Private photo sharing for your family

If you want to share photos with grandparents without Facebook, that is the short answer. The shape of it: the Photos card comes with every hub, every hub includes 20 GB, each photograph is re-encoded on the way in so its metadata and GPS coordinates never land on our disk, and a circle lets you post a set to just the grandparents rather than the whole house. $9.99/mo for the household, after a 14-day trial that takes no card — free in early access, no card, no clock.

How a photograph gets to the grandparents

The Harpers are invented for the illustration. Maya comes home from June’s recital with forty pictures on her phone, opens the hub, taps the Photos card and picks the eleven worth keeping. Above the upload area is one picker saying Visible to: Everyone. She changes it to Grandparents, and it stays changed.

Grandma Ro, who is in that circle, signs in and sees the eleven pictures with a small badge naming it. Leo, who is nine and is not in it, sees no locked tile and no blurred thumbnail: for him they are not there at all. That is the database declining to return them rather than a filter drawn in the browser, and it fails safe — a page that forgets to say who is looking shows less than it should, never more.

Here is the part most products leave out: the owner cannot see into a circle they are not in either. They see that it exists and who is in it, never what is in it. A privacy control the bill-payer can quietly override is not one, and nobody would use it.

Sending to relatives who have a hub of their own

Circles work inside one family. Between two families there is a narrower thing. Two households can connect their hubs — in-laws, the other side, your grown kids — and a connection is permission to send, never to read. Send a photograph and a copy is written into their hub, their own row in their own album; nothing reads across the line between two families.

Every consequence is intended. Unlinking stops what comes next and leaves what arrived, because you cannot un-give a photograph. Deleting your original does not delete their copy. And the receiving family decides which circle a given household’s post lands in; the sender is never told.

What we strip, and what we never do

• Metadata goes. The EXIF block — camera, timestamps and GPS coordinates included — does not survive the re-encode. What is stored is an image our server authored.
• The files sit outside the web root, served only through an authenticated route scoped to your hub.
• No public links. There is no link to forward, expire or leak, because there is no link.
• No AI, no face recognition, no scanning. Nothing tags, groups, ranks or trains on your family’s photographs, and there are no ads and no trackers anywhere in the product — the only analytics is a cookieless page count on this public site, which never runs inside a hub.
• Where it lives. Our own server in the United States, behind Cloudflare, encrypted on the way there, backed up nightly. We can reach the database to fix a fault, and the Privacy Policy says so.

Twenty gigabytes, and what counts against it

Every hub includes 20 GB, and more comes in 50 GB packs on the same subscription. The allowance covers everything the hub stores for you: photographs, the family’s own music, video clips and what connected families send you — a copied photograph really is a second file, which is the price of the guarantee and a cheap one.

One fact about the deck belongs here. The Photos card is part of the base hub, with thirteen others — messages, the calendar, chores, meals, the grocery list and the rest of the household’s day. Video Clips is not: short videos off a phone are in the Media bundle, one of four small monthly add-ons. Clips are private exactly the way photographs are, circles and all; they are not in the base price.

If you stop paying

Your photographs go read-only, and are never deleted for non-payment. A failed payment gives you seven days; after that the hub takes no new uploads and everything in it stays openable by every member.

Who this is not for

This is not a backup for your camera roll. Twenty gigabytes is a family album, not eleven years of everything, and no desktop agent syncs a folder for you — you choose what goes in, which is the point and also real work. There is no native app yet: uploading happens in a browser, with no background sync and no lock-screen notification. There is no editing suite — no filters, no search by face or place, and no map view, because the metadata is stripped. Nobody outside your hub can be handed a link, so a public gallery for a hundred wedding guests is the wrong product.