Built so that trusting us is optional.

Who holds what

Your family holds the keys. Till18 holds none. There is no company account with a balance in it, no omnibus wallet, no administrator who can move a capsule — not because we promise restraint, but because the ability was never built.

Signing in is by email, and the login provider signs on your behalf rather than holding anything of yours. That distinction matters: it means the provider can be replaced without a single capsule moving, and it means no vendor of ours sits between your family and the money.

The guardian quorum

You appoint guardians — usually a partner, a sibling, a close friend. Five is the shape we recommend, of whom three must agree for anything unusual to happen. Guardians cannot spend, cannot withdraw, and cannot see more than they need to. What they can do is vouch for each other, replace a lost key, and hold one piece each of the fallback.

The emergency valve

Life occasionally justifies opening a capsule early. When it does, a majority of your guardians must approve together, a 60-day public notice runs, and any single guardian can veto it during that window. The delay is not bureaucracy; it is the thing that makes coercion pointless and mistakes reversible. We never charge for it.

What an attacker gets

Stealing one phone gets nothing. Stealing one guardian’s key gets nothing. Phishing a parent gets nothing, because a parent has no withdrawal power to phish. The realistic attacks are social, slow and visible — which is exactly why the emergency path is public and delayed rather than fast and private.

The contract, and the audit

Each capsule is its own contract, published where anyone can read it. An independent security audit of that contract is underway; we publish the report when it lands, including anything it finds. A capsule created before an audit and a capsule created after it are the same contract — we do not quietly upgrade the rules under existing families.