Principles

• Self-hosting is no-obligation. The paid thing is our hosting convenience, never the software. A self-hosted space owes us nothing — and one that leans on shared glue we run (the push relay, the signed release feed) is warmly invited, never required, to contribute.
• We can only price what ciphertext exposes: storage bytes, member counts, space counts. Never content, never analytics.
• Paying is not anonymous. Checkout runs on Stripe, which collects your name, email, and card — and as the merchant we can see those in Stripe’s dashboard. Our own stores still hold only two opaque Stripe ids, a tier key, and a period end per paid space, so a compromise of our systems exposes no billing identity.
• The free tier is first-class. Constraints ratchet only for new spaces; existing spaces keep what they have.
• AI is never bundled — and off by default. Model tokens are the one marginal cost that can dwarf a subscription, so bot/AI usage is always opt-in, and when opted into it’s a metered add-on — never hidden in a flat price.

The price book

What paying buys today: the space stops counting toward the account’s free-space limit, it is never reclaimed as unused, and it carries a larger storage allowance (below).

Storage allowances

Allowances are a function of margin: an allowance is the storage a space could fill forever with the tier still keeping at least 80% of gross — 20% of the price buys your storage, 80% stays for resilience. Two honest exceptions: Free has no revenue (its 1 GB is cost containment), and Family’s €5/year buys only ~3 GB at strict 80/20 — we hold it at 5 GB rather than shrink the family tier. Uploads past an allowance are refused; nothing is ever deleted, and messages always keep working.

Input rates

Hibernation is live in production: an idle space parks as stored bytes, not a running process, so its marginal cost while asleep is storage alone — the compute rate applies only to the fraction of time it’s awake. One deliberate exception: a space with a bot sidecar never sleeps, one more reason AI usage carries its own meter.

The model

For a tier with gross annual revenue G across n charges/year:

net      = G − (0.25 × n) − (0.015 × G)          # Stripe fees out
cost     = GB_stored × storage_rate × 12          # media, the only real dial
         + slot_rate × 12 × awake_fraction        # compute while awake
         + ~€0.10                                 # wakes, requests, push (noise)
profit   = net − cost
break_even_GB = net ÷ (storage_rate × 12)         # where a space stops covering itself

Message text is never material — a decade of busy family chat is a few cents a year of storage. The only way a space outspends its price is stored media.

Estimates per tier

Usage profiles are typical-case estimates, not caps. Gross and net are exact; costs and margins are estimates.

• Break-even storage is the number that matters. Every tier’s included allowance sits far beneath its break-even, so no tier can structurally lose money — while still feeling unlimited in practice.
• Stripe’s fixed fee punishes small monthly charges, which is why the picker defaults to annual (and why a space is priced as a years-scale commitment).
• The fixed floor is small. A modest number of Family spaces, a dozen Community & Friends annuals, or a single Business space covers the whole serving plane; beyond that, margin is contribution toward resilience.
• Business margin is deliberately not an infra story. At that margin the price is buying priority support and features to come, not bytes. If that feels wrong when read beside the books, this page exists to force that conversation.

What could invert these numbers

• AI/bot usage — excluded above by design; metered add-on or bring-your-own key.
• Media hoarding past break-even — bounded by the storage allowances.
• A space that never sleeps — bot-sidecar spaces; today that’s a known subsidy, priced into the margins above.
• Rate changes — Stripe, storage, or machine pricing move; the snapshot is re-derived.