Make private mean restricted
An obscure URL is not an access policy. Use authentication, least-privilege accounts and network restrictions where possible. Administration and internal dashboards should not be exposed simply because they are easy to deploy.
Keep the architecture manageable
A reverse proxy, application service and database can serve a small project well. Separate credentials and persistent data from the application image. Use health checks and a service manager so restarts are predictable.
Own the export path
Choose tools that can export useful data and document how to restore it elsewhere. Keep important files and database backups in a separate destination. Ownership is practical when migration remains possible.
Account for the people in the data
A private application may still process personal information. Collect only what it needs, set retention periods and protect logs. A no-KYC hosting account does not remove the application operator’s responsibilities.