No backend
Backup meant an encrypted file the user carries themselves, not a sync service.
An offline-first personal finance and debt-tracking app built to replace the spreadsheet a real household was already running its debt payoff and monthly budget from - without a backend, without an account, and without ever needing a network connection to be trustworthy.
FlutterDartRiverpodDrift / SQLiteAES-256-GCM BackupsOffline-First Architecture
Personal Finance / Mobile App
A Heavens Web Solutions mobile app development project.
Offline-first, zero cloud dependency
52 automated tests, all passing
AES-256-GCM encrypted backups
Project overview
The functional reference for this app was never a wireframe - it was a Google Sheet. A working household finance and debt-payoff tracker, with a Debt Master tab, a Payment Log, an EMI calendar, a budget planner. It worked. It also lived in a browser tab, required a live connection to open, and asked its owner to manually keep three sheets in sync every time money moved.
Key features
- Offline-first ledger with zero cloud dependency
- Debt payoff and EMI tracking
- Monthly budget planner
- AES-256-GCM encrypted local backups
- PIN and biometric app lock
- Edit and delete on every record type
Results / impact
A private, offline ledger that replaced a household's spreadsheet without losing anything the spreadsheet already got right - and a debugging process disciplined enough that a security-adjacent bug could be fixed without ever weakening the lock screen it exposed.
The Brief
Three constraints that don't bend.
The mandate for Better Money was specific about what "better" meant: mobile-first, and substantially better than the spreadsheet - while never losing the calculations and structure the spreadsheet already got right. Everything else followed from three constraints that don't bend.
No account
Security meant a PIN and the phone's own biometric sensor, never a login screen.
No connection required
Every number on screen has exactly one source: the transaction ledger itself, recomputed, never separately stored and allowed to drift.
Principles
What "better" had to mean.
Personal finance apps have a way of making people anxious about money they're already anxious about. The brief named a handful of qualities to hold onto, and - just as usefully - five familiar shapes to actively avoid becoming.
Private
Every record stays on the device it was created on, by default and without a setting to change it.
Calm
No streaks, no badges, no red dots demanding attention for their own sake.
Trustworthy
A number on screen is either real or clearly marked as an estimate - never one dressed as the other.
Simple
Expense entry needs an amount, a category, an account, a date. Everything else is optional.
Focused
One currency, one ledger, one job - tracking what a person actually has and owes.
Modern
Fintech-grade visual polish without borrowing fintech's habit of manufacturing urgency.
Deliberately not:
a spreadsheet an accounting ERP a banking clone a crypto dashboard a social app
Design System
A palette tuned to sit quietly under one moment of color.
The palette started from the product's own name: a mark built from a rupee sign growing a leaf, rendered in a teal-to-emerald gradient. Everything else in the interface was tuned to sit quietly underneath that one moment of color.
Display
₹2,45,000
32 / 700
Heading
Debt Snapshot
24 / 700
Title
Recent Transactions
17 / 600
Body
Choose a backup password
15 / 400
Caption
This month · HDFC Bank
12 / 400
One card, doing less: the balance card was the single most prominent thing on the screen, so it was the first thing trimmed. "Total Balance" became "Available Balance" once the underlying figure was confirmed to genuinely be what's spendable today, and the four stat tiles below it were relabeled in the household's own words - Income, Spent, EMI Due, Debt.
By the Numbers
Built solid enough to trust with real money math.
8
Local Database Tables
15
Feature Modules
105
Dart Source Files
52
Automated Tests, Passing
0
Analyzer Warnings
Counted directly from the shipped Flutter project at the time of this case study.
How a Number Gets to the Screen
Nothing is stored that can be computed.
The rule that shapes every screen in the app: nothing is stored that can be computed. An account's balance, a debt's outstanding amount, a budget's remaining spend - none of these are fields in the database. They're the result of replaying every transaction that touches them, every time, from the one ledger table that owns the truth.
A balance never comes from a stored field: it's replayed from the transaction ledger through a pure domain function, on every write, in one direction. No screen holds a number the ledger didn't just produce.
