Harmony - personal journal auditing web app

Reflect & Audit with Harmony, an AI-powered personal journal auditing web app.

Comment

Inspiration

In today's fast-paced world, daily reflection and journaling are essential tools for mental clarity, personal growth, and emotional well-being. However, traditional text journals lack interactive feedback, while mainstream public AI tools often raise serious privacy and data security concerns. Users are understandably hesitant to write personal thoughts, private reflections, or sensitive career goals into AI tools if there is any ambiguity about where their data goes or who can access it.

We were inspired to build Harmony — Personal Journal Auditing Web App for the This Hackathon to solve this exact problem: an intelligent, conversational reflection and progress auditing partner powered by the Google Gemini API, engineered with enterprise-grade zero-trust security, strict Firebase Authentication, UID-bound Firestore data isolation, and runtime key fetching from Google Cloud Secret Manager.

What it does

Harmony is an AI-powered personal journal auditing web app deployed on Google Cloud Run. It enables users to capture daily reflections, audit personal progress, track mood insights, and visualize growth with interactive charts while guaranteeing total data privacy.

🌟 Core Capabilities

  • 🤖 Smart Journal Auditing: Context-aware reflection analysis with auto-extracted daily highlights, checkable tasks, and key milestones.
  • 📈 Interactive Chart Audits: Gemini creates visual progress line charts, score trends, and data metrics on demand from your historical logs.
  • 🔐 100% Owner Data Isolation: Owner-isolated Firestore storage (/users/{userId}/*) protected by strict security rules.
  • 📊 Progress Charts: Interactive Recharts bar, line, pie, and scatter analytics for deep progress auditing.
  • ⚡ Real-Time Firestore Journal Sync: Synchronizes chat conversations, reflection data logs, and calendar events seamlessly.
  • 🛡️ Firebase Security: Federated Google Sign-In and Email auth paired with strict UID database authorization.

🖥️ Your Digital Journal Auditing Workspace

  • 💬 Intelligent Journal Conversations: AI-enhanced journaling with context-aware memory and past log auditing.
  • 📉 Visual Progress Analytics: Dynamic performance graphs, test score trackers, and sentiment trends.
  • 📚 Knowledge & Journal Workflows: Search history, compare past entries, export highlights, and copy clean summaries.
  • 🎛️ Unified Harmony Dashboard: All daily logs, reflection charts, and upcoming calendar events in one place.

How we built it

We built Harmony as a cloud-native web app using Next.js 16 (App Router), React 19, TypeScript, and Tailwind CSS, hosted on Google Cloud Run with a dedicated least-privilege IAM service account.

1. Security Constitution & AI Custom Instructions

Before writing application code, we established security custom instructions in Google AI Studio. The system prompt instructs the Gemini API to act as a security-conscious assistant—enforcing input sanitization, resisting prompt-injection attacks, and adhering strictly to data boundary rules.

2. UID-Isolated Database Authorization

User data is partitioned strictly by Firebase UID. Access control is mathematically bounded at the database layer using strict Firestore Security Rules:

$$P(u, d) = \begin{cases} 1 & \text{if } \text{auth}(u) \neq \emptyset \land \text{uid}(u) = \text{path_owner}(d) \ 0 & \text{otherwise} \end{cases}$$

This guarantees zero cross-tenant data leakage: User A can never read, query, or mutate User B's journal entries.

3. Runtime Secret Management

No API keys or credentials exist in source code or client bundles. The server-side API routes dynamically retrieve GEMINI_API_KEY from Google Cloud Secret Manager using the Cloud Run service identity (personal-gemini-journal-sa).

4. Mathematical Sentiment & Task Density Modeling

For the Harmony Insights dashboard, Gemini calculates a time-decayed emotional sentiment index (S_{\text{index}}):

$$S_{\text{index}} = \frac{\sum_{i=1}^{N} w_i \cdot s_i}{\sum_{i=1}^{N} w_i} \quad \text{where } s_i \in [-1, 1], \; w_i = e^{-\lambda(t_0 - t_i)}$$

Additionally, task extraction density (D_{\text{task}}) is modeled across conversation turns:

$$D_{\text{task}} = \frac{|\mathcal{T}{\text{extracted}}|}{|\mathcal{C}{\text{turns}}|} \cdot \sigma(\theta \cdot \mathbf{v}_{\text{context}})$$

Challenges we ran into

  • Preventing Secret Leakage in Client Bundles: Standard frontend builds risk exposing environment variables. We solved this by routing all Gemini API calls and secret fetching through isolated server-side Next.js API endpoints (/api/chat/gemini, /api/insights).
  • Cross-Tenant Security Verification: Ensuring Firestore Security Rules prevented cross-user document access without breaking real-time updates required developing a rigorous matrix test suite verifying unauthenticated blocks and cross-UID read/write rejections.
  • Container Optimization on Cloud Run: Optimizing the Docker container for standalone Next.js deployment to keep build size minimal and reduce cold-start latency on Cloud Run.

Accomplishments that we're proud of

  • 100% Codelab Compliance: Successfully fulfilled every requirement of the official Google Cloud Codelab, including the mandatory service verification label (dev-tutorial=cloud-run-ai-challenge).
  • Zero Hardcoded Secrets: Built a production-ready application where all sensitive credentials stay protected within Google Cloud Secret Manager.
  • Impact & Scale Metrics:
    • ∞ Personal Memories: Structured daily reflections auto-summarized and safely preserved.
    • 100% UID Privacy: Strict owner-bound Firestore security rules with zero hardcoded keys.
    • 24/7 AI Reflection Companion: Always ready to listen, audit goals, and draw progress charts.

What we learned

  • Security-First AI Engineering: AI safety must be enforced at both the prompt level (AI Studio System Instructions) and infrastructure level (Firestore Security Rules & IAM roles).
  • Least-Privilege Cloud Architecture: Configuring dedicated service accounts with minimal IAM roles (roles/secretmanager.secretAccessor) provides a clean security posture on Google Cloud Run.
  • Structured Data Extraction: Prompting the Gemini API to return strictly typed JSON schema allows effortless integration into frontend charting engines like Recharts.

What's next for Harmony - personal journal auditing web app

  • 🔍 Semantic Search & Vector Embeddings: Integrate Vertex AI Vector Search to enable natural language querying across historical journal entries (e.g., "Find entries where I felt overwhelmed about deadlines").
  • 🎙️ Voice Reflection Mode: Add real-time speech-to-text input so users can speak their journal entries hands-free.
  • 📱 Mobile App & Offline Sync: Expand Harmony into a Progressive Web App (PWA) with offline Firestore cache sync for journaling on the go.

Built With

  • ai-agent
  • cloud-firestore
  • cloud-native
  • cybersecurity
  • docker
  • firebase-auth
  • framer-motion
  • gcp
  • gemini-api
  • google-ai-studio
  • google-cloud
  • google-cloud-run
  • hackathon
  • llm
  • nextjs
  • node.js
  • prompt-engineering
  • react
  • recharts
  • rest-api
  • secret-manager
  • security-rules
  • tailwind-css
  • typescript
  • web-development
Share this project:

Updates

Submission history