Personal command center

01 Problem and context

Scattered productivity tools (tasks in one app, Pomodoro in another, notes in a third) fragment the day; consolidating them requires a backend with well-isolated per-user data.

Running personal projects usually ends up spread across four or five tools that never talk to each other. Command Center pulls projects, tasks, a pomodoro timer, notes and an activity log into a single authenticated dashboard. The real requirement is not the interface but the isolation: it is a multi-user system where each account sees only its own rows, and that boundary is enforced in the database rather than in the client.

02 Solution

A unified full-stack application: Next.js 16 with App Router and React 19 on the frontend, backed by Supabase with 8 Postgres tables and 9 Row Level Security policies that isolate each user's data. The Pomodoro timer shares global state (Zustand) between the dashboard and its dedicated page, and tasks feature persisted drag-and-drop reordering.

1. 01Relational schema design: eight tables with explicit delete semantics, cascade on tasks and set-null on notes and pomodoros, so deleting a project leaves no orphans and destroys no notes.
2. 02Per-account isolation: row-level security enabled on all eight tables and nine policies written against auth.uid(). The notes-tags join table resolves ownership through the parent note with a subquery.
3. 03Supabase authentication with route protection, and profile creation handled by a trigger rather than by opening an insert policy.
4. 04Shared timer state between the dashboard and the dedicated view, so the pomodoro survives navigation.
5. 05Dashboard with database-derived KPIs, a chart of tasks completed over the last week and an activity feed.
6. 06Deployed to Vercel on top of Supabase, with manual verification of the full path.

03 Results

Verifiable figures in the repository and its documentation:

04 How it's built

A personal productivity "command center" web application integrating project and task management, a Pomodoro timer, tagged notes, and a dashboard with KPIs and an activity chart. Built with Next.js 16 (App Router), React 19, Tailwind CSS 4, and Zustand for global state management, it uses Supabase for authentication (including OAuth) and persistence in Postgres with Row Level Security. It includes middleware-protected routes, task drag-and-drop with position persistence, and data synchronization via custom hooks.

05 Ethical decisions

• ✦Account separation lives in the data layer, not the client: if the UI fails or someone queries the API directly, Postgres still refuses other users' rows.
• ✦Profile creation is handled by a trigger scoped to the signup event, rather than leaving a general insert policy open on personal data.
• ✦The activity log records only the user's own actions and falls under the same ownership policy: there is no telemetry with cross-account visibility.

06 Highlights

• ✦Full-stack application with Next.js 16 (App Router), React 19, and Supabase as the backend (auth and Postgres database).
• ✦SQL schema with 8 tables and 9 Row Level Security policies to isolate each user's data.
• ✦Route protection middleware and SSR authentication with @supabase/ssr, including OAuth callback.
• ✦Pomodoro timer with shared global state (Zustand) between the dashboard and dedicated page, with session logging.
• ✦Project and task management with persisted drag-and-drop reordering and a dashboard with Recharts charts.

07 Limitations

There is no dataset: the system runs on data the user creates, so the honest limits are about verification and the security model. Testing was manual and driven by a written plan, with no automated suite. The profiles table has select and update policies but no insert or delete: signup depends on the trigger, and removing an account requires direct intervention. The anonymous key reaches the browser by design in the Supabase model, which concentrates all security in the policies. That is the intended architecture, and it also means a single bad policy becomes a leak immediately.