diff --git a/list.json b/list.json
index f8748d2..9a39796 100644
--- a/list.json
+++ b/list.json
@@ -67,5 +67,27 @@
             "I decided that's BS and made my own script to sync a project to git."
         ],
         "repo": "https://git.c0ntroller.de/c0ntroller/overleaf-git-sync"
+    },
+    {
+        "type": "project",
+        "name": "simple-cb",
+        "short_desc": "A simple callback server for OAuth2 applications.",
+        "desc": [
+            "Most times when using OAuth2 on an API like Google or Spotify I just need the refresh token on setup.",
+            "To get the initial tokens and the refresh token it is necessary to have a server that prints the POST body.",
+            "This application does this."
+        ],
+        "repo": "https://git.c0ntroller.de/c0ntroller/simple-callback-server"
+    },
+    {
+        "type": "project",
+        "name": "photo-sync",
+        "short_desc": "A script that syncs a Google Photos album to your drive.",
+        "desc": [
+            "Giving random apps access to your Google Photos can be bad.",
+            "To still use an album as screenaver etc. I wrote this script.",
+            "It syncs all your photos to your drive while giving you maximum privacy."
+        ],
+        "repo": "https://git.c0ntroller.de/c0ntroller/simple-callback-server"
     }
 ]
\ No newline at end of file
diff --git a/projects/photo-sync.adoc b/projects/photo-sync.adoc
new file mode 100644
index 0000000..f398097
--- /dev/null
+++ b/projects/photo-sync.adoc
@@ -0,0 +1,37 @@
+:experimental:
+:docdatetime: 2022-08-08T12:19:20+02:00
+
+= Google Photo Sync
+
+Why give up privacy for a screensaver?
+
+== Storytime
+
+I recently got a new NVidia Shield with Android TV and after setting everything up I wanted to add a screen saver.
+There are tons of them and some of them even can take a Google Photo album and make your TV a digital picture frame.
+
+I thought it would be great because I already use Google Photos for sharing albums with other people.
+
+So I tried to log in. 
+
+And I didn't do it.
+
+The screensaver app did not only need access to my photos.
+It also wanted my personal details, email address, contact list, and other details.
+This was unacceptable.
+
+Then I thought about it: These apps normally can use images stored on the device or a connected drive.
+My NAS is already connected to the Shield so...
+
+== The Solution
+
+I already had some experience with the Google API from projects like the link:#/project/infoscreen[Infoscreen] and the link:#/project/simple-cb[Simple Callback Server].
+
+I decided to make it easier for users who are not familiar with the API, so I created a CLI to set everything up.
+
+I think the `README` is pretty good so no need to explain the setup process.
+
+== What's left
+
+My detection for images with similar names is bad (but it works and I can only think of one edge case where it doesn't).
+I could use MD5s to make it better.
diff --git a/projects/simple-cb.adoc b/projects/simple-cb.adoc
new file mode 100644
index 0000000..5811b63
--- /dev/null
+++ b/projects/simple-cb.adoc
@@ -0,0 +1,26 @@
+:experimental:
+:docdatetime: 2022-08-08T12:19:20+02:00
+
+= Simple Callback Server
+
+This is probably my simplest project.
+
+== What is this?
+
+It's the simplest thing you could imagine: An `express` server that prints out all headers and the body or all query parameters.
+Still, I needed it sometimes and I didn't want to rewrite it every time I use it.
+
+== What can it be used for?
+
+When creating a dev application on Google, Spotify, or other services you often have some heavy authentification flow to get access.
+But normally I want to use the API for private projects and it's _my_ account that gets authenticated every time.
+
+To make reauthentication easier these OAuth protocols often provide a "refresh token" which can be used to get a valid new token.
+
+To get the initial authentification token and to get such a refresh token you provide a callback address where you get redirected after the user logs in.
+The tokens and meta information normally are sent in a `POST` body.
+And this is where this small application is necessary.
+
+=== This sounds overly complicated
+
+It is. But this is necessary for OAuth2 to be safe.