Terms of Service

1. Who may open a hub

You must be 18 or older to sign up. The person who signs up becomes the hub’s owner: they choose the family’s address, they hold the bill, and they are the only person who can invite anyone in.

The owner is responsible for what their family does in the hub, and that responsibility is not a formality. It covers the accounts they create for children, the relatives they invite, and anything uploaded from any of those accounts. If you are setting up a hub on behalf of a household — a grandparent paying for their daughter’s family, say — you are still the one agreeing to this page.

2. Accounts and roles

There are four roles, and they differ in what they can do rather than in what they can see:

• Owner — one per hub. Invites people, manages the subscription, can do everything an admin can.
• Admin — a second parent. Can invite, manage members and change family settings, but cannot touch the owner’s account or the bill.
• Adult — a full member. Posts, uploads, arranges their own deck, and can start a hub of their own.
• Kid — an account created inside the family by a parent. It needs no email address, cannot invite anyone, and cannot start a hub of its own.

Adult accounts are identified by an email address and a password you choose. Children’s accounts are identified by a member name that is unique inside your family, so two different families can both have a “kid”. One person can belong to several hubs with one password — a grandparent in each of their children’s families — and each hub keeps its own separate sign-in.

Keep your password to yourself; tell us if you think someone else has it. There is no password-reset email yet, so a member who is locked out is reset by their family’s owner or admin, and if that is the owner themselves, by us.

3. What a hub is

A hub is one family at one address — yourname.latchandlantern.com. People get in one way: the owner invites them. There is no directory, no discovery, no friends-of-friends, and no way for an ordinary member to bring somebody else in.

Circles narrow things further. Inside a family, a message, photograph or clip can be addressed to a named group of relatives instead of the whole hub. That is a privacy preference between people who already trust each other, not a security boundary — but it is a real one: the owner cannot read a circle they are not in. The only way a parent reaches what is inside a circle is to delete the circle, which returns its posts to the whole family, cannot be undone, and is written into the family’s log.

Branching. Any adult in a hub can start a hub of their own, with its own bill, automatically linked back to the one they came from. That is the answer when somebody wants to bring in people the current owner should not be sharing with: a second household, not a wider one.

Kin links copy; they never share. Two families can link their hubs, and a link is permission to send, never to read. When you send a photograph to your in-laws, a new copy is written into their hub, where it lives under their own isolation like everything else they own — the way a letter you post becomes the recipient’s letter. The consequences are all intended: revoking a link stops future sends and leaves what already arrived; deleting your original does not delete their copy; and a copied photograph is a second file, counted against their storage and not yours.

4. What it costs

The unit of payment is a hub, not a seat. One subscription per family; every member is free, whether that is three people or thirteen.

• Trial: 14 days, no card needed to start.
• Then: a monthly subscription, charged through Stripe. The price in force is the one shown in the pricing section of our front page when you subscribe.
• Sponsored hubs: one family can pay for another’s hub at a lower per-hub price. The sponsored family’s hub is otherwise unchanged.
• Storage packs: every hub includes 20 GB across photographs, songs, clips and what other families send you. More is sold in 50 GB packs as a second line on your own subscription.
• Widget bundles: fifteen cards come with the hub; the rest are sold in four small monthly bundles. A bundle you stop paying for takes its cards off the deck and leaves every row inside them untouched, so they come back in their old places the day you buy it again.

Cancel whenever you like, from Settings › Billing › Manage billing, which opens Stripe’s own portal. Cancelling takes effect at the end of the month you have paid for. We do not refund part of a month unless the law where you live says we must.

During early access nobody is charged at all. When that is the case the front page says so, the price is struck through, and no trial clock is running. When early access ends we will say so first, and a family’s clock starts then rather than retroactively.

5. When a payment fails

Nothing is deleted. Not at any stage of this.

1. The payment fails. We hear it from Stripe and open a 7-day grace period. The hub works normally; a banner says what happened.
2. If the grace period runs out, the hub goes read-only: every photograph, message, recipe and event is still there and still readable, but nothing new can be posted.
3. Sign-in and the billing screens stay open the whole time — a family locked out of its own login could not reach the button that fixes it.
4. Pay, and everything works again immediately. Your deck comes back arranged the way you left it.

A sponsored hub follows its sponsor: if the sponsor’s payment fails, the sponsored hub gets the same grace clock. If the sponsorship ends altogether, the sponsored family is given a fresh trial to decide whether to pay for themselves.

6. Your content is yours

Every photograph, message, recipe, song, clip, list and note your family puts in the hub belongs to your family. We claim no ownership of any of it.

