Private by Default: How to Share a Memory Capsule With Family Without Broadcasting It

--
title: "Private by Default: How to Share a Memory Capsule With Family Without Broadcasting It"
description: "A memory capsule holds things you would not say at a dinner table. A practical model for private capsule sharing: one person, one piece, and a clear default of nothing shared."
tags: ["privacy", "design", "personal", "memory"]

canonical_url: https://stillherememory.com/blog/share-capsule-with-family

Most sharing features are built for reach. You write something, hit a button, and the system optimises for how many people see it. That default is wrong for a whole category of content: private memory. If you want to share a memory capsule with family privately, reach is the enemy, not the goal.

A memory capsule is one person, described in detail, by someone who misses them. It contains the kind of material you would not say out loud at a family dinner. So the correct starting state is nothing shared. Not with the team running the service, not with relatives, not through some helpful default that got enabled in an update.

The default matters more than the controls

Give people a sharing panel with twelve toggles and they will get one wrong. Give them a system where nothing moves unless they carry it out, and the mistake surface shrinks to almost nothing. Private capsule sharing works because there is no ambient audience to accidentally reach.

Concretely, three properties are worth designing for:

• The user picks the person. One recipient, never a group by default.
• The user picks the fragment. One memory, one photo, one paragraph, rather than the whole record.
• Withdrawal is possible. What has not been sent is still fully under their control.

Why a file beats a link

This is the part people get wrong. A shareable link feels modern and is much harder to live with, because a link can be forwarded, indexed, screenshotted, or sit in a group chat for two years. A plain exported file sent directly to one person has a smaller blast radius. It is less elegant and more honest about what is actually happening: you handed something to someone.

If your product has both, make the file path the obvious one and the link path the deliberate one. Not the reverse.

Sharing has a social protocol, not just a technical one

The technical side is the easy half. The failure mode I keep seeing is social: someone shares a memory with a relative, and the relative reads it as a request to fix their grief. Advice comes back. Or a correction: that is not how it happened.

So the interface should encourage the sender to state what they want. "You do not have to reply" is a complete instruction, and it changes the exchange. Tools that let people set expectations alongside the content produce better outcomes than tools that just move bytes.

What should never be shared

Some content in a capsule is structurally private. Unresolved conflict. Private guilt. The two-in-the-morning material. If a user starts editing a capsule for an audience, the capsule stops working as a place where they can be unguarded, and you have quietly destroyed the thing they came for.

A rough split that holds up in practice:

• Shareable: stories, small habits, a photo the family already loves.
• Keep back: unfinished conflict, private guilt, the late-night entries.
• Ask first: anything involving a living relative who never agreed to appear in it.

The takeaway for anyone building this

Privacy in memory tools is not a settings page, it is the default state plus a narrow, deliberate path out. Build the path so it carries one piece to one person, make withdrawal cheap, and let the user say what kind of response they want. Everything else is decoration.

The full version of this, written for people rather than developers, is at stillherememory.com.