Ridgeback — backing up the family photos

The system decides what this app may read; the household decides what belongs in the family library. After that: two independent states per photo, two distinct delete verbs, and a count that tells the truth about what has not happened yet.

Backup flow v0.3 · iOS + Android + desktop

2026-09-10
iPhone 390 × 844 · Pixel 412 × 915
desktop · 1120 × 780
Maintained by Not Hotdog LLC

01Turning it on

Partial photo access is the trap on both platforms: the household believes it granted access while the backup quietly covers a subset. Widening the grant is step one of two, and it changes what can be seen rather than what gets backed up.

02Albums

The system decides what this app may read. The household decides what belongs in the family library. Screenshots and someone else’s shared album are visible and still off, because visible is not the same as wanted.

02Folders · Android

Android enumerates folders on disk rather than curated albums, so the list is the shape of the storage — and it includes folders other apps write into. Omar’s Pixel is the second device in this household, and these switches move its contribution.

03Backing up

One large number, and it is a count rather than a percentage. Turn videos off and watch the bytes collapse while the count barely moves — video is most of the weight and almost none of the items.

04The library

Every tile carries two marks, because stored and understood finish days apart. The box copies bytes in minutes; the local model reads them whenever the graphics card is free.

05One photo · two verbs

Freeing space on the phone is the most common reason anyone deletes a photo, and a backup that follows them is worse than none. So the two actions never look alike and never sit adjacent.

06The desktop app

The window holds the household's identity and the destination at once, which is why the desktop shows what every device contributed, imports this computer's own folders, and owns the question of whose storage the bytes actually sit in.