There is nothing to scroll past the end of, nobody to discover, no strangers, no audience and no score. A child can only be added to a room by their own parent, and a parent who wants to read a room joins it like everybody else, so a child can always see exactly who is there.

What that adds up to is a real conversation with none of the audience: saying something to people who will answer, sharing a photograph, being part of something that keeps going. The ordinary things, without the rest of it watching.

One thing we are still building: a child signs in with an address their parent types when setting them up, and nothing yet confirms that address belongs to the child. Until it does, a parent could point it at themselves. Verifying it properly is the next piece of work on this.

We also mean to build a review for a child's eighteenth birthday: showing them what was posted about them before they were old enough to decide, and taking out anything they would rather was not there. That is a plan, not a feature. It does not exist yet.

No. The one relationship Roost records is guardianship, because a child has to have an adult who is answerable for them. Nothing else is asked or stored: not who is married to whom, not who is whose cousin, not who is a friend rather than family. A room is whoever was invited into it, and a room for a trip, a party or a wedding works exactly like a standing one, except that whoever made it can close it when the occasion is over. Closing is not deleting. Everything in it stays, and it can be opened again.

Mine are mostly family, which is why most of this page says so. The rule was never who you are related to. It is that somebody already inside asked you in by name, once, with a code that expires.

What it is not for is schools and organisations. They have obligations about keeping and handing over what was said that Roost is not built to meet, and we would rather say so than let somebody find out later.

There is nothing to pay and nothing to buy. Roost earns nothing today. It began as something I made for my own family, and the cost of running it is ours.

That may not last for ever. Something that keeps a family's photographs at full size for years, potentially, has to be paid for somehow, and we would far rather that were the families using it than an advertiser. If Roost ever does become something you pay for, our intention is plain: anybody who helped test it early keeps it free for as long as it exists. I would rather say that now, while it costs me nothing to mean it.

The words, yes, whenever you like: one download, plain text, and you need neither Roost nor an account to open it.

The photographs, voice notes and scans are not in that download yet. They are safe and still full size, but collecting them into one file is a job we have not finished, and we are not going to describe it as though we had. It is close.

Nothing is stranded meanwhile. Every picture in a room is a real image on the page, so you can keep one the way you keep any picture: press and hold it on a phone, right click it on a computer.

In the meantime, ask. Email hello@azimuth.org.uk and we will get your things out for you by hand, or delete them, whichever you asked for. It is slower than a button and it works today, which a button does not.

You can take down anything you posted, whenever you want.

You can leave any room you do not hold, whenever you like, and nobody is told. Rooms are held rather than owned, usually by whoever started one, and a room can be handed on: another member who has been trusted with holding one asks for it, and whoever holds it decides. They can hand it over there and then, or set that person to take it on later, or say not now. What nobody can do is press a room on somebody who has not asked for it. Until a room is handed on, whoever holds it cannot leave, because a room with nobody answerable for it is worse than one you are stuck in. Whoever holds a room can also close it, which stops anything new being posted, and nothing already in it is deleted by us.

What you cannot do is delete other people's photographs, and we would rather be straight about that than let anybody find out later. A picture of five people at Christmas is five people's picture.

Removing your account outright is not a button yet. Email hello@azimuth.org.uk and we will do it by hand, for now.

Taking your name and face out of things other people wrote is the one we have not built and cannot yet do by hand either. It is coming.

Roost is made and run by Azimuth Partners Ltd. Beyond that, three companies. Supabase holds the database, the sign-in system and the photographs, voice notes and scans themselves, on servers in London. Vercel serves the website and the app. SMTP2GO sends the only emails Roost ever sends: the sign-in code you ask for, one message to a child telling them a parent has set them up and how to get in, and a note to us when somebody fills in the form below. There is no email about anything that happens inside a room. All three are contractually barred from using any of it for anything but running Roost.

That is the whole list. No advertising company, no analytics company and no data broker. If a fourth is ever needed it will be named here before it is used.

As a rule: a family's room is not opened. There are two exceptions and both are narrow, fixing a fault that cannot be fixed any other way, and a lawful demand that cannot be refused. Every time either happens we write it down: when, which room, who looked, and why. Be clear about what that is and is not. The register is a real table in the database, and the rule that lets the room it concerns read its own rows is real and enforced by the database rather than by us remembering to be fair. But a database cannot notice that somebody read something, so nothing fills the register in automatically. We do, by hand, and a promise kept by discipline is worth less than one kept by machinery. It has never been written to, because neither exception has ever happened. Where a lawful demand forbids us from saying it happened, the row still goes in, marked as one we may not show, so what is withheld is the telling and not the record. Two things are still to do: a written procedure for us, and a screen, because today the room's right to read its own rows is true of the database and not yet reachable in the app.

Roost runs on rented servers, and whoever runs a service on rented servers is able to open what is on them. Saying otherwise would be a promise we could not keep. What we can promise is the rule above, and that the room is told every time it is set aside.

Worth knowing how ordinary that is. Apple can open the photographs in a British iCloud account, because the setting that would stop them, Advanced Data Protection, has been unavailable in the UK since February 2025. Snapchat's own terms reserve the right to access, review and delete your content at any time and for any reason. Photographs posted to Facebook and Instagram are not encrypted in a way that shuts Meta out, whatever is true of their private messages. So the useful question is not whether somebody is able to look, but what stops them, and whether they told you.

No, and the reason is that the two are built for different jobs. WhatsApp protects a conversation. Roost protects a record.

It is worth being accurate about what that buys, because it is easy to assume it means more than it does. WhatsApp encrypts messages so that WhatsApp cannot read them, and that part is real. Your history, though, lives on the phone, and what puts it back on a new one is a backup sitting in iCloud or Google Drive. WhatsApp's own help pages say that backup is not covered by end-to-end encryption unless you turn encrypted backups on yourself. So in the ordinary setup you can sign in on a new phone and get everything back, and so, in principle, can Apple or Google. Turn encrypted backups on and neither can, and nor can you if the password goes into the sea with the phone.

Where we think Roost comes out ahead is the other half of it. WhatsApp cannot read your words, but it still sees everything around them: who you talk to, how often, and when. And it belongs to a company whose business is knowing things about you. There are no adverts here, no ranking, no training data and no reason to want any of it.

If a UK court or the police make a lawful demand, we have to comply, and we will tell the room unless we are legally barred from saying so.

Roost is not open to the public and is not being offered as a service. Before that changes there is proper work to do: a privacy notice, a data protection assessment covering the children in it, and advice from somebody qualified to give it. That is one of the reasons it is still a handful of invited households and not open to anybody else.