A list of software that keeps its promises, a report card for the products that don't, and the parts of my own life still sitting in the gap between the two.
Originally published in What I Carried.
A year ago I was, and mostly still am, a Google person. Gmail, Photos, Drive, Calendar, the whole stack, without much thought about it. I don't say that as a confession, because there isn't one to make. Almost everyone reading this is some version of the same thing, with a different logo. That's the actual starting condition, not a strawman I'm building to knock down.
What changed isn't that I discovered a problem I didn't have before. I had it the whole time, the way most people do: as a background irritation that never got worked out into a sentence, because nobody sat down and totaled the bill. This week I built Awesome Sovereign Software, a list of applications that pass a five-question test — no account, no server, no subscription, readable data, and survives the vendor going away — and then, almost as an afterthought, a report that runs the same five questions against twelve products most people actually live inside. Gmail wasn't even on the scoreboard. Kindle, WhatsApp, LastPass, Notion, Google Photos, Adobe Creative Cloud, ChatGPT, Fitbit, Evernote, Ring, Spotify, and Microsoft 365. That last one's the honest surprise: it scores a 3 out of 5, because the apps still run offline and the file formats are actually open. Everything else clusters at 1.5 or below. Nothing on that list scored a 5. Nothing on my own machine, most days, would have either.
I didn't build the report to make a point about Google specifically. I built it because I'd spent months on work adjacent to this — a local-first backend, a paper skeptical of what "sovereign AI" can actually mean at personal scale — and it took writing five plain yes-or-no questions down and running real products through them before the pattern stopped being a mood and became a table. I already believed the argument. I hadn't done the arithmetic.
The report's line is that the five criteria collapse into one: the account is the server is the subscription. Once your identity lives on someone else's infrastructure, the rest follows on its own: the data gravitates to their storage, the price becomes rent, and the vendor's death or acquisition or pivot becomes your emergency, on their timeline, not yours. Amazon reached into people's Kindles in 2009 and deleted purchased copies of 1984, refunds included, which is as clean a demonstration as exists that a DRM library is access and not ownership. Evernote capped free accounts at fifty notes a year after being bought. LastPass got breached and vaults got cracked; a hundred and fifty million dollars of stolen cryptocurrency got traced back to it years later. That's one breach, one product. The current number is sixteen billion credentials circulating across thirty known datasets, and Change Healthcare — one company's one breach — exposed 192.7 million patient records, roughly 58% of the US population. Third-party involvement in breaches doubled in a single year, from 15% to 30% (Verizon DBIR 2025), which means the attack surface isn't only the product you chose; it's every vendor they chose. The bill, when someone actually adds it up, isn't a list of incidents. It's a dependency graph, and every node you don't control is a node someone else can lose. Fitbit users have until May 2026 to hand a decade of health data to a Google account or lose it, because one company bought another.
It keeps going once you stop expecting it to. Adobe's apps deactivate the day a subscription lapses, years of muscle memory in tools you must keep renting, and in 2024 the FTC and DOJ sued the company over cancellation friction and hidden early-termination fees, which is the government's way of confirming the friction wasn't your imagination. Ring quietly moved previously free features behind a subscription, then in 2024 remotely bricked Car Thing, a physical device people had paid for outright, and only started offering refunds after a lawsuit and public backlash made the arithmetic worse than just paying out. WhatsApp's export is a clunky per-chat affair with no bulk option, so years of a real relationship sit on Meta's servers in a format built to make leaving tedious rather than impossible. Google's own graveyard is the base rate for "survives the vendor": Reader shut down in 2013, Play Music in 2020, Stadia in 2023, from the company with the most resources on earth to keep something running if it wanted to. None of this is a conspiracy. It's rent, run out over a long enough lease, on a category of thing that was never supposed to be a lease: your notes, your photos, your health record.
The report tries to be fair about this, because most of these products are services by design and nobody at Spotify pretends otherwise. The distinction that actually matters is between your data and someone else's licensed content. The music was never mine. My kid's baby photos were.
Put a number on my own version of it and the shape gets uncomfortable fast. The Gmail account is well into its second decade, carrying the recovery address and login for nearly everything else I own online: a single point of failure underneath a dozen other accounts. Google Photos holds thousands of images at this point, not a folder I could zip in an afternoon, and a chunk of it is shared albums and a shared calendar with family who have never had a reason to think about any of this and aren't going to switch because I did. The report's five questions don't have a column for that part. It isn't only my data anymore, and an exit plan has to cover the people it's shared with too, not just me.
None of this is new, and the part that unsettled me most while building the report was recognizing the shape of it from other centuries. The mechanism was never "we will take your things." It was always "you may keep using your things, through us, on terms we can change." Access as the choke point, not ownership. Three versions of it, from three completely different institutions, that all collapse to the same move.
The medieval Church controlled access to scripture the same way a vendor controls access to a file format: by keeping the readable version in a language almost nobody spoke. Lay ownership of vernacular translations was formally banned by regional church councils in the thirteenth century, and translators who broke the monopoly paid for it directly; William Tyndale was strangled and burned in 1536 for putting the Bible into English without the Church's authorization. The scripture stayed exactly where it had always been. What moved was who got to read it: clergy controlled the only legible copy, and salvation ran through the account they administered.
American coal and mill towns ran the identical mechanism on money instead of scripture. Companies paid workers in scrip, a currency valid only at the company-owned store, at company-set prices, on credit the company extended. A worker's labor, converted into pay, was technically his, and functionally unusable anywhere else. "Sixteen Tons" got written about this exact arrangement for a reason: a man could work an entire life and owe his soul to the company store, because the currency he was paid in was never designed to leave the platform that issued it. Several states eventually passed anti-scrip laws once the pattern became impossible to ignore, which is its own small proof that regulation, not export, was what finally forced the exit.
AT&T ran the same play on hardware. For most of the twentieth century you did not own the telephone in your house; Bell System's tariffs required you to lease it, and rules barred attaching any non-Bell equipment to the network at all. That held until a 1968 FCC ruling, Carterfone, forced the network open to outside devices, and it took the 1984 antitrust breakup to end the monopoly on the wires themselves. For decades, the thing sitting on an American kitchen counter, the thing people would have sworn they owned, was rented from a company that could dictate exactly what was allowed to touch its network.
Scripture, wages, and a rotary phone are not the same kind of thing, and I'd be overclaiming to say they are. What's identical across all three is the move: let people believe they hold something, while the actual control sits one layer up, in whoever administers the access. A Google account, a Kindle library, a Notion workspace, and a Fitbit subscription are the same move, run by companies instead of a church or a coal operator, with a login screen where the company store used to be.
Not much, and what exists is unfinished. The Gmail account is still open. The Photos library is still growing. But it isn't only a plan anymore either: Ollama is already running on this machine for the AI work that doesn't need any of that to exist, LibreOffice handles documents, Inkscape handles the vector work Adobe used to. Notes, passwords, and file sync are still the parts of the Sovereign Stack that live only in the README, not on the machine. That gap, between the pieces already running and the pieces still just a line on a list, is one step further than I was a year ago and several steps short of done.
The report ends with a line I wrote for other people first and only recognized as aimed at me after it was already published: pick one row that stings and replace it this weekend. For most of the twelve, I could, this weekend, on my own. For the one that actually matters most, I can't. The photos are shared with family who have never had a reason to think about any of this and won't switch because I did, and an exit plan that quietly excludes the people you're closest to isn't sovereignty, it's just moving the dependency from a company to them. No migration got finished writing this. What got finished is the one row on my own scoreboard where the blocker isn't the vendor at all: leaving well means bringing people with you, and nobody I know has written that part yet. Including me.