Create the owner account. Your partner joins later via an invite link from inside the app.
Before entering real data, verify protection: open /data/db.json on this site in a private window — it must say 403 Forbidden. Passwords are stored as bcrypt hashes on your own hosting; nobody else ever sees them.