What we owe each other, and what has not been decided.

One

Who you are agreeing with

Not Hotdog LLC builds Ridgeback, runs it, and is the company on the other side of this agreement. There is no second company standing behind it and no parent to escalate to.

Which country's law governs the agreement is not settled, and where a dispute would be heard is not settled either. This is the same gap the privacy draft carries in its first section. It has to close before either document can bind anyone, and it is one decision, not two.

Two

What this covers, and when

Ridgeback is not open. There is a waitlist, no account you can open today, and nothing being sold. Nobody is currently bound by any of this.

When it does open, these terms would cover the assistant, the apps you reach it through, and this site. They would sit alongside the privacy policy, which answers a different question: this page is what you may do and what we owe you, that page is what is held about you and what you can do about it. Where the two disagree, the disagreement is a mistake, and we would rather hear about it than have you guess which one wins.

Three

Who may open a household

An adult opens a household. Everyone else arrives by invitation into one that already exists, which is how a person gets a seat at all.

Children are meant to be here. A household assistant that could not hold a child's reminders, or recognise a child in a photograph, would not be the product. But the age at which a person may hold their own login is a decision, how a parent agrees on behalf of a child is not worked out, and what changes on the day that child becomes an adult is not worked out either.

This is the largest unanswered question in both documents, and it is not a drafting gap. It is a product question about what a thirteen-year-old in someone else's household is entitled to, and it will be answered in the open like the rest.

Four

The household, and who controls it

A household is not a folder with people added to it. It has a shape, and the shape decides what your relatives can do to your things.

Two things are closed in the model rather than in the interface, which means no screen can be the exception to them. A member cannot edit their own group membership, and a group carrying safe mode cannot hold the power to change groups.

What happens to a household when its Creator leaves is not decided. It is the question most likely to matter in a real house, because the real version of it is a separation, and the answer cannot be that the data follows whoever signed up first.

Five

Safe mode

Safe mode withholds two things: spending money, and sending a message out of the house. They become unavailable rather than hidden, so nobody is left tapping a button that quietly does nothing.

Three properties of it are commitments, not settings, and changing any of them would be a change to this agreement rather than a product decision we make on a Tuesday.

• The flag outlives the grant

  One safe-mode group anywhere in a person's list settles it. A second group cannot hand back what the first withheld, and no group added later can undo it. Give a flagged person the ability to spend and the switch goes on, stays on, and the action still will not fire.

• It is not yours to lift

  A person under the flag can read exactly what has been done to them and cannot be the one to undo it. Every screen about it is legible and none of it is editable.

• Seeing into a household is a separate door

  Joining a household does not carry the right to read the records that relate to a particular person. That grant hangs on a name, so a guest invited over the next five years does not inherit it silently.

Six

What you may not do

Most of this list is ordinary. One item is not, and it is the one that matters for a product like this.

• Do not use a household to watch an adult who has not agreed to be in it

  Ridgeback learns who is in a photograph, keeps a house's messages, and knows where people are expected to be. That is useful to a family and it is equipment to somebody controlling a partner. Inviting a person in so you can read them, without their knowing that is what the seat is for, is a use we will end an account over.

• Do not upload photographs of people you have no business uploading

  You are the one who knows whether the people in your pictures agreed to be in them. We cannot check it and will not pretend to.

• Do not resell it, or run someone else's business on a household seat

  It is priced and shaped for a house.

• Do not attack it

  Breaking into another household, or trying to, is the obvious one. Good-faith security research is welcome and is not what this means, but where to send a finding is not published yet.

• Do not use it for anything illegal

  Said once, plainly, without a list that pretends to be exhaustive.

Seven

Your things stay yours

The photographs, messages, lists, receipts and everything you tell Bobby about your family belong to you. Putting them into Ridgeback does not give us ownership of them and does not give us the right to sell them.

We take the narrowest permission that makes the software work: to store your things, move them between your devices, show them back to the people in your household who are allowed to see them, and let the assistant read them in order to answer you. That permission ends when you delete the thing.

We do not train models on your data without your permission. That sentence is on the front of this site and it belongs in the contract too, because a promise that lives only in marketing copy is not a promise.

Eight

Storage and models you bring

You can point Ridgeback at a bucket you rent and a model you run. Doing that moves part of the responsibility to you, and it is worth being exact about which part.

