One-time products
Sell a file, grant access, skip building Gumroad badly.
Define products in app/products.php, attach a one-time Stripe price, put protected files outside public/, and Simple Stack handles checkout, entitlement rows, logged-in access, and optional UUID links.
Protected by default
Files never live in public/.
Downloads are streamed by PHP only after a paid purchase is found. If the web server can serve the file directly, the setup is wrong and doctor.php will complain.
Access shape
Account library plus UUID link.
Buyers can log in and view their library, or use the high-entropy access URL. The UUID link is convenient, so treat it like a password with better posture.