Joining a family

A family agent is set up once, by one adult, and then everyone else joins. There are two ways to join — on a shared family device with a code and PIN, or as your own account by email invite — and both are designed so the powerful controls stay with a responsible adult, by construction.

The agent is ready right away

One adult — the owner — sets up the family household. There's no ceremony and nothing to author: Dustav is provisioned instantly, ready to use the moment the household exists.

Everyone who joins after that just starts talking to it. The first time a new member opens their chat, the agent asks what to call them — a short, plain question, not a ritual — and it's set up from there. The agent already knows the household; this is just meeting a new person in the family.

Joining on a shared device: code, PIN, and an approval

This is for joining on a device an adult sets up, without an email account of your own — typically how a kid comes in:

1. The family code. The owner reads out a short family code. You enter it at the join page.
2. The PIN. One shared PIN for the whole household — the owner reads it aloud too. (The PIN is stored encrypted, and only an adult in the household can see it; whoever's joining never sets it.)
3. An adult approves the device. The first time a particular device is used to join, that device isn't trusted yet. We email the owner a 6-digit approval code — they read it aloud, you type it in, and the device is trusted from then on. (It's the same simple step as signing in by email code, and there's no random link to fumble with on a phone.) The owner's email is the gate — only someone who can read their inbox gets the code, and there's no separate adult PIN to manage. A device that's never been approved can't get in, even with the right code and PIN.
4. Pick who you are. Once the device is trusted, you tap your own profile from the household — or "someone new" to start talking to the agent for the first time.

The code and the PIN are deliberately easy to say out loud, which is why the per-device approval matters: a low-effort credential a kid can use every day is paired with a one-time gate that only an adult can clear.

Joining as an adult: an email invite

Another adult — a co-parent, say — joins as their own account:

1. The owner sends an invite to their email address.
2. They sign in with a normal email code (which creates their account if they don't have one yet).
3. They're added to the household as their own member, linked to their own sign-in.

An invited adult gets their own private layer that's genuinely private — see Shared facts & privacy for what that means.

Roles

Three roles decide who can do what:

• Owner — set up the household and holds the subscription. Full control over members, devices, the PIN, and billing. Can't be removed.
• Admin — an adult the owner promotes (a spouse, typically). Manages members, devices, and settings.
• Member — anyone who joined by code + PIN, or an invited adult. The family-management controls aren't theirs — and for a code + PIN member, they aren't even shown. A kid never sees a settings panel they could change.

The everyday powers a family needs — adding a member, approving a device, managing the subscription — sit with the adults running the household, kept out of a kid's reach by the architecture rather than by a checkbox. Our broader stance on building for kids and families is on the Kids & families page.