Families
A family sees its own children, because that is a database rule and not a link
The delivery side of picture day, written without the marketing tense. The part that is built is described in the present. The part that is switched off is said out loud, before anything else, because a page that describes buying as something available today would be a false claim about money on a page about children.
What is switched off, said first
The family store is early access and live payment is not turned on. There is no checkout on this site, no price on this site, and nothing here that takes money. A family cannot buy a print through this today.
We put this above the capability list rather than under it on purpose. A page that lists what a store can do and discloses the dead rail in a footnote is technically honest and practically misleading, and the ordering is the only part of that a reader actually experiences.
The mechanism as built, not a promise of when: families buy prints and downloads, the school earns from those sales above a cost floor enforced in code, payouts route to each party’s own connected account, and a fundraiser gift is never skimmed on the way through. Raw card data never touches our servers. None of it runs today — live payment is not turned on.
That last promise is a design commitment rather than a capability claim, which is why it stays in the present tense while everything around it is in the future. Re-tensing a claim is honesty; deleting a promise because the rail is off would be the opposite, and the two look identical as a change.
Delivery is a permission-checked read
When a family opens what the school has sent, the system resolves which students are attached to that family and returns those. Not a folder, not a code on a card, not a link that anyone who receives it can open.
The distinction matters most in the ordinary case rather than the alarming one. A shared gallery link forwarded once in a class group chat is not a breach anybody notices, reports, or can undo — it is simply a photograph of somebody else’s child sitting in a stranger’s messages, forever. A permission-checked read has no forwardable form.
The wall that makes this true is in the database rather than in the application: a read that came from outside the school’s own tenancy returns zero student rows because the database refuses it, and that is re-checked on every build rather than trusted to a code review.
The decisions a family makes, and where they land
A family’s publication permission is held per student, it defaults closed, and it is re-checked at the point of use rather than at the point it was collected. That is what lets a withdrawal reach the digital edition, the online reader and the print run together instead of reaching whichever of the three somebody remembered.
Face matching is not wired in the shipping product and cannot be switched on from it: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. It is not bundled into a publication permission, because bundling two unrelated decisions into one signature is how consent stops meaning anything.
The full mechanism, including the piece of it we have not finished proving, is on matching. The same story written for a parent rather than for a school office is at homeroom.family.
What a family is actually served
Four things reach a family out of a picture day, and they have different rules. Separating them is what lets the built parts be described in the present tense while the switched-off part is described in the future one.
The portraits
Built
The images of that family’s own students, and no others.
Resolved by a permission-checked read against the roster rather than handed over as a folder. The family does not see a class, a year group or another family’s children, because the question the system answers is “which students are attached to this family” and it answers it in the database.
A missed notice
Built
If a student was not photographed, the family finds out from the school rather than from silence.
This exists because the missed list is derived from the roster rather than written by hand, so it is available on the afternoon of the day rather than in the week somebody gets round to reconciling. Retake day is then a session against that same list.
The decisions
Built
Publication permission, held per student and defaulting closed. Face matching, off until turned on.
Two decisions, kept apart on purpose. Bundling them into one signature is how a consent form stops meaning anything to the person signing it, and it is the reason a family can allow a yearbook photograph without allowing anything biometric.
Buying prints
Early access
Not today. The store is early access and live payment is not turned on.
There is no checkout on this site and no price on it. The mechanism as built: the school earns above a cost floor enforced in code, payouts route to each party’s own connected account, raw card data never touches our servers, and a fundraiser gift is never skimmed on the way through. None of it is live — payment is not turned on.
A permission-checked read against a gallery link
This compares two ways of getting images to families, not two companies. The left column is the ordinary arrangement, and it is ordinary because it is easy to build rather than because anyone decided it was right.
| The question | A gallery link | A permission-checked read |
|---|---|---|
| Who can open it? | Whoever has the link, including whoever it was forwarded to | The family the students are attached to |
| Can access be withdrawn later? | Only by invalidating the link for everyone | It is re-resolved on every read |
| What does a forward cost? | Nothing, and nobody finds out | Nothing to forward: there is no working link form |
| Where is the rule enforced? | In whatever page holds the gallery | In the database, re-checked on every build |
| Is a minor’s image ever publicly reachable? | A link is public by construction | Never made public and never indexed |
What a family asks
Can a family buy prints through this today?
No. The family store is in early access -- built, opening gradually, not open -- and live payment is not turned on. This site runs no checkout and quotes no price. We would rather say that plainly than let a page imply otherwise by describing the buying flow in the present tense.
How does a family see its own children and nobody else's?
Delivery is a permission-checked read against the roster: the system resolves which students are attached to that family and returns those, because the wall is in the database rather than in the page. There is no shared link that works for whoever has it, because a link that works for whoever has it is not a permission model.
Is a child's photograph ever public?
No. A minor's photograph is never made public, never indexed by a search engine, and never sold. Sharing outside the school happens only where a permission on file allows it, and even then it is a deliberate share rather than an open door.
Who decides whether a photograph can be published?
The permission on file for that student, applied by the system at the point of use rather than remembered by a person. That is why the gate sits before delivery in the order of the day rather than after it.
What happens to a photograph when a family leaves the school?
It stays with the record it belongs to, under the school's own retention decisions, in the school's own tenancy. It is not sold, and it is not handed to an outside company as a data set to be mined. This is a statement about mechanism, not a legal conclusion about entitlement.