“not sure if it’s a great idea to use Nostr for this.“ I don’t see why not. It’s a great use case. Data are not stored on a single server that don’t belongs to you. Data and services are not govern by one company. Here we encrypt data with our key, and a passcode. In near future, include one time password (like google authentication). This is secure, and free.