“not sure if it’s a great idea to use Nostr for this.“

I don’t see why not. It’s a great use case.

Data are not stored on a single server that don’t belongs to you. Data and services are not govern by one company.

Here we encrypt data with our key, and a passcode. In near future, include one time password (like google authentication).

This is secure, and free.