Your family’s privacy

Your world is private

Nothing here is public, ever. Only people with a seat in your world can see it — there is no search engine, no directory, no public link.

Photos stay in the family

Every photo is served only to people who belong to your world. No one else — not other families on this service, not the internet — can load it.

Every person chooses how they appear

Five choices, from full Member down to Black-box (a private placeholder — the tree keeps its shape, nothing about you shows) and Absent (no trace). You can always lower your own; nobody may raise yours for you. Children’s choices belong to their parents until 18.

History is kept, never rewritten

Changes close a chapter and open a new one — they never erase. That record is your consent ledger: what you allowed, and when, is always answerable.

No ads, no selling, no surprises

Your family’s words and photos are not advertising material and are never sold or shared. You pay for the world; that is the whole business.

You can always leave — and the family can close the world

Leave any time: your presence can be erased on the spot, while shared history stays with the family. The whole world can be closed too — the delete button is right on the world page. If no one else has ever signed in, it is deleted immediately and completely, no copy kept. The moment a second person signs in even once, the world is protected forever after: closing it becomes a 90-day goodbye — everyone is emailed three times, anyone can save their memories or fork a branch, and afterwards a private archive is kept for 7 years, then destroyed. Nothing here vanishes silently, and nothing is ever held hostage.

If a world closes, YOUR things follow YOUR choice

The family decides whether a world closes; each person decides what happens to their own things when it does. Four choices, in plain words: keep me as my own little archive (a small world of your own is created and the pages and photos you added move into it before the old world is removed) · hand my things to a family member (recorded with your seat and shown to whoever closes the world; picking the exact person arrives in a future update) · just email me everything (your own words are mailed to you before removal, with a reminder to save your photos) · let mine fade with it (your things rest in the world’s 7-year archive — this is also the quiet default if you never choose, so silence never costs you anything you have today). Set or change yours any time on Your Page (☰ menu → 🎯 Your page → “If this world ever closes”). It covers only what you added, nobody can set it for you, every change of mind is kept with its date, and a parent answers for a child until 18. One honest exception: someone closing a world that is truly theirs alone — no second person ever signed in — is already making this choice for themselves, so the instant delete applies there.

Is it end-to-end encrypted? No — and here is the honest why

End-to-end encryption would mean even we could not read your world — and then we could not print your volumes, assemble editions, generate your PDFs, or email your own words back to you when you leave. Those features are the product, and they require the service to read what it prints. What we do instead: your world is isolated at the database layer with ownership checks on every query, photos are served only to seat-holders, nothing is ever mined, sold, or shown to anyone outside your world — and real deletion genuinely works (we have run it, all the way down). If a feature ever conflicts with this page, this page wins.