HushOS has family plans from today. Up to 20 people share one plan's storage, and it covers both their own files and the family folders they share, end-to-end encrypted. Everyone's own files stay private to them. Families are on the web and in the Android app. The iPhone app isn't in the App Store yet, and its family folders are still being finished.
What a family is
A family is a group of HushOS accounts with folders they share. Every member can open the family folders, and nobody else can, us included. Their keys are made and sealed on members' own devices, the same way your own files are.
Each member keeps their own files. My files stays private from the rest of the family, exactly as it is private from us. The family folders sit beside it, under the family's name. An account can be in one family at a time.
Lindqvist family
Family folders. Everyone in the family can open what’s in them.
Try it: open a folder, Members or New family folder. Nothing here is saved.
One person organizes the family. They can let others manage it too: invite people, let them in, make family folders and remove someone.
One plan's storage
A family's storage covers everyone's own files and the family folders together. There is no separate allowance to keep track of: a file in My files and a file in a family folder draw from the same plan.
One plan for everyone’s files
Move the sliders. The plan is the smallest that fits with a tenth to spare, for versions and Trash, as the pricing page works it out.
Family Pro fits.
2 TB- Everyone’s own files, 900 GB
- Family folders, 300 GB
- Free, 848 GB
Their own files leave the family’s storage with them.
Moving files between My files and a family folder uses no extra storage, because both sides are the same plan. Your device does the move: it downloads each file, locks it again under the keys of where it is going, uploads it, and the original is deleted as the copy lands. Only the current version moves, and the move dialog says what else is lost before it starts.
The people who manage the family see how much space each person's own files take, rounded up to the whole gigabyte. They never see the files' names, how many there are, or what is in them. Everyone in the family sees how much the family stores in all, counted the same way, so nobody can work out exactly how much someone else stores.
On a phone, your own files work as before, and the storage the app shows is the family's.
Joining
Whoever starts a family names it, then chooses its plan before inviting anyone.
You invite someone by email, and the invitation is open for seven days. They sign in, or make an account, and accept. Someone already in another family has to leave it first. Then someone who manages the family lets them in, with one click on the family's page. Nobody reads anything out, on either side.
When they are let in, the manager's device writes the keys HushOS gives it for the newcomer into the family's signed member list, and the newcomer's device takes the family as HushOS first shows it. From then on it holds on to that: every later member list has to follow on from it, signed by someone who manages the family, and anything else is noticed and paused, never used.
A newcomer's own files join the family's storage when they are let in, so they have to fit in the family's free space. If they don't, the person letting them in is asked to free up space or move to a bigger plan first.
Checking each other
Any two members can check each other whenever they like. Each opens the family, chooses Check it's Maya beside the other's name, and the two of you compare twelve words, in person or on a call. Not in a message sent through HushOS.
What a check adds. A new member's device learns who is in the family and which keys are whose from a member list the server stores and hands out. Until someone checks, a dishonest server could have handed the person letting a newcomer in keys of its own for them, or shown the newcomer a family it made up, and read what goes into those family folders. The twelve words are worked out from the member list that let the later of you in, and from both your accounts, so matching words mean you both see the same family and each of you has the other's real keys. If they do not match, nothing is saved, and the screen says what to do next.
A check is best made with the person who made the family: two newcomers who check only each other learn that they see the same family, not that it is the real one.
Who is checked first. Managers can let people in and change the family, so nobody is made a manager, or the organizer, until whoever gives them the role has checked it's them. Someone invited to manage the family joins as a member and gets the role once they are checked.
Checking protects a family from the server. It does not protect a family from the people who manage it: they decide who is in it.
When someone leaves
Someone who manages the family chooses Remove from family. The person removed loses the family folders straight away, and the device of whoever removed them replaces the keys of every family folder, which can take a few minutes. Someone who leaves on their own loses the folders straight away too, and their keys are replaced the next time a manager opens the family. Either way, their own files stay theirs.
Their own files go back to their own storage: Free, unless they choose a plan. If the files take more than that, they can still open, download and delete everything, but can't upload until they make room. Nothing is deleted.
Once their keys are replaced, nothing they kept opens anything new. Until then (for someone who leaves on their own, until a manager next opens the family), files added to the family folders are still locked under keys they had. Files from before they left stay sealed under the keys they had, so anything they could open then stays readable to them if they ever got a copy of the server's data.
