Why I Built This

For 30 years I cut motion pictures and television, working on productions where continuity photos and reference images aren’t decorative — they’re working records that drive reshoots, approvals, and budget. (IMDb)

I built PictaBase to solve that problem as a visual database, not just a media library. The original pain came from production workflows, but the same breakdown happens in real estate, construction documentation, insurance, archives, agencies, and any business that relies on photos as working records.

I’ve also bought 45+ lifetime deals over the years, so I know how it feels when a founder offers unsustainable economics and disappears six months later. That buyer perspective is exactly why I’ve been uncompromising on PictaBase’s unit economics and fail-closed architecture — every cost path was modeled before the deal was priced.

I built this because photos are typically stored in “dumb” folders with no relational context. Finding specific visual assets across thousands of files—like a specific actor in a specific scene—is an operational bottleneck. PictaBase is a universal visual database (DAM) that connects assets to user-defined relational metadata.

Most of you are makers. You know that a lifetime deal is often a bet on whether the founder’s infrastructure costs will outrun their bank account. I didn’t build this by guessing; I built it to be pixel-blind and fail-closed.

The Architecture

PictaBase is a professional-grade application footprint, not a thin wrapper.

Pixel-Blind Server

Your image bytes never transit the PictaBase server. We use S3 Presigned POST for direct browser-to-bucket uploads. This means zero server bandwidth costs and maximum upload speed.

Metadata Portability

We use Sidecar Metadata. Every tag, note, or AI label is written to a .meta.json file alongside the original in S3. If our database disappears, your data survives in standard JSON.

Strict Quality Gate

The backend is enforced at PHPStan Level 8 with zero errors. The frontend is strictly typed using TypeScript/TSX and aligned to backend serializers.

In the days immediately before launch the codebase went through a dedicated efficiency-and-correctness audit. Seven P0/P1 launch-blockers were remediated and pinned by regression tests that fail loudly on reintroduction. Two further findings were independently re-audited and deferred with documented rationale rather than blindly applied — both turned out to be based on stale assumptions. The PHPUnit suite grew from 449 to 488 tests across the audit window; PHPStan Level 8 stayed clean throughout.

Why this LTD is Sustainable

The “LTD killer” is uncontrolled egress and transfer costs. We solved this at the architectural level:

Derived Asset Pipeline: Grid browsing uses lightweight WebP thumbnails generated in the browser or via AWS Lambda.

CloudFront Delivery: All derived assets are served through CloudFront with project-scoped signed cookies. This enables edge caching and moves transfer costs onto a lower egress profile.

Fail-Closed Security: If CloudFront signing is unavailable, the system returns a 503 rather than silently falling back to expensive S3 origin fetches.

Test Drive: The Free Tier

If you want to verify these claims before committing, start with the Free Tier.

250 MB Storage: Sufficient for testing the metadata engine and S3 upload flow.

Zero Feature Gating: All core features—faceted search, tagging, AI suggestions, and sharing—are enabled.

No Credit Card: Create an account and start pushing the code immediately.

My Pitch: Break It. I’ll Be Watching.

I’m one person. The codebase has been through two adversarial AI security review passes (six total reviews across Gemini 3.1 Pro, GPT 5.4, and Opus 4.6) plus a dedicated pre-launch efficiency audit — but no review pass simulates a live crowd of makers.

Today I’ll be in the comments throughout launch day. If you find something, I’ll respond, fix what I can fix today, and credit you by name in the changelog.

Specific things to try:

1. Break the upload pipeline. Drag in your largest folder. The presigned-POST flow should keep up — show me where it doesn’t.

2. Try to enumerate someone else’s projects. The 404/403 divergence and the cross-project batch-asset oracle were both closed in the April hardening pass. If you can pull a project ID that isn’t yours, I want to see it.

3. Try to spend my AWS budget. The 4-code-per-user cap, the per-project AI privacy switch, and the rate limiter on every public route are supposed to make this hard. Find a path I missed.

4. Stress the metadata engine. Tag a few thousand assets with overlapping terms, merge the terms, confirm nothing drifts.

Found something real? Report it through the support portal. Confirmed bugs get a public credit and an extra LTD code on the house.

What You’re Buying Into

We are offering a Lifetime Deal that scales with your needs without becoming a liability for the platform.

Tier 1 to Tier 4: Hard storage ceilings enforced in code, from 5 GB to 100 GB.

Expansion Revenue: Future monetization comes from capacity (storage top-ups), not from paywalling core utility.

If you’re a maker who values portable data, strict types, and disciplined infrastructure, I’d love to have you on board.

Chris Conlee

Founder, PictaBase · 30-year Hollywood editor (IMDb) · U.S. Army veteran, Gulf War · Lifetime-deal buyer 45+

Built PictaBase because the tool he needed didn’t exist.