Recital photos and video organized by act, class, and performer — consent-aware delivery for dance studios, music schools, and K-12 performance programs

The Consent Graph is the permission record under every action on the platform: which images appear in the shared gallery, which families can access a gallery link, which products can be built for a given performer, and what happens when a deletion request arrives. A standard recital photo delivery is a shared folder link — everyone on the email list can see every child, including the ones whose guardians never consented to that exposure. The Consent Graph enforces the alternative at the engine layer: an unconsented performer does not appear in a shared gallery, a family product cart, or a share-link, because the engine refuses to include them. It is not a policy reminder. It is code.

If a guardian opts their child out of the shared gallery, that child’s images are withheld from the gallery every other family sees — even if the photographer captured them during the performance. The child’s images may still be available to that family alone if the guardian opts in to individual-family delivery while opting out of shared delivery. The split between shared-gallery consent and individual-family delivery consent is a real distinction in the permission record. A child who is opted out of everything appears in nothing: no gallery, no product, no grandparent share-link, no archive thumbnail served to any other party.

Not yet. The storefront substrate, fulfillment engine, and product catalog management are built and production-ready — a studio can configure package tiers, pricing, and album options. The live checkout interface that accepts payment from parents is honest-off: it exists in the platform but is not enabled for live transactions. There is no billing, no subscription, and no pricing commitment from this page. The charge rail — the part that moves money — is also honest-off. When live checkout is enabled (a founder-gated decision), studios will be notified directly.

At setup, the studio defines the event structure: shows (opening night, closing night), acts or numbers within each show, class groups or ensembles within each act, and costume groups where a class wears multiple looks. The photographer uploads captures tagged to that structure, and the platform maps them to cast records. A family navigating their gallery sees the acts and classes their child participated in, organised the way the show ran — not a flat album of every photo from the event day. A studio can publish one show’s gallery while the next show is still in proofing, without exposing unreviewed images.

The split engine applies three rules in order: fee off gross proceeds first (not hidden inside the split), splits calculated on the net remainder, and a largest-remainder reconciliation pass that assigns any residual penny to the party with the largest remainder. The studio’s share is the studio’s share — nothing is silently coerced into a platform margin between what a family pays and what the studio receives. A studio treasurer sees the projected payout per event before the charge rail runs, not after. The split engine is built and production-ready; the charge rail that moves money is honest-off.

Rush-turnaround delivery is a configurable window — 24-hour, 48-hour, or 72-hour — in which the studio commits to delivering an edited gallery after the recital closes. Families see the expected turnaround window at gallery access before the event. Video-clip bundles let a studio attach a short edited clip of a performer’s number to the photo gallery for that act, purchasable by the family as an add-on and subject to the same Consent Graph rules as photos. Both are early-access — in active development and not yet live in the platform. They are named here because they are real planned features, not because they are available today.

The product catalog a studio configures can include: digital download sets (by act, by show, or by season), print packages (single prints, multi-print sets, enlargements), album products (single-show album, full-season album, class album), and senior-dancer tribute products for graduating students. Each product is consent-gated at the performer level: a product that would include an image of an unconsented performer is not built for that performer’s classmates. Post-season products like the “recital year” album and senior tribute are configured separately and are also subject to Consent Graph rules. Live checkout for all products is honest-off.

A private grandparent link is generated by a parent within the platform, not by the studio. The parent shares a link to a subset of their child’s gallery — the images the parent selects from the images already permitted by the performer’s consent record. The grandparent sees only what the parent shared; there is no path from that link to other performers’ images. The link carries an expiration date the guardian sets. It is not a public URL: it does not browse the full studio gallery and it does not reveal images of other children. This is structurally different from a studio sharing one public album link with the whole class.

A public album link or a social media post gives anyone who receives or finds it visibility into every performer in the gallery — including children whose guardians did not consent to that exposure. The studio has no way to enforce an opt-out after the link has been shared. This platform enforces opt-outs before delivery: unconsented images are never placed in a deliverable gallery, never included in a product, and never covered by a share-link. A studio running its recital photos through this platform can credibly tell families it has consent controls in place — because it is the platform enforcing them, not a manual process that depends on the photographer’s memory.

When a guardian submits a deletion request for their child’s images, the request is logged in the consent record with a timestamp. Images associated with that performer are removed from all active galleries and share-links. Downstream products — album orders in progress, product carts, pending share-links — are invalidated. The studio administrator is notified. The deletion log is retained as an auditable record of the request and the action taken, even after the images are removed. The platform does not guarantee destruction of every infrastructure backup copy in all circumstances, but it does guarantee that the performer’s images are no longer served from any active delivery surface within the stated window.

Book Recital Coverage is the path for a studio or school that wants professional photography coverage at their recital. The studio books a session for their event, the photographer captures against the consent-gated workflow, and the resulting gallery is delivered through the platform with the Consent Graph in place from the first upload. A studio that uses its own photographers can use the platform for gallery delivery, storefront, and payout management without the coverage service. Coverage and delivery are separate offerings; a studio chooses one or both. Coverage booking is in active development; delivery and gallery management are production-ready for studios bringing their own content.