Why export is free forever
Lock-in is the standard business model for memories. We made it impossible to build here, on purpose, in code.
The economics of memory-keeping products usually rest on a quiet fact: the memories are hostage. Once the photos, the voice notes, and ten years of family writing live inside a service, leaving costs more than staying, and the pricing page knows it. Nobody writes "lock-in" on a slide; it emerges, one retention decision at a time.
A family archive is a century-scale object. Whatever we charge for, it cannot be the exit — a family's ability to take everything and walk away must cost nothing, require no one's permission, and survive our worst year. So export at DearestEllie is free, complete, and always available; and because policies erode, the guarantee is implemented as code that makes the alternative unbuildable.
The invariant, in code
One module lists the capabilities that are always free — full export is on the list, alongside privacy controls and the basic archive itself — and one guard function stands in front of the payment path: if any contribution request names an always-free capability as the thing being charged for, the code throws. A checkout that gates export cannot be written here without first deleting that guard in a reviewed, visible diff. The test suite goes further and scans the user-facing copy itself: phrasing that gates export behind a plan is a forbidden pattern that fails continuous integration, the same as a broken function.
Free is necessary but not sufficient — a free export into a proprietary blob is still a hostage situation with better manners. So the export is an open, documented, versioned format: the Open Memory Format, plain JSON a person can open in a text editor and a programmer can parse in an afternoon. The zip export carries its own documentation — the full specification, a human-readable README, an offline viewer that works in any browser with no connection to us, and a checksums file so every original can be verified with standard tools. The format identifies itself inside the file, so an export found on a hard drive decades from now, long after this service, still says what it is.
And the door swings both ways: the same format imports back in. A family can export, hold the file for years, and restore it into a new archive — here, or in any other software that chooses to read the published spec. We genuinely hope others do.
The business consequence
The honest question is what's left to run on, if leaving is free. The answer is the commons model: voluntary contribution, keepsakes printed at cost, and families who can help carrying the cost for families who can't. Remembrance itself — creating an archive, keeping it, exporting it — is never the product being sold, so it can never be the thing withheld. This is also why no archive is deleted or locked because a family cannot pay: the same principle, pointed at the other exit.
Making leaving free changes the incentive structure more than any mission statement could. A service that can hold memories hostage will eventually be run by someone willing to; a service that cannot must be worth staying for. That is the only retention strategy we allow ourselves — and putting it in code, rather than in a promise, is how we make sure the version of us having a hard fundraising year still keeps it.