UI Widget — e.g. Dashboard
Riverpod — reactive provider
Domain Function — pure, unit-tested
Repository
Drift / SQLite
Case Study: A Bug Fix
The bug that ate the backup
Flagged high priority
The most serious issue reported wasn't a crash. It was quieter and worse: Import Backup would pick a file, the lock screen would appear out of nowhere, and after unlocking - nothing. No error. No data. The file just seemed to evaporate.
Symptom
A phantom lock screen
Tapping Import Backup and picking a file was, from the user's side, indistinguishable from the app randomly deciding to re-lock itself mid-task.
Trace
The file picker is a real screen change
On Android, the native document picker isn't a dialog drawn over the app - it's a separate Activity. Opening it fires the same paused/resumed lifecycle events as switching to any other app, which is exactly what the app's auto-lock watches for.
Trace
Auto-lock defaults to zero
Until a user opens Security Settings and changes it, the auto-lock delay is 0 - lock immediately on any return to the foreground. Every single trip through the file picker satisfied that condition.
Root cause
Relocking replaces the whole screen, not a layer on top of it
The lock screen isn't an overlay - it swaps out the entire app for a standalone lock screen, which unmounts everything underneath, including the import screen's own memory of which file had just been picked.
Fix
Move the file above the wall that gets torn down
A small piece of state - which file, how far the import had gotten - now lives one level higher than the lock screen can reach. Every step writes to it immediately, before anything has a chance to disappear.
Before
Pick file
Activity switch → relock
Screen unmounts
File only in memory
Nothing happens
After
Pick file
Saved above the lock wall
Relock → unlock
Resumes itself, no re-picking
Restore completes
Fixing this the easy way would have meant weakening the lock - skip it for the file picker, or extend the default grace period. Both were off the table: the brief was explicit that security cannot be the thing that gets quietly relaxed to make a bug disappear. So the fix is structural instead of a workaround: the in-progress import now lives in application state that sits above the security gate in the widget tree, survives being locked and unlocked, and picks itself back up the moment the screen exists again - including re-showing the password prompt, re-validating, and re-opening the confirmation screen exactly where it left off.
The relock behavior itself was correct and stayed exactly as it was - the fix moves the file's memory to a place a relock physically cannot reach.
What Shipped
What actually shipped.
A ledger that never double-counts
Debt payoff, account balances and budget spend are all derived, never separately entered - including the one field that used to be a manual entry: a debt's starting outstanding amount, now a single starting-balance transaction instead of a second source of truth.
Backups you actually own
AES-256-GCM, a password only the user knows and the app never stores, PBKDF2 at 150,000 iterations, and a checksummed manifest that refuses to silently misread a backup from an older or newer app version.
Edit and delete, everywhere
Every user-created record - expense, income, debt, account, budget, category, debt payment - opens the same add form pre-filled, with delete a confirmation away.
A dashboard that reads the room
A brand-new account sees a short "get organized" prompt instead of five empty charts. Someone with real history sees a live cash-flow trend and their next EMI.
Honest About the Gaps
What's still open
Known, not hidden
- SQLite foreign-key cascades aren't enabled yet - deleting a debt can leave orphaned payment rows behind.
- Exporting shares the same file-picker Activity switch; a relock mid-save can only cost a missing confirmation toast, never the file itself.
- The on-device restore path is verified by static analysis, unit tests and a full code trace - not yet by a live run on a physical phone.
The lesson worth keeping
- State that has to survive an interruption belongs above the thing that interrupts it - not patched around inside the screen that gets torn down.
- A security control and the bug it exposes are usually two different problems. Fix the one without touching the other.
- Every number the app shows still traces back to one ledger. That discipline is what made the fix above possible to verify at all.
Recreated from the Shipped App
Next
Next case study
Our Product
SaaS / Photography Management
DigitalHugs
An all-in-one platform for photo selection, digital albums, event delivery and studio management.
AI-powered face recognitionEnd-to-end studio workflow
View case study
Let’s build your next digital solution.
Start a conversation about your business requirements.