Blog · 31 October 2026

Your app needs a database and file uploads: what to do

Lots of apps start as a webpage. Then someone asks for accounts, a saved list, or a place to add photos, and you've got a different kind of app.

Here's how to tell when you've crossed that line, and what changes when you do.

How to tell

Ask these questions about your app:

• Does it need to remember something after someone closes the page?
• Should people see each other's data, or be kept from it?
• Do people upload files?
• Does it use a secret key, for payments or an AI model?

If all your answers are no, you have a website, and it can stay simple. If any answer is yes, the app needs a server, and probably a database or file storage.

A common trap is data saved in the browser, often with localStorage. It feels like a database while you're testing. But it lives in one browser on one device: nobody else can see it, and clearing that browser removes it.

Why local files don't work

Coding agents often reach for SQLite or a data.json file, because they work straight away with no setup. They're fine on your computer.

A live app is different. It gets restarted, and each update replaces it with a new copy. Files saved beside the code can vanish, so hosts generally ask you to keep data somewhere separate. Two kinds of place cover nearly everything:

The database usually keeps a reference to each file, such as its name. The file itself stays in storage.

Do you need to do the setup yourself?

On many hosts, yes. You create a database, copy its address into your settings, set up storage somewhere, and connect the pieces yourself.

On Toupas, it's part of making the app live. When you ask your agent to make the app live:

1. Toupas notices how the app saves data. If it's using SQLite or local uploads, the agent is told to move it, and makes the change.
2. You decide what happens to your data. You're asked whether the live app should start with a copy of your local data, or start empty. The agent can't answer this one for you.
3. The app gets its own database and folder. It's Postgres, and the address reaches your app as a setting called DATABASE_URL. File storage works with ordinary S3 code. You don't copy any addresses around.

You can also run a matching database and file storage on your computer, so what you test behaves like what's live:

toupas dev db
toupas dev storage

Which plan you need

A website with no server fits on the Website plan. An app with its own server or a database needs the App plan, which comes with 128 MB of memory and 500 MB of storage. You can add more of either. Toupas tells you which one you need when you make the app live, and every new app starts with a free 30-day trial.

Three things to do before real people use it

Check who can see what. Sign in as a second person and try to open the first person's data. Hiding a button doesn't protect anything: your server has to check who's asking, every time. Ask your agent to test this directly.

Keep your own copy of anything you can't lose. Toupas backs up databases every night, but no backup is instant, so a serious failure could cost you up to a day of changes. Take your own copy before big changes.

Limit uploads. Decide which file types and sizes you accept. Otherwise one person's large videos can use up your storage.

No code at all?

If you're working in ChatGPT or Claude and just need sign-in and saved data, you may not need a coding agent. Here's how to build an RSVP app from a chat, and what chat-built apps can't do.