Here are the realistic ways to store your app’s info and files, plain and simple — no wrong answers, just trade-offs.
“Could I just use Google Drive or Dropbox to make this easier?”
Great question! Drive and Dropbox are perfect for personal files, but they’re not built to power a live app — your app can’t reliably or securely pull files from them for your users, they hit strict limits as you grow, and for something as sensitive as government ID photos, it’s genuinely risky. Cloudflare R2 is the right tool for this job, and it’s honestly not harder once the token is made — that token is the only fiddly part, and here’s exactly how (below).
“I made an R2 account but I’m stuck making a token — it says I need a token to manage tokens, and I don’t know what to put.”
You’re just on the wrong screen — easy fix. That “need a token to manage tokens” message is Cloudflare’s general account-tokens page. The R2 one is separate and simpler:
social-roster-app.Send us those three (Access Key ID, Secret Access Key, Account ID) and you’re done — you don’t need to create a bucket or touch anything else; we handle the rest.
Supabase is a managed cloud service — a company that runs the computers for you. It stores your database (all your users’ and campaigns’ info) plus your files, and handles backups, security, and scaling automatically.
Best for: keeping things simple — the easy, proven path.
You keep your database right where it is, but move the big image and video files — including ID photos — to storage built specifically for files. Cloudflare R2 stands out because it charges nothing for bandwidth (the data used whenever someone views or downloads a file).
Best for: later — once you’re storing a lot of media.
You’d run the database and files on a machine you own or rent yourself, instead of paying someone else to manage it.
Best for: only if you have real technical help on hand.
To be clear and kind: this isn’t a way to run a live website’s storage. A plugged-in drive can’t reliably or securely serve your app to the public, and it’s unavailable whenever your computer is off or asleep.
Best for: backups only, never the live app.
You wanted a way for people to upload photos and videos that you and your admins can see and manage, and that your users can then see too. Here’s the plan, in plain terms:
Private and controlled by default, so nothing sensitive is ever exposed.
On the build plan — Phase 3 A simple version comes first, with a more polished version to follow later.
You asked us to compare costs, including Google’s storage and a plain hard drive. Here’s the honest, plain-English answer — the real cost isn’t just storing the files, it’s “bandwidth” (the data used every time someone views a photo in your app). That’s the cost that quietly grows as your app grows, and it’s where these options differ the most.
~$0–$8/mo extra
Cheap today because you’re small. Charges a moderate fee for viewing traffic once you outgrow the included amount — grows steadily as you do.
~$0.30–$7.50/mo
Charges nothing for people viewing your photos — that’s the cost that normally grows fastest. Cheapest option at every size we checked, and it’s still a real secure cloud service.
~$12–$240/mo
Similar storage price to the others, but charges the most by far for people viewing your photos — that cost snowballs as your app grows.
Pennies/mo
Cheapest in dollars but not safe for a live app holding IDs — no guaranteed uptime, no built-in security, no backups unless you build them yourself. Great for backups only.
Bottom line: Cloudflare R2 is the cheapest option that’s actually right for this — because it charges nothing for bandwidth, which is exactly why you’re already setting it up. The full numbers behind this are in our research notes if you ever want them, but this is all you need to make the call.
Questions about any of this? Just ask — happy to walk through it with you.
Great news — your app has no users or files yet, so there’s nothing to move. We just connect new uploads to the new storage and write all the code. You won’t touch anything technical.
sbp_) or Project Settings → Database (the password).
Why: we need this to finish locking down your data security and to connect the new storage — it’s the same access our security fixes need.
media.yoursite.com (looks polished, needs a domain you own) or the default Cloudflare address (works instantly, zero setup).
Why: just tell us your preference — either way works great.
Reply to this with any questions, or with the items above, and we’ll take it from there — end to end.
To finish setting everything up, we just need two things from you:
sbp_) or your database password (Project Settings → Database).That’s everything — send those two and we handle the rest, end to end.
To build the part that tracks who’s paid and automatically nudges brands and chases down what’s owed, we’ll need your Stripe account details when you’re ready.
No rush at all — just flagging it now so you can start a Stripe account whenever suits you.
Will anyone besides you help manage the app?
If so, send their names + emails (and roughly how many). We’ll set each person up with their own secure login — safer and cleaner than sharing one account.
Ready to start on payments?
If you can open (or authorize) a Stripe account this week and share your basic business details, we’ll get the verification going early so the payments dashboard is ready the moment we build it — no waiting.
For the stuff people upload — what’s your preference?
Would you rather it waits for your approval before anyone else can see it (safest — what we recommend), or posts right away and you can take things down if needed?
Just reply whenever — no rush.
Would you like a custom address like media.socialroster.com (looks more polished, needs a domain you already own pointed at it), or is Cloudflare’s default address fine (works instantly, nothing extra to set up)? Either is completely fine — just let us know which you’d prefer.