The laddered roadmap
I wrote this to plan how the app could grow from a free solo iPhone app into a shared, cross-platform one, with every step shippable on its own.
What happened next: 1.0 shipped as the first two phases: a free single-user app with private iCloud sync. Sharing came next, built on iCloud instead of the separate backend planned here, and it is held for a later release.
From here → a full iOS + Android + neutral-cloud ecosystem, built so every rung is shippable on its own and the later rungs are opt-in. The spine: local-first solo → Apple sync → "sign in to share" → Android. Each phase is complete and valuable even if I stop there. Pairs with the sync and sharing decision doc, the cloud and multi-user prep notes, and the related items in the backlog. Re-check costs before spending.
The one design choice that makes it all ladder
Route all sharing through the neutral backend with one-tap federated login, starting in Phase 2, even for Apple↔Apple. That single decision is why Android (Phase 3) becomes "add a client app," not "re-architect." And because solo use never needs the backend (it stays local-first + CloudKit), I can stop after Phase 0, 1, or 2 and still have a coherent product. The substrate that keeps every rung's data portable, stable UUIDs on everything + the complete export bundle, is already built.
The user-facing promise this yields: "Using TuckBuddy and syncing your own stuff is free and account-free. Sharing with someone (anyone, any phone) is one quick sign-in."
Phase 0: Ship the single-user iOS app (local-first, free)
Build (backlog): finish Up Next: the AI proxy + kill switch, the AI consent gate, import by picking the file, the location adder, plus the photo-thumbnail groundwork. Polish and the graceful "AI offline" state.
Gate A: before any TestFlight
Apple Developer Program: $99/yr. Plus: an App Store Connect app record, the camera/photo privacy usage strings (verify in Xcode), the App Privacy label, and a privacy-policy URL. Internal testers (me + partner) need no Beta App Review; external TestFlight does.
Gate B: before AI ships to any tester
AI proxy on Cloudflare Workers (~$0–5/mo) holding the Anthropic key + the remote kill switch + the AI consent gate. Set an Anthropic spend cap as the backstop. (AI usage itself is cents to single-digit dollars at beta scale; ~$0.002–0.005 per parse.)
Ships to: internal TestFlight → external TestFlight → App Store.
Stop-worthy outcome: a private, free, local-first inventory app. Complete and valuable even if I never go further. Monetization optional (a one-time "Pro" unlock or AI credits).
Phase 1: Apple private sync (my stuff, all my Apple devices, free)
Gate C: before the first synced build (do not skip)
Resolve the pre-freeze schema batch in one migration: seed the creator, owner and share-state fields on items, a home ID and owner on places, a thumbnail on photos, and a bin code on spaces. Once testers sync, the production schema is additive-only and creation-time fields are painful to add, so this lands now. (No $; it's a work gate.)
Build: Private sync: switch the local store to the CloudKit-backed store + iCloud capability; deploy the CloudKit schema to Production. Thumbnail-first photos (instant browse, cache on device).
Cost: $0 to me. Apple hosts it; data counts against each user's iCloud quota. No accounts, no login.
Stop-worthy outcome: iPhone↔iPad sync + automatic iCloud backup, invisible auth, still free. A great single-user synced app on its own.
Phase 2: "Sign in to share" (accounts + the neutral backend, the pivot)
The load-bearing phase. Solo sync stays on CloudKit (free, no account); all sharing goes through the neutral backend with one-tap login, so cross-platform is baked in from the start.
Gate D: before building sharing
Stand up the neutral backend: Supabase (structured data) + Cloudflare R2 (photos, zero egress) + Sign in with Apple / Google. Cost ≈ $10–35/mo, flat at ~2,000 users (R2 is zero-egress, so it's engagement-proof; the DB is nearly free). Turn on spend visibility.
Gate E: legal (I become a data steward)
Update the privacy policy (I now store shared data on a server), the App Privacy label, and wire real data-deletion (a delete request must wipe the bucket). This is the responsibility I take on in exchange for cross-platform reach.
Build: Federated sharing (each person owns their own zone → their contributions count against their own storage) + "Sign in to share" one-tap auth + private-items enforcement. Ownership and attribution UX (who owns vs. who can see; "my stuff" filter).
Monetization opens here: sharing is a natural paid tier that funds its own hosting; AI credits/subscription (StoreKit) can land around now too.
Stop-worthy outcome: two Apple users share a home seamlessly; single users stay free/local. Android isn't built, but the sharing backend already is the cross-platform one.
Phase 3: Android (opt-in; "it just works")
Gate F: before Android
Google Play Developer: $25 one-time + Google's ~12-tester / 14-day closed-test rule for new personal accounts + build the Android client (Kotlin/Compose, or cross-platform). This is a separate app: the backend and data are already portable; the UI is the new work.
Build: the Android app talks to the same backend from Phase 2 and imports via the export bundle. An Apple user sharing with an Android user just works, with no re-architecture, because sharing was neutral from day one.
Cost: $25 one-time + the same backend scales.
Outcome: the full iOS + Android + neutral-cloud ecosystem.
The guarantee: if I never build Phase 3, nothing before it is wasted. Phase 2 sharing already works Apple↔Apple on the neutral backend. Android is purely additive.
Gates & spend at a glance
| Gate | When | One-time | Recurring |
|---|---|---|---|
| Apple Developer Program | before any TestFlight (P0) | – | $99/yr |
| AI proxy (Cloudflare) + Anthropic spend cap | before AI ships (P0) | – | ~$0–5/mo + AI usage (cents–$ at beta) |
| Pre-freeze schema batch | before first synced build (P1) | work only | – |
| CloudKit private sync | P1 | – | $0 (users' iCloud) |
| Neutral backend (Supabase + R2 + auth) | before sharing (P2) | – | ~$10–35/mo flat |
| Legal (privacy policy / label / deletion) | before storing shared data (P2) | work only | – |
| Google Play account | before Android (P3) | $25 | – |
(Not on the critical path but recurring once adopted: analytics SDK (TelemetryDeck/PostHog) free tiers; App Store commission 15% via the Small Business Program.)
How this maps to the growth philosophy
Each gate lands at a moment of clear value, never cold, exactly the progressive-onboarding rule. Solo use asks for nothing (Phase 0–1). The first account appears only at "sign in to share" (Phase 2), a high-intent moment. Payment appears after the value is felt (sharing tier / AI credits). The ladder is the trust-gated activation model applied to the business, not just the UI.
Decision checkpoints I still owe myself
- Confirm "all sharing → neutral backend" vs. CloudKit-for-Apple-sharing (leaning neutral for consistency).
- Pick the neutral backend (leaning Supabase + R2).
- When to start Phase 1 vs. staying local-first through the first TestFlight (current plan: local-first first).
- Whether/when Android is real, but the roadmap is built so I don't have to decide that until Phase 3, and nothing before it depends on the answer.