To run the service we need your permission to do a few specific, mechanical things with it, and nothing beyond them. You grant us a non-exclusive, worldwide, royalty-free licence, for as long as you keep the content in the hub, to:

• store it and back it up on the server that runs your hub;
• copy it into another family’s hub when a member of yours sends it over a kin link;
• re-encode and resize photographs as they are uploaded, which is also what strips the camera data out of them;
• display it to the members of your hub, and only to the ones the poster addressed it to.

That list is exhaustive. We do not sell your content. We do not use it for advertising, and there is no advertising in the product. We do not use it to train a model of any kind, and no AI system reads any of it — there is no such system anywhere in the product, which is stated plainly on Security.

Delete something and it is gone from the hub. It survives for a while in the nightly database backups, which are described on Privacy, and a copy somebody already sent to another family belongs to that family now.

7. What you may put in it

The rules about music, video, images, links and behaviour live on their own page: Acceptable Use. It is part of this agreement, and the short version of it is that a hub is your household’s private shelf, not a distribution service, and that content depicting the abuse of children means an immediate end with no warning and a report.

8. Ending it

You can leave whenever you want. Cancel the subscription from Settings and the hub runs to the end of the month you paid for, then goes read-only with everything intact.

To have the hub and everything in it deleted, or to get a copy of your family’s data, write to us from the owner’s email address and ask. We will confirm it is you, and then do it. Being candid: there is no self-service “delete my hub” button yet and no one-click export — deleting a family is an operator action behind a typed confirmation, and an export is something we produce by hand. Both are done on request; neither is automated, so allow a few days.

We can suspend or close a hub for non-payment (after the grace period above), for a breach of Acceptable Use, or if we are required to. Except where the breach is severe enough that waiting would be wrong — material depicting the abuse of children, an active threat to someone, a legal order — we will tell you what the problem is and give you a chance to fix it before anything is deleted.

We could also stop offering the service. It is one product run by a very small operation. If we ever shut it down we will give at least 30 days’ notice to the owner’s email address, stop charging immediately, and make an export available before anything goes.

9. What we cannot promise

We will try hard to keep your family’s hub up, safe and unlost. We cannot promise it. The service is provided as it is, without warranties of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement, to the fullest extent the law allows.

Concretely, and this matters more than the paragraph above it: this runs on one server, in a house, in the United States. The nightly backup lives on the same disk as the database. There is no second site and no automatic failover. All of that is spelled out on Security. Keep your own copy of anything you would be heartbroken to lose — your photographs above all. Please do not let this hub be the only place a picture of your children exists.

10. If something goes wrong

If we are at fault, we will make it right as far as we reasonably can. But we have to put a ceiling on it, and the ceiling is this: our total liability to you for anything arising out of the service is limited to what you paid us in the twelve months before the problem, or $100 if you paid us nothing.

Neither of us is liable to the other for indirect, incidental, special or consequential damages, or for lost profits, lost data or lost goodwill, even if we were told such damage was possible. None of this limits liability that cannot be limited by law — for fraud, or for death or personal injury caused by negligence.

11. Covering us

If your family’s use of the hub causes somebody else to bring a claim against us — a copyright holder whose album was uploaded, a person who was harassed from an account in your hub — you agree to cover our reasonable costs of dealing with it, including legal fees. We will tell you promptly if such a claim arrives and will not settle it without talking to you.

12. Which law, and where

These terms are governed by the laws of the State of Wyoming, USA, without regard to its conflict-of-laws rules, and any dispute goes to the state or federal courts sitting in Wyoming. If you are a consumer somewhere whose law gives you the right to your own local courts and protections, that right is untouched by this paragraph.

If a court decides some part of this page is unenforceable, the rest of it stands. Not enforcing something once does not mean we have given it up.

13. Changes to these terms

We will change this page as the product changes. For a small change — a clarification, a corrected link — we will update the effective date at the top. For anything that genuinely affects you, we will email the hub owner at least 30 days before it takes effect, and say plainly what changed. If you do not want to accept the new terms, cancel before they start and ask us for your data.

Questions

Latch & Lantern is operated by The DAS Board LLC. Write to [email protected] — that address reaches a person, and it is the same one for billing questions, data requests, security reports and copyright notices.

Honest note. This page has not been reviewed by a lawyer. It was written by the person who built the product, to describe accurately what the product does and what we are each agreeing to. It is not legal advice, and if you need legal advice about it you should ask someone qualified to give it. If anything here is wrong, unclear or unfair, tell us and we will fix it.