Files keep their authors through all of that. Every file in a family folder carries a signature from whoever wrote it. Replacing keys means sealing every file's keys again, and the easy way would sign each file as the work of whoever replaced the keys. HushOS keeps the writer's original signature instead, and the person replacing the keys signs only that they sealed it again. Info on the file shows both: Written by Sam, Keys replaced by Maya. Your device opens the original and the copy sealed again and compares them itself, so nobody can attach Sam's signature to something Sam did not write.
A file written by someone who has since been removed reads "Written by Sam, who has left Lindqvist family." That mark is on purpose. Someone who has left may still hold the keys they had, and a signature carries no date anyone can trust, so HushOS cannot tell an old file of theirs from one made to look old. It says what it knows instead of vouching for them.
When a plan or a family ends
Whoever pays can cancel the plan from the family's page. It stays until the end of the time paid for. When it ends, everyone's own files go back to their own storage, as when someone leaves, and until someone chooses a plan again nobody can upload to the family folders or be let in. Nothing is deleted.
A family ends when its last member leaves it or deletes their account. If its plan is still renewing, whoever pays cancels it first; it then runs to the end of the time paid for, with no refund, and HushOS keeps it set to end. 30 days after a family ends, its folders and everything in them are deleted from our servers, and then, once its plan has ended, its member lists, key changes, memberships and invitations. The family's billing records are kept for accounting, and the privacy policy has the exceptions.
Plans
- Family Plus
- 800 GB for the whole family, $10 a month
- Family Pro
- 2 TB for the whole family, $20 a month
- Family Max
- 4 TB for the whole family, $30 a month
- Members
- Four included, then $1.50 a month ($15 a year) for each member after that, up to 20
- Yearly
- $96, $192 or $288 a year: $8, $16 or $24 a month
- In euros
- The same figures as in dollars
- In pounds
- £8, £16 or £24 a month, or £72, £144 or £216 a year, and £1.20 a month (£12 a year) for each member after four
- In rupees
- ₹399, ₹799 or ₹1,399 a month, or ₹3,900, ₹7,800 or ₹13,800 a year, and ₹59 a month (₹590 a year) for each member after four
- Tax
- Added where it applies, at checkout
The pricing page shows the prices in your currency.
Whoever chooses the plan pays for it. Letting in a member past the places paid for adds a place, charged straight away for the rest of the period, and only the person who pays can do that. Fewer places, or a smaller plan, start at the next renewal, and a smaller plan can be chosen only while everything the family stores fits in it.
Polar, which takes the payment, is told it is a HushOS family, who pays and how many places are paid for. It is not told the family's name or who is in it.
If you run HushOS on your own server, families are in the same code and on by default. Without billing there is no shared plan: each family folder has the space you set, and members' own files keep their own.
What the server knows
To let the right people in, HushOS's server knows the family's name, who is in it and what each person can do, who invited and let in whom, the email addresses invitations went to, and how many family folders there are, with their sizes padded as every file's is. It already knew how much each person stores; what is new is that the people who manage a family see that figure, rounded up to the whole gigabyte. It cannot open family folders: not a file name, not a byte of what is inside.
The family's name is not encrypted because it appears in invitation emails. If you would rather it said nothing, choose a neutral one.
The security page lists what the server learns about everything else, and the privacy policy says how long each of these is kept.
What is not done yet
- Families on iPhone. The iPhone app isn't in the App Store yet. Until it is, on an iPhone you use a family in a browser.
- Making a family on a phone. In the Android app you join a family, use its folders, invite people and let them in, but you create a family and choose its plan on the web.
- Sharing from a family folder. You cannot share a file or make a link from inside a family folder yet. When keys are replaced, HushOS has to tell which shares were made by someone allowed to make them, and that needs shares signed at family level, which we have not built.
- Limits for each person. One member's own files can fill the family's storage for everyone, and then uploads stop for the whole family until there is room. A manager can see whose files take the space, but can't set a limit yet.
- Handing over the bill. While a plan is running, whoever pays for it can't hand it to another member, so they can't leave the family without cancelling it.
- Large moves. A move between My files and a family folder goes down to your device and back up, and a file over 256 MB can't be moved that way yet: download it, then upload it where it should go.
- What someone already has. A member who is removed keeps anything they already downloaded or kept on a device. New keys protect what is written after the keys are replaced; they cannot reach into copies someone already made.