Menu

Privacy for family and personal media

A family library is shared narrowly, if at all - with a partner, a parent, a grown-up child. This page covers what private, encrypted storage means for photos like those, and how sharing them inside a household works. For the wider picture, see PhotoLog for personal and family use.

A family library is kept, not delivered

A client gallery and an event gallery are episodes. They have a beginning, a hand-off and a point after which nobody opens them again. A family library has none of that: it is started for one reason - a baby, a house move, a parent getting older - and then it outlives that reason by decades.

That single difference decides most of what follows. When a library is delivered, the risks are about the moment of delivery. When a library is kept, the risks are about time: relationships change, devices are lost, phones are replaced, and the person who set the whole thing up is not necessarily the person still administering it in fifteen years. A mechanism that is right for a one-off hand-off is often the wrong one for that.

The concrete version of that difference is which primitive you reach for. A share link is built for handing something to someone once; for a household the fit is membership, which has nothing to send, re-send or remember to deactivate. Studios covers that mechanism with a worked example.

It is a privacy question and not only a convenience one because a studio’s boundary is drawn in keys rather than in folders - how encryption works sets out the hierarchy those keys form. Which turns the everyday decision, one studio the whole family is in and another just for you, into a decision about who can decrypt the christening photographs rather than a decision about where to file them. Worth making before you organise, because it is much easier to start with the boundary you want than to move a decade of photographs across one later.

When the household changes

This is the part a page about family privacy owes you plainly, because it is the case that actually happens.

Removing someone from a vault rotates its key, so what you add afterwards is protected by a key they never held. Rotation works forwards. It does not reach into a device that person already owns, it does not erase a copy already synced or downloaded, and a key held before the rotation still opens what it opened before, if it is ever obtained again.

So the useful posture is preventive rather than reactive:

  • Separate before you need to, not after. If part of the library is meant for a narrower audience than the rest, it belongs in its own vault on the day it goes in.
  • Treat removal as stopping the flow, not as a recall. It closes what comes next. What has already left the account has already left.

What the encryption covers, and what sits beside it

Photos and videos are encrypted in your browser before they are uploaded, so PhotoLog’s servers only ever hold ciphertext. What that leaves uncovered is the bookkeeping around the files, and how encryption works lists it item by item rather than in summary here.

The household version is the part worth holding on to. The contents of the photographs are protected; the shape of the family’s activity is ordinary operational information the service holds. Which is not nothing. It is also not the thing people picture when they worry about a family archive - the picture in mind is a stranger leafing through the album, and what the servers hold is ciphertext. No-AI storage covers what PhotoLog does and does not do with stored media, and how to ask the same question of any provider.

Who else can get you back in

The risk worth planning for in a library like this one is usually not an attacker. It is a lost account secret and a replaced phone. Backing up your library and setting up storage names the three routes back and the one case that cannot be undone. What it has no reason to say, and a household does, is that the boundary you drew for privacy is also the boundary that decides who is able to help.

Another member of the family studio is a recovery route for the vaults you share with them, and for nothing else. So the vault you kept to yourself - the one with the pictures you have not decided what to do with yet - is the vault with nobody in it to ask. That is not an argument for putting everything in one place. It is an argument for knowing which shelves of the library rest on the Recovery Code alone, and writing that code down accordingly.

Photographs that leave the library

Where a photograph is stored decides who can open that file. It decides nothing about the copies that leave it.

The picture from the first day of school, once it is in the family group chat, is governed by the group chat. The one printed and pinned to a grandparent’s fridge is governed by whoever walks into that kitchen. Neither is a limitation of this product in particular; it is the boundary of what storage architecture is able to answer at all.

Which is the note to end on, because it matches how a library like this actually gets used. Most of these photographs are not going anywhere. They are simply being kept - for the version of your family that will want them in thirty years and has not been born yet. Holding the two questions apart is what lets you decide, photograph by photograph, which of the two you are doing.