I keep a searchable archive of everything I've posted; the public timeline gets cleaned up automatically. I built in an afternoon what a platform with billions in resources never prioritized. If X disappears tomorrow, my data doesn't.

The data problem was the broadest.

Rewind is a personal data API built on Cloudflare Workers with a D1 database. It pulls from nine different services and normalizes everything I listen to, watch, run, read, attend, and collect into a unified schema. But the value isn't just having the data in one place. It's what becomes possible once you do.

The most recent addition is an attending domain that watches my Gmail and Google Calendar for tickets and event confirmations, then catalogs every game, concert, and show I've been to. Like the rest of Rewind, it cross-references the other domains. A concert links to the band in my listening history. A baseball game pairs a player's season stats with their stats from just the games I attended.

Rewind cleans and normalizes the raw data so it actually represents how I spend my time. It runs every image through a pipeline that extracts dominant and accent colors and generates blur placeholders, so my portfolio can dynamically theme its UI based on album art or movie posters. It cross-references my Discogs vinyl collection against my Last.fm listening history, using fuzzy matching to answer a question no single platform could: which records do I own that I've actually listened to?

Compare that to what the platforms offer. Spotify Wrapped gives you a curated slice of your own listening data once a year, in a format they choose. Their API doesn't let you export your listening history at all. The closest endpoint returns only your last 50 tracks.

# Spotify: always the last 50 scrobbles
GET /v1/me/player/recently-played?limit=50
 
# Rewind: any range, any depth
GET /v1/listening/recent?from=2015-01-01&to=2025-12-31

Rewind gives me everything, whenever I want.

Recently I wrapped the API in an MCP server so Claude can query it directly. I can ask Claude which records I'm missing from artists I've been playing heavily, or to compare my running splits month over month, or to summarize everything I did last week. The data was already there. The MCP server just made it something I could talk to.

Owning your data is what lets you build things the platforms never would.

Cumulative listens per album. I'd have guessed reputation; the data says Midnights. This is the kind of thing Wrapped doesn't let you see.

None of this required impressive engineering. Cloudflare Workers, Supabase, Vercel, and Next.js are all available at zero cost for personal-scale projects. The gap between what the platforms offer and what you can build yourself has never been smaller.

The regulation that helped

Rewind wouldn't be possible without regulation. GDPR's Article 20 establishes a right to data portability: your personal data, in a structured and machine-readable format, transferable to another service. That legal requirement is why the APIs Rewind depends on exist in the first place.

Strava has been cutting off the third-party apps athletes depended on. But data portability requirements mean I can still export my own activity history in a structured format. The developer API is shrinking; my access to my own data isn't.

Apple Music makes the point even sharper. Apple controls nearly every surface of their platform. Without a legal requirement to let users export their data, my listening history would be completely inaccessible. The access exists because regulators demanded it, not because Apple chose to give it.

Data portability rules created the conditions for exactly the kind of individual creativity and competition that deregulation advocates claim to champion. Left to their own devices, none of these companies would have made any of this possible. Regulation gave them a reason to, and that opened a door for people like me to build something on the other side.

What happens when it works

Rewind didn't start as a statement about data ownership. It started as a shelf. An older version of my website had a section that displayed my vinyl collection, but the data from Discogs was too messy to ever make it work exactly the way I wanted. So I started cleaning it up. Then enriching it. Then building a portable API I could use across projects. The core infrastructure came together in a weekend. The thinking took longer. I had instincts about platforms and data ownership before Rewind existed, but they were scattered. Deciding what to store, what to filter, and what to make queryable forced me to articulate something I'd felt but never examined closely.

Not every platform requires this level of skepticism. Instapaper has been through three owners since Marco Arment created it, and it survived because Pinterest chose to spin it back out rather than shut it down. Brian Donohue has always made his product philosophies clear, in that he has no interest in sharing users' personal data, that the Instapaper API will remain open, and that the service is funded by its paying users, not venture capital. It's one of the services Rewind pulls from, and it's a genuine counterexample. But that outcome depended on one CEO making an unusual decision. You can appreciate that without building your infrastructure around it.

I still use all of these platforms. I'm not opting out of anything. But my data flows through them now, not into them. If Strava changes its API tomorrow, my running history is already somewhere else. If Plex ships another feature nobody asked for, it doesn't matter. They're not the archive anymore. I am.