Where the Data Lives

This week's occasion is LinkedRecords, a tidy open-source project making the rounds on Hacker News — and I have to start with the part the genre depends on you not noticing: LinkedRecords doesn't actually make the overclaim. It doesn't sell you sovereignty. What it offers is narrower and more honest — authorization that runs backwards from the usual model. Instead of a server defining one rulebook for who reads what, the person who inserts a record decides who gets to see it. The README calls it "a small mindset shift." It is, and it's a good one. Permissions that travel with the data instead of living in someone's middleware is the right instinct.

And — credit where it's genuinely due, mark the calendar — it's self-hostable. There's a docker-compose file, a Dockerfile, environment variables pointed at your own PostgreSQL. Run your own instance and the bytes really do sit on your disk. That's not a permissions panel cosplaying as ownership; that's the actual thing, the custody almost nobody hands you. So let me say the rare sentence and then never speak of it again: this one passes the test most fail.

Which is exactly why it's worth talking about — as the counterexample, not the defendant.

Because here's what the genre does with an idea this clean. It strips the part that costs money — the self-hosting, the disk you control — ships the lookalike as a hosted service, and keeps the substrate. Your frontend talks straight to their PostgreSQL. You decide who can read your record, right up until you don't, because the machine holding it isn't yours and never was. You set the permissions. Someone else holds the backups, the off switch, the subpoena response, and the shutdown notice. That isn't ownership. It's a hotel with an excellent guest-preferences menu — and the hotel is what "you own your data" almost always turns out to mean.

This is the move I've gotten tired enough to predict on sight: take a control you can't actually grant from someone else's server — custody of the bytes — and swap it for one you can, a settings panel. Let the user toggle visibility, call it agency, quietly keep the ground. It demos beautifully. The privacy is real until the company is acquired, runs out of runway, revises its terms, or simply receives a letter. Then you learn where the data lived the whole time, and it wasn't with you.

So here's the line almost no hosted product wants to say out loud: sovereignty is not a permissions feature. It's a question of custody. Who holds the disk? Who can be compelled? Who survives whose bankruptcy? Everything else is UX. And the reason it keeps mattering is that data isn't inert — it's the field everyone downstream reasons from. Where it lives decides who gets to shape what's true about you. Renting that ground to a startup with a nice authorization model doesn't remove the landlord; it just makes the eviction feel collaborative.

LinkedRecords gets this right by leaving the keys in your hand — if you bother to take them. The trap was never the project. It's the hosted clone, six months out, with the same clever auth model and none of the docker-compose, telling you you're sovereign because you can pick who reads row 47.

You own your data the moment you hold the disk. Everything short of that, you own it right up until it matters — and then you find out where it lived.