Case Study · Built and released free
All your cloud storage.
One place.
A free Windows desktop app that lets you browse Google Drive, OneDrive and Dropbox together, without switching tabs, re-authenticating, or giving any app write access to your files.
Situation
Northlight Vault is a free Windows app for people whose files are spread across Google Drive, OneDrive and Dropbox, so finding anything no longer means opening three browser tabs.
Most professionals who use cloud storage don't use just one service. They have Google Drive for one client, OneDrive for another, Dropbox from a previous role. Finding anything means opening three browser tabs, signing into each one, navigating separately, and hoping you remembered which service it's actually on.
Many unified-storage tools require write access, which is a hard no in most professional settings, sync files locally, which is slow and unnecessary, or charge a monthly fee for what should be a simple browsing problem.
Objective
The aim was the simple version of the idea: read-only, local, free, and clear about what it does.
The simple version of the idea: read-only, local, free, and clear about what it does. A person should be able to find a file across all three services in one place, and an IT administrator should be able to approve it without a long conversation.
Decisions and the reasoning
Four decisions define Vault: it is read-only, it runs on your machine instead of a server, it is free permanently, and its privacy practices are easy to audit.
01
Read-only by design
Vault requests read-only OAuth scopes from every connected service, not because it couldn't request more, but because it doesn't need to. The constraint is intentional.
-
Simpler trust modelUsers and IT admins can approve Vault instantly, there's nothing it can do to their files
-
Smaller attack surfaceNo write tokens means a compromised session can't modify or delete anything
-
Clearer product scopeRead-only keeps the product focused, it does one thing and does it well
02
Desktop, not browser
Vault is an Electron app running locally on Windows, not a web service. Credentials stay on the user's machine and the app works independently of any backend infrastructure.
-
No server, no accountNothing passes through a Northlight server, OAuth tokens live locally, API calls go direct to each cloud provider
-
Offline-capable metadataBrowsed folder structures can be cached locally so the app feels fast even on slower connections
-
Native file openingFiles open in whatever app handles them on your machine, no in-app preview required
03
Free, permanently
Vault has no subscription, no freemium tier, and no plan to add one. Shipping it free was a deliberate decision.
-
Removes the friction barrierA free tool gets tried. A paid tool gets evaluated. For a first product from a new name, being tried matters more than capturing revenue
04
Privacy-first architecture
The app was designed to be auditable. Every permission request and data flow is explained in plain language on the download page, not buried in a privacy policy.
How it works
Vault connects to each provider directly through its official API and OAuth 2.0 with read-only permissions, and it stores tokens encrypted on your machine.
Vault connects to each cloud provider directly using their official APIs and OAuth 2.0. When a user connects an account, they authenticate in their browser through the provider's own login flow, Vault never sees or stores passwords.
Built with
Results
As of October 2026 the installer has been downloaded more than 70 times, counted by GitHub, with no promotion.
As of October 2026 the installer has been downloaded more than 70 times, counted by GitHub, with no promotion. That number includes repeat downloads and cannot show who installed the app or kept using it. By design, Vault sends nothing back to us, so we know the download count and little else.
We haven't asked for enough feedback yet, nor have we received any (negative) feedback. Version 1.0.1 adds a feedback request inside the app.
What I learned
Two lessons: I did not know I could measure downloads, and privacy by design limits what you can learn about your users.
I didn't know I could measure it
I stopped promoting Vault because I had no data and assumed nobody wanted it. I didn't know the download count existed, because the places I looked didn't show it. Once I found it, it told a different story.
Privacy by design limits what you can learn
Not collecting usage data protects users, and it also means asking them directly is the only way to find out what they think. I should have built that request in from the start.
How this connects to my client work
Before deciding to keep, change or stop something, I make sure there is a way to measure how it's doing, and that the measure can actually show what we need to know. Often nobody is measuring, and that is the first thing to fix.