A parent posts a first-day-of-school photo in what looks like a closed group. Twenty people they trust. A week later a cousin mentions seeing it somewhere else, or the app surfaces it in a "memories" module that a friend-of-a-friend can scroll past, or someone screenshots it and it turns up in a group chat nobody in the family is part of.
Nothing was hacked. Nobody broke a rule. The photo simply did what the platform was designed to let it do: travel.
That pattern repeats every day, and it is not a story about careless parents. It is a story about how the tools were built.
How most platforms actually work
Four defaults do most of the damage.
Public is the starting point. On most large networks, private is a setting you have to find, not the state you begin in. Any account created quickly, or by a family member who is not comfortable with settings screens, starts wide open.
Content is designed to be indexable. Profile photos, display names, and public posts are crawlable. That means a photo can be found by someone who was never looking for your family in particular.
Sharing is not something you control. Once a person can see an image, they can screenshot it, forward it, download it, or re-upload it. "Only friends can see this" describes visibility, not distribution.
The platform's incentive is reach. Recommendation systems are graded on engagement. A photo that performs well gets pushed to more people, which is exactly the opposite of what a parent wants from a picture of their eight-year-old.
None of those four are bugs. They are the product.
What access-controlled actually means
"Private" is marketing. "Access-controlled" is an engineering claim, and it is testable. Three questions decide whether an app really has it.
Who can see this, exactly? Not "friends." A named, countable list of people. If you cannot look at a piece of content and see the finite set of accounts with read access, it is not access-controlled.
Who can move it? Screenshots can never be fully prevented on any device, so the honest version of this question is narrower: does the app itself give people a one-tap way to rebroadcast your content outside the circle? A reshare button, a public link, a cross-post feature. Every one of those is a hole you did not open.
What happens when someone leaves? This is the one almost nobody asks, and it matters most. When you remove a person from a family group, do they keep the content they already had access to? A system built around access control revokes on removal. A system built around reach does not, because it never really tracked who had access in the first place.
What to check before you post
Five questions, worth about ten minutes on any app you already use for family sharing.
- What is the default audience for a new post? Create a test post with no photo and look at the audience selector before you change anything. Whatever it says is what your least technical family member is publishing to.
- Is my profile photo and display name public? On most platforms these are public no matter what your other settings say. Check whether your kid's face is your avatar.
- Can content be reshared out of the group by the people in it? Look for a share, repost, or "send to" button on your own post. If it exists, treat the group as semi-public.
- Is there a searchable or algorithmic surface? Search the app for your own name from a logged-out browser session. What comes back is what a stranger can get.
- What does the privacy policy say about "partners" and advertising? If you can find the words "advertising partners," "interest categories," or "affiliates" in a policy, your family content is feeding a targeting system. We wrote a longer breakdown of how to read those signals in what "you are not the product" actually means.
If an app fails questions 1, 3, or 5, it is not a family sharing tool. It is a broadcast tool that family members happen to use.
Why we are building Orbit around these questions
Orbit starts from the answer sheet above rather than retrofitting it. Content lives inside an orbit, which is a finite invited group, and it does not leave that orbit without your action. There is no public feed, no discovery surface pointed at your posts, no reshare button that moves an image to an audience you did not choose. Remove someone from an orbit and their access ends. Messages are on your terms: you decide who can start a conversation with you, and only the people in that conversation can see it. There are no ads, so there is no reason for us to profile anybody, and no advertising SDKs in the app to do it.
We are honest about the limit: no software can stop a person who can see a screen from photographing it. What software can do is refuse to hand out a bigger audience than you asked for. That is the part most apps decided not to do.
If you want the mechanism-level version, how Orbit protects you walks through it. Or read the case for smaller audiences in private social media is not antisocial.