Personal Gemini Journal

Your private AI journal, powered by Gemini and secured with Firebase, Firestore, Cloud Run, and Secret Manager.

Comment

Inspiration

AI journaling can be powerful, but personal journal data is highly private. While building AI applications, I noticed that many prototypes focus heavily on the AI experience while treating authentication, authorization, secrets, and data isolation as afterthoughts.

For this project, I wanted to approach the problem differently:

What if an AI journal was designed with security as a core product feature from the beginning?

That led me to build Personal Gemini Journal, a private AI-powered space where users can reflect, brainstorm, and have multi-turn conversations with Gemini while their data remains strictly isolated.

What it does

How we built it

What I Built

Personal Gemini Journal allows authenticated users to:

Sign in using Firebase Authentication Have multi-turn conversations with Gemini Use Gemini for journaling, brainstorming, and reflection Automatically synthesize conversations into journal entries Generate summaries, moods, themes, and action items Save personal entries to Cloud Firestore Review previous reflections Explore long-term patterns through Gemini Reflection

The application is deployed on Google Cloud Run and uses a server-side architecture so sensitive Gemini credentials never need to reach the browser.

Challenges we ran into

Challenges

One of the biggest challenges was separating the AI experience from the application's security boundaries.

It is easy to build a prototype where the frontend directly calls an AI API with an API key. That approach may work for a demo, but it creates a serious credential-exposure problem.

I instead moved privileged Gemini communication behind Cloud Run and used Secret Manager for the credential.

Another challenge was ensuring that authentication actually translated into authorization.

Knowing who a user is is not enough. The application also needs to prove that the authenticated user is allowed to access the requested resource.

That led to the combination of:

Firebase Authentication + verified ID tokens + backend authorization + Firestore security rules.

What we learned

What I Learned

This project reinforced several lessons:

Authentication is not authorization. AI models should never be trusted with application security decisions. Secrets should be managed by infrastructure, not application source code. Database isolation needs to be enforced server-side and at the database layer. Prompt injection is an application security concern, not just a prompt-writing problem. A production-ready AI application needs security boundaries around the model.

The biggest takeaway was that the AI experience and security architecture should be designed together.

Technology Stack Frontend Next.js React TypeScript Tailwind CSS Authentication Firebase Authentication Database Cloud Firestore Backend Google Cloud Run Node.js TypeScript AI Gemini API Security Google Cloud Secret Manager Firebase ID token verification Firestore Security Rules Server-side authorization Input validation Prompt injection defenses

What's next for Personal Gemini Journal

Why It Matters

Personal journals contain information users may not want exposed.

An AI application handling that information should therefore be designed around privacy rather than treating privacy as an optional feature.

Personal Gemini Journal demonstrates how an AI application can combine a useful Gemini experience with authentication, strict user isolation, secure secret management, and a production-oriented Cloud Run architecture.

The goal wasn't just to make Gemini work. The goal was to make Gemini work securely.

Built With

Share this project:

Updates

Submission history