What is tallpond?

tallpond is a platform where developers host their apps for free and users pay their own direct usage costs from one prepaid wallet. No subscriptions, no per-app billing, no developer-run infrastructure.

Status: tallpond is live — the dashboard is at app.tallpond.com. New accounts get a $5 welcome credit to try real apps end-to-end before spending anything, and can add more to their wallet anytime. Deploys are open: anyone can create and ship an app with the CLI — see the Quickstart.

The model in one paragraph#

Every request an app makes flows through a single metered gateway. The user's session identifies the payer; the operation and path identify the cost. Before a metered operation runs, the gateway places an escrow hold against the user's balance, then captures the actual cost on completion — a user can never overspend, and no operation starts without funds reserved. Developers ship a declarative schema, functions, and immutable source/static snapshots; only missing content-addressed file blobs transfer on redeploy. They hold no secrets and run no servers, so serving a million users costs a developer exactly what serving one does: nothing.

Why it's different#

For users:

• Fractional cost. You fund the compute, storage, and AI calls your own activity creates.
• Your data is yours. Account, balance, and per-app data controls live in one dashboard, identical across every app.
• Uniform security. Identity, encryption, key storage, and billing are the platform's job, done once and shared by every app. Apps are untrusted by design: sessions are audience-bound per app, and a per-app monthly spend cap bounds what any app can debit — set it to $0 and the app is blocked instantly.

For developers:

• Zero hosting burden. Publish open-source SaaS without paying to serve its users.
• No secrets. Every API that normally needs a dev-held key (AI models today; more to come) is re-exposed by the platform as a metered pass-through. Your repo is public and static — it can't leak a key it never contains.
• One security artifact. You write declarative, default-deny access rules in your schema. Everything else — auth flows, session handling, multi-tenant isolation, metering — is platform mechanism you can't get wrong.

Live today#

• Authentication — OAuth 2.0 + PKCE via the gateway; tokens live in httpOnly cookies, never in page scripts.
• Database — scoped, metered CRUD with private, resource, and federated scopes; cursor pagination; atomic batches.
• Resources & membership — consensual membership, roles, moderation, and shared (creator-owned) tables.
• Files & storage — object storage on both scopes with metered upload/egress.
• AI — an escrowed, OpenAI-compatible pass-through; the caller pays their own token cost.
• Users & profiles — cross-app public identity and account deletion.
• Billing — wallet, top-ups, and per-app spend caps.
• Schema & deploy — defineSchema, safe automatic migrations, and the tallpond CLI.
• Functions — app-defined serverless functions that run as the invoking user.

Where to go next#

• Quickstart — run the platform locally and build an app.
• API conventions — auth schemes, error model, billing mechanics.
• Metering & rates — exactly who pays what, per surface.