Why PictureBook starts private
The product boundaries that keep a child's story inside the family workspace until a parent decides otherwise.
A picture book can contain a child's name, appearance, interests, and family ideas. Those details deserve a stronger default than a public gallery.
The draft belongs to one family
Child profile fields are encrypted before storage. Owner APIs recover them only inside the authenticated family boundary, while anonymous routes never receive the encrypted payload or compatibility columns.
Generated media is not public by default
Illustrations and narration live behind same-origin asset proxies. The owner workspace may preview work in progress, but the reader and share surfaces allow only approved media from a ready book.
Sharing is a capability, not a publication
A parent must confirm guardian authority before creating a share link. The link contains a random capability token, exposes no account controls, and stops working immediately when consent is withdrawn.
Deletion means access stops first
Deleting a book revokes its readers and share links immediately, then schedules exact-prefix storage cleanup. A failed cleanup stays visible to an administrator without restoring access to the book.
Privacy here is not a badge added at the end. It shapes the route, storage, review, sharing, and deletion contracts from the beginning.
