Hello. How can we help?

Walk in: there are no invitations anymore. Type your family's name and your address on neiliro.com and the letter with your family's own link arrives within a minute. It opens the setup once; the address you used becomes the administrator's login. Nothing arrived? Check spam, then write below.

The first 30 days are free, no card needed. After that there is one plan for the whole family, however many of you there are: €4.99 a month or €44.99 a year. Cancel anytime; a payment can be refunded within 14 days, no questions asked. Exporting your data is free forever — see the terms. Families created before the public launch keep the promise made to them: a free year.

Two months free instead of one. A family already using Neiliro can share a link from its own settings; a household that starts here through that link gets 60 free days, and the family who shared it gains a free month once the new family subscribes. The link carries a random code and nothing else — it does not tell us, or you, anything about the other family, and the family who shared it never learns who used it, only how many did.

Nothing disappears. The family's space becomes read-only: you can still sign in, read everything and download the archive, but not add or change anything. It stays that way for 60 days, and subscribing at any point brings it all back as it was. Only after those 60 days, and after writing to you twice, do we remove the data.

The service is monitored around the clock, backed up nightly, and updated without downtime — and it is still young, which means we do not yet promise an uptime level. One family running on it every day is our own. If something breaks, we would rather hear it from you than find it in a graph.

The first person to set up the family space becomes its administrator. From Settings they create the others and hand out one-time invitation links, which expire after a week. Everyone picks their own password on the way in — nobody types a password for someone else.

Once. A new family arrives at an address like smiths-k3x9.neiliro.com — the suffix is there so no two families collide — and for the first 24 hours after setting up the hub, the administrator can replace it with a name of your own, from Settings → Hub address. The hub offers this at the first sign-in too, so you don't have to go looking.

It is one move, because everything follows the address: everyone signs in again at the new one, the family email address changes with it, and links to the old name stop working — including a home-screen icon added before the move, which needs adding again. Do it before you hand the address to the rest of the household and none of that costs anything.

After the first day, or after the move, the address is permanent. The old name is retired rather than given to the next family, so a bookmark of yours never opens someone else's hub.

Neiliro installs from the browser: open your family's address on the phone and choose "Add to Home Screen". It then behaves like an app, works offline for what you have already opened, and updates itself in the background. No app store, no download. The same page makes a good always-on kitchen tablet.

Yes — demo.neiliro.com gives you a throwaway family filled with sample data, no signup. It disappears when you log out.

Use "Forgot password?" on your family's sign-in page. The link is single-use, expires in an hour, and is only ever mailed to an address that has been confirmed — which is why we ask you to confirm it when the account is created. A reset does not switch off two-factor authentication.

Two-factor codes cannot be recovered by email — that would make the second factor pointless. Write to us from the address on the account and we will verify who you are before turning it off, which takes a bit longer than a password reset by design.

Your account is recoverable — the password reset above still works. The family's words are another matter: they are encrypted with a key held only by the family, in each member's browser and behind each member's password, with the recovery code as the spare. If another member still signs in, ask them: Settings → Family key → re-admission link hands you the key again, and you can then write a new recovery code. If nobody in the family can sign in and the code is gone, the words are gone for good — the dates, amounts and links remain, the text does not. This is by design, and it is the one situation we cannot help with, because we never had the key.

Yes — an administrator changes it in Settings → People: open the member and edit the Login address field. The new address then has to be confirmed before it can recover the account, exactly as the first one did.

Only an administrator can, and it is deliberately not filed with the display name: the sign-in address is a credential. Whoever holds it can reset the password, so quietly rewriting one is quietly handing over the account.

Not the words. What your family writes — notes, tasks, events, list items, money notes, attachments and letters — is encrypted in your browser with a family key we do not hold. We cannot read it, and neither can anyone who steals our disks or backups. What we can see is the structure: who, when, how much, which rows link to which, member names, file sizes. Three exceptions are deliberate: a letter is seen once on arrival before it is sealed (that is how e-mail works), a wishlist is readable because it exists to be shown to guests, and a calendar subscription or shared link decrypts for whoever holds the link. Personal tasks and notes stay personal even from the rest of your family — there is no administrator back door. The privacy policy is the long version.

Encryption in the browser rests on the code the browser runs, and no web app can remove that: whoever serves the code could serve a version that copies the key. So the code is open, every release is built by a public workflow that builds it twice and refuses to publish if the two differ, and each release carries the SHA-256 of every file. How to compare what your browser loaded against that list, or rebuild the tag yourself.

In the European Union — DigitalOcean in Amsterdam. Each family is a separate, isolated database rather than a row in a shared one. Backups are encrypted, taken nightly, and expire within 14 days.

Possibly — tell us quickly. A restore brings the whole family back to how it looked at a point in time, so anything else written since would be lost too; that makes it a last resort rather than an undo button. Backups only reach back 14 days.

Settings gives you the complete archive — database and every attachment, in one file — and a button that deletes the family. The archive restores into the open-source self-hosted edition, which is the whole point: leaving has to be possible or "no lock-in" is just a slogan.

Every hosted family gets one at [email protected] — Settings shows yours. Give it to the school and the utility company: their letters land in the hub where anyone at home can read them, and one tap turns a letter into a task. Replies go out from that same family address.

The mailbox name is your hub's address: rename the hub during its first day and the email address moves with it, so hand it out once the name is settled.

Better not. It is a household mailbox by design: everyone in the family sees what arrives there. Household correspondence — yes; your bank and your doctor — keep those in your own inbox.

It is the same application from the same source, free forever under AGPL-3.0, running on your machine. What you take on is the operating: certificates, backups, updates, and mail delivery. The hosted service is that work done for you, plus the family address on our mail domain.

GitHub issues — not this form. Your hub is yours, we cannot see it, and an answer in the open helps the next person with the same problem. The README covers installation and upgrades.

Both directions work — it is the same archive format either way. Tell us in the form and we will walk you through it; the move includes your attachments and takes a short, planned downtime.