Joining a family

A family pal is born once, by one adult, and then everyone else meets it. There are two ways to join — on a shared family device with a code and PIN, or as your own account by email invite — and both are designed so the powerful controls stay with a responsible adult, by construction.

The pal is born once

One adult — the owner — creates the family pal and runs the onboarding ceremony, the same self-authoring conversation a solo pal goes through, with a family flavor woven in. The owner does this alone; the rest of the household isn't in the room. By the end, the pal has a name, a personality, and the sense that it's going to be the whole family's pal.

Everyone who joins after that meets the already-born pal. The first time a new member opens their chat, the pal speaks first — a short, warm introduction where it learns their name, gives them a face, and writes its first notes about them. It's a light version of the ceremony: the identity already exists, so this is just the pal meeting a new person in the family.

Joining on a shared device: code, PIN, and an approval

This is for joining on a device an adult sets up, without an email account of your own — typically how a kid comes in:

1. The family code. The owner reads out a short family code. You enter it at the join page.
2. The PIN. One shared PIN for the whole household — the owner reads it aloud too. (The PIN is stored encrypted, and only an adult in the household can see it; whoever's joining never sets it.)
3. An adult approves the device. The first time a particular device is used to join, that device isn't trusted yet. We email the owner a 6-digit approval code — they read it aloud, you type it in, and the device is trusted from then on. (It's the same simple step as signing in by email code, and there's no random link to fumble with on a phone.) The owner's email is the gate — only someone who can read their inbox gets the code, and there's no separate adult PIN to manage. A device that's never been approved can't get in, even with the right code and PIN.
4. Pick who you are. Once the device is trusted, you tap your own profile from the household — or "someone new" to meet the pal for the first time.

The code and the PIN are deliberately easy to say out loud, which is why the per-device approval matters: a low-effort credential a kid can use every day is paired with a one-time gate that only an adult can clear.

Joining as an adult: an email invite

Another adult — a co-parent, say — joins as their own account:

1. The owner sends an invite to their email address.
2. They click the link and sign in with a normal magic link (which creates their account if they don't have one yet).
3. They're added to the household as their own member, linked to their own sign-in.

An invited adult gets their own private layer that's genuinely private — see Shared memory & privacy for what that means.

Roles

Three roles decide who can do what:

• Owner — created the household and holds the subscription. Full control over members, devices, the PIN, and billing. Can't be removed.
• Admin — an adult the owner promotes (a spouse, typically). Manages members, devices, and settings.
• Member — anyone who joined by code + PIN, or an invited adult. The family-management controls aren't theirs — and for a code + PIN member, they aren't even shown. A kid never sees a settings panel they could change.

The everyday powers a family needs — adding a member, approving a device, managing the subscription — sit with the adults running the household, kept out of a kid's reach by the architecture rather than by a checkbox. Our broader stance on building for kids and families is on the Kids & families page.