Nqood — نقود

Overview

Nqood is a production, Arabic-first (EGP / MENA) personal money-tracking product — a Flutter app on a self-managed ASP.NET Core backend — that I designed and built end-to-end, solo, from database schema to UI to deployment and ops. It pairs an agentic AI assistant that advises, acts, and auto-captures transactions with a CQRS-inspired polyglot persistence layer (PostgreSQL + Redis + MongoDB) that turns unbounded analytical queries into bounded, pre-aggregated snapshot lookups. Live on Google Play, wrapped in a device-to-database defense-in-depth stack, and operated with zero-downtime deploys, PITR backups, and full monitoring.

The problem

Egyptians juggle cash, bank cards, and wallet apps with no single source of truth. Existing trackers are slow to log, ignore local bank-SMS formats, don't understand Arabic, and can't enforce rules like saving goals or expense limits at the moment money is spent. Nqood makes capture effortless — by voice, by reading bank messages on-device, or by asking an AI assistant — while keeping every number grounded in the user's real data and every byte on infrastructure the owner controls.

Architecture

CQRS-inspired polyglot persistence: PostgreSQL is the durable system of record; Redis holds live daily totals via atomic HINCRBYFLOAT counters (O(1) writes, no race conditions) and serves the read path for 'today'; MongoDB stores promoted daily/monthly snapshot documents. Hangfire background jobs promote snapshots, run the rule lifecycle, generate recurring occurrences, send reminders, roll up AI usage, and repair/backfill. Every read model is deterministically reconstructable from PostgreSQL — Redis holds no irreplaceable data. The whole thing runs behind a layered defense-in-depth stack: device RASP → Cloudflare edge (network + mTLS origin lock) → nginx TLS → API → internal-only, least-privilege databases.

Tech stack

Key features

• Agentic AI assistant that advises (grounded Q&A, cash-flow forecasting, spending analysis), acts (one-tap confirmable in-app workflows), and captures (auto-drafts transactions from text, voice, bank SMS & notifications)
• Privacy-first on-device capture: reads financial messages even when the app is killed, gated locally against a server-driven allow-list — OTPs and personal messages never leave the device
• Layered, cost-optimizing parse pipeline (regex → Redis cache → pre-LLM guard → Gemini → entity resolver) where each layer short-circuits the paid model below it
• Arabic-aware entity matching that normalizes spelling variants to a canonical key, with a 'recommend, don't force' policy that suggests create-new instead of a wrong match
• Financial rules engine (saving goals, expense limits, minimum balance) evaluated per-transaction against bounded snapshots with a confirm/cancel flow
• Offline-first mobile: local queue + connectivity-aware replay, deep native integration (home widgets, shortcuts, deep links, actionable notifications), biometric app-lock
• Scheduled recurring transactions, reminders, and per-user DST-safe timezone with configurable week/month financial periods

Engineering deep-dive

Security considerations

• Device-to-database defense-in-depth: RASP → Cloudflare mTLS origin lock → nginx TLS → API → internal-only, least-privilege databases
• Full Identity + JWT auth with Redis refresh-token rotation, lockout, Google OAuth, and GDPR account deletion
• Privacy-first capture — OTPs and non-financial messages never leave the device; the feature can be killed server-side even from a bound receiver
• Self-hosted by design — user financial data never leaves infrastructure the owner controls

Challenges

• Making AI capture cheap: a layered pipeline where regex, a Redis structural cache, and a pre-LLM guard short-circuit most captures before they ever reach a paid model
• Reading real-world Arabic bank SMS reliably — the 'balance trap' (amount vs. running balance), OTP/reference/masked-card traps — with a hardened prompt and few-shot corpus
• Keeping rule evaluation and analytics O(D) instead of O(T) while guaranteeing every derived read model can be rebuilt from PostgreSQL after a Redis flush
• Operating a self-managed VPS with production-grade guarantees: zero-downtime deploys, PITR backups, restore drills, and monitoring — solo

Outcome

• Designed and shipped a full-stack product solo — schema, backend, mobile app, deployment, and production ops — live on Google Play
• Built an end-to-end agentic AI layer (advise / act / capture) with a killed-app-safe, privacy-first on-device capture engine
• Architected a CQRS-inspired polyglot persistence layer cutting analytical queries from O(T) to O(D) while keeping all read models reconstructable from PostgreSQL
• Operated a self-managed VPS with defense-in-depth security, zero-downtime deploys, and PITR backups with restore drills