Terms

You pay for storage and the tools that find, share, and preserve your photos. No advertising. No data sales. No training models against your library. If you're charged for something, that's what the money is for.

You own your photos. You can leave at any time with everything you put in.

You need an email address to register. The first registration on an email anchors that email to a family; later invitations to the same address must land in the same family. That's how multi-family membership works without giving anyone multiple shadow accounts.

You set a username at registration. It's your @-handle. It's yours and it doesn't change.

You need to be old enough to be your own contracting party in your jurisdiction. Accounts under 18 are minor accounts — they cannot accrue browsing charges on viewer-pays or public rooms. Adult status flips automatically at UTC midnight on the 18th birthday.

A family is a billing and trust boundary. One family has one payer (or several, by promotion) and any number of members. Photos uploaded into the Family Library are owned by the payer; photos in an owner-only sub-room are owned by that room's owner.

Ownership is immutable inside the platform. There is no in-platform “transfer your library” mechanism. To hand a library to another family, export it (see below) and let them re-upload. The constraint is deliberate — ownership has billing consequences, and clean re-uploads keep those consequences honest.

Family additions, removals, role changes, and room ownership reassignments run through the normal in-platform flows. Any payer can remove a member.

Your bill comes from one thing: how much you store.

Storage tiers:

• Free up to 1 GB. No card required.
• Paid in $1 steps from $6 a month at 200 GB to $14 a month at 1 TB. You pick the band. Moving up is one click; moving down is one request, and you can do it once a full billing cycle has passed at the current band and your stored bytes fit under the destination cap. Mid-cycle changes pro-rate symmetrically — moving up accrues partial-month arrears, moving down accrues a partial-month credit, both settled at the next billing date.
• Pay-as-you-go above 1 TB, billed at ~$14/TB·mo on each day's actual stored bytes. Charged at cycle close. PAYG is sticky: leaving requires an explicit demote request and being back under 1 TB at the time, and the move takes effect at the start of the next billing cycle.

Browsing your own family's library is never metered, on every plan.

Across families, paid plans include every direction with no meter — paid families viewing content others shared with them, and outside viewers browsing paid families' shared or public rooms.

Free plans have a 500 MB rolling 7-day budget on those two directions. When that budget runs out, the free family can't view shared content from outside the family, and people outside the family can't view the free family's shared or public rooms, until the window rolls forward or the family moves to a paid plan.

Library export is free, always.

Closing your account. Closing settles any accrued arrears — the days on PAYG or partial-month adjustments you haven't yet been billed for. The full amount is due on close.

All current rates live on the pricing page.

Any change to a rate gets at least 90 days' notice before it takes effect. Notice goes to you by email and posts on the pricing page on the same day. The 90-day floor is enforced in code: the platform refuses to insert a rate change with an effective date sooner than 90 days out.

If a change is going to cost you more and you don't want to stay, leaving during the notice window is free. Export your library and close your account at any point in those 90 days — no exit fee, no prorated charges. The current export-is-free year applies regardless of when you joined.

Within a billing cycle, you are grandfathered onto the rate in effect at the start of that cycle. Mid-cycle changes take effect the following cycle.

Delete a photo, video, album, or room and the platform shows it as deleted to everyone, immediately. The bytes are retained for 30 days so you can restore once if you change your mind. After 30 days a daily job removes them and every reference to them.

Storage billing continues during the 30-day window because the bytes still exist. Once they're gone, the storage charge is gone with them.

You can delete your entire account at any time. Account deletion is total and immediate — every photo, comment, reaction, share, room, and the encryption key that secured them are removed in one cascade. The 30-day recovery window does not apply to account-level deletion. Billing records persist as long as the law requires, no longer.

If a payment fails, the family moves into a grace state. Members and external recipients lose access; payers can still see the library and update payment. After 90 days without successful payment the family becomes a ghost; eventually frozen, which closes the cascade described above.

Any of these states is recoverable by paying the backlog of subscription charges. Email goes out at each transition. If you intend to leave, account deletion is the clean path — tell us so we know not to keep sending bills.

You can download a full copy of your library at any time. You get the bytes plus the metadata they arrived with, so the export round-trips. Library export is free, every time, no rate floor.

The short version: nothing illegal where you live, nothing abusive of other people, nothing that circumvents platform integrity (uploading hashes that match known illegal material, attacking other accounts, accessing content that isn't yours).

Content that violates these gets removed and accounts get closed. The platform cooperates with law enforcement to the extent legally required and no further.

The service runs with care, but not without bugs or downtime. Treat your local copy as a real backup and treat VestaNabu's copy as a real backup, and you'll be fine.

Liability is capped at the amount you've paid in the trailing 12 months.

Terms questions, billing questions, and operator feedback all go to support@vestanabu.com. Every message gets read.