Your credential is sealed on the way in and the field it was typed into never comes back. Nobody can read it afterwards, including us. Nothing the assistant can call ever touches it either: a tool that needs an object is handed a link the server made, good for five minutes.

Saving a configuration writes a real test object under your own prefix, reads it back, and removes it. Until that round trip works the settings are stored and inert. This is deliberate, and it exists to prevent a household that believes it is backed up finding out five weeks later that it was not.

The two fall back differently, on purpose. If your bucket cannot be reached, storage quietly uses ours, because working out where an object lives must never fail. Questions do the opposite. A household that moved them to a provider it chose did so to stop them going anywhere else, so they never fall back silently, and if you turn a fallback on the screen names the company they would leave for.

What you own once you bring your own: the bill from that provider, whether they stay up, and whether their terms permit what you are doing. We are not answerable for an outage in a bucket we do not run.

Nine

Paying

Managed is what a household gets by doing nothing. We answer its questions on our own model and keep its files in our own bucket. Most households will never open the other screen, so whatever managed does is what Ridgeback does.

The shape of the bill is settled: an allowance is included, and usage past it is charged in proportion and added to the same bill. The rates are genuinely undecided, and so is what happens to a refund. Nothing is charged while the waitlist is the only way in.

Bobby reads the same meter the settings screen does, so what the assistant tells you that you owe and what the screen says can never disagree.

Ten

What Bobby says

The assistant generates its answers, and generated answers are wrong sometimes. It reads receipts without you typing anything in, which means it can misread a number on a crumpled one. It learns who is in your photographs, which means it can put the wrong name to a face. Check it before you rely on it for anything that matters.

It is not a doctor, a lawyer or an accountant, and a confident sentence from it about your health, your rights or your money is still a guess.

On managed, we choose the model and we will replace it. The useful thing to tell you is not which one is running on a given day, it is that it will change. On a model you brought, the answers come from whoever you chose, under their terms as well as ours, and what they keep of what passes through is not something we can promise for them.

Eleven

Whether it is working

This is early software built by a small operation. It will break, and when it does there is no support desk with a queue you can hold in.

Whether there is an availability commitment at all, and what happens if it is missed, is not decided. Saying so is more useful than an uptime figure nobody has the equipment to measure yet.

Twelve

Ending it

You can leave whenever you want, take your things with you, and have what we hold deleted. A deletion completes within 30 days, and the privacy draft is specific about the places it lags on the way: backups, the delivery queue, and the smaller copies of photographs.

We can end an account over the uses in section six. How much warning you would get, and whether there is any way to argue about it, is not decided. It should be, because losing a household's photographs over an accusation nobody could answer is the kind of thing that reads as reasonable in a terms document and is indefensible in practice.

Thirteen

What we are answerable for

While Ridgeback is unfinished it is offered as it is, with no promise that it will suit a particular purpose. That is an honest description of the software rather than a lawyer's reflex.

The limit on what we would owe if something goes badly wrong is not written, and what sits outside that limit is not written either. These are the two terms most often copied from another company's page without being read. They will not be filled in here until somebody qualified has decided what is fair to a household rather than what is safest for us.

Wherever you live, the rights your own consumer law gives you are not affected by anything on this page, and no clause here is meant to take one away.

Fourteen

Changes to these terms

While this is a draft it will change often, and each change will be an open question being closed rather than a term being quietly rewritten. Once there are real terms, how you would be told they had changed, and whether you would be asked to agree again, is not decided.

Fifteen

What is still missing

Everything marked above, gathered in one place. Every one is a decision rather than a piece of work. Until they are made this document cannot become terms of service, and the first two are shared with the privacy draft, so answering them closes four gaps rather than two.

• Whose law applies, and where a dispute is heard

  Section one. Shared with the privacy draft. The entity is settled: Not Hotdog LLC.

• How consent works for children

  Section three. Shared with the privacy draft, and the largest of these. Includes the age for a login of one's own and what changes when a child turns eighteen.

• What happens to a household when its Creator leaves

  Section four. The real version of this question is a separation.

• Where to report a security finding

  Section six.

• The rates, and the refund rule

  Section nine. The structure is settled: an included allowance, then usage charged in proportion on the same bill.

• Whether there is an availability commitment

  Section eleven.

• Notice before an account is ended, and any appeal

  Section twelve. The 30-day deletion window is settled.

• The liability limit and its exclusions

  Section thirteen. Needs a lawyer, not a decision.

• How you would be told these terms changed

  Section fourteen.