Design a Kitchen Together, Live

What the share link opens — and what it does not

Every saved design has a share link: the 🔗 on its card in 📂 Load copies it, and the first save copies it for you. The link ends in a random share code, not in the design’s ID, and whoever you send it to can open the design straight away, without an account — to look at it, not to change it:

• They can look around the plan, the elevations, the countertop dimensions page and 3D, and measure with 📏.
• Signed in, they can comment with 📍 — you get a notification — and, while you have the design open too, ask to point at things on your screen.
• They cannot change it, save it, see its price or your customer notes, or find out its ID. Taking the controls, the design’s chat and its calls are for people you invite — the rest of this page.
• To stop a link working, press Make a new link on the card that appears when you copy it: the old link stops at once. Only the design’s owner can do that.

The design itself stays private. Opened by its ID — which includes an older link that ends in ?project= and the ID — it opens only for people who are allowed in:

• You, on any computer you sign in from.
• A designer or installer you hired through Community, on the project they were hired for.
• A contact you invited into this design — the rest of this page.
• Our sales team, once you give them the design’s ID — IDs are random, so nobody can guess yours.
• Anyone at all, once you publish the design to the Community gallery.

Everyone else is stopped at that door: someone who is not signed in is asked to sign in, and a signed-in stranger sees Not authorized to view this project. That is deliberate — a kitchen plan is the layout of your home. So if an older link fails for your contractor, nothing is broken: copy a fresh share link from Load, invite them, or send a PDF. You, a pro you hired and a contact you invited get your usual access from a share link too; anyone else, our sales team included, gets a look.

Three things that have to be true first

1. You both have a real account.Google, Apple or a six-digit code sent to your email — all free. A guest session is fine for trying the planner, but a guest has no contacts book, so it can neither invite nor be invited.
2. The design is saved to your account.An unsaved draft has nothing for anyone to open. Until you save, the Contacts tab says so and offers nobody to invite.
3. They are in your contacts.In the designer, open Chats & contacts → Contacts, press Add a contact (the person with a plus, at the top), type their sign-in email and press Send request — or do it in Community → 📇 Contacts, where the button says Send invitation. Contacts work both ways: they accept the request in their own Contacts before either of you appears in the other’s book, and they must have signed in to Flip Kitchen once so the address belongs to someone.Why the extra stepIt is the same line that keeps strangers out of your messages. You add a contractor once and then invite them into any design you like.

Only the owner of a design can invite people into it. If you opened a design someone else owns, the Contacts tab says so above your contacts and shows no Invite buttons — you can still message them.

Invite, and what the other person sees

With the design open in 2D, click the round speech-bubble button on the tool strip, right after the 📍 comment button — its tooltip reads Chats & contacts. The left panel opens with two tabs, Chats and Contacts; switch to Contacts to see your book and press Invite beside a name.

• They get a message. A line lands in your chat with them, the same conversation they see under Chats in the designer and in Community Messages: I’d like you to look at my kitchen design “…” with me, with an Open the design button, plus a notification on their devices. That line is written by our server, so it is not end-to-end encrypted.
• Chats need Chrome. Chats are end-to-end encrypted, and on the website that works in Google Chrome on a computer; on an iPhone or iPad, the FlipKitchen app gets the same encryption in an app update that is still to come — until then, what is sent from the app is not encrypted. Until everyone in a chat has opened chat in Chrome or the updated app, the top of the chat says Not encrypted yet: text and voice messages still go, unencrypted, but photos and files cannot be sent until then. The design’s own chat is the exception: it is always encrypted, and anything sent there before someone has opened chat in Chrome or the updated app stays unreadable to them. In another browser the Chats tab says Chats need Chrome, though inviting from Contacts still works. If the person you invite uses another browser, copy the share link from the design’s card in 📂 Load and send it to them yourself — signed in to the account you invited, they can open it while the invite is good, but they can join the design’s chat only from the design in Chrome.
• The link works for thirty minutes. Once they are in, it stays good for as long as they are in the design, and for thirty minutes after they leave so they can come back. Beside their name you see how many minutes are left, then In this design while they are there; an expired invite offers Invite again.
• They come in as a watcher. An invited person never takes control on their own. You decide whether they operate.
• Removing someone from your contacts ends it at once. The pass is checked every time the design is opened, not only when the invitation is sent, and they leave the design’s chat as well — the same happens if they take you out of their contacts. An invitation that simply runs out does not take them out of the chat: they keep getting its new messages until you remove them there with ⋮ → Members → Remove.

The same live session switches on by itself whenever two people who already have access open the same saved design — you and a designer you hired, say. No invitation is needed for that. Your own devices count too, but only one of them edits at a time: open the design on a second computer, or in a second tab, and that one shows You’re editing this on … with an Edit on this device button. Press it and the first one saves before it hands over — nobody has to approve.

One person operates, everyone else watches

Two people dragging the same cabinet in different directions is how designs get wrecked, so there is always exactly one operator. Whoever opened the design first operates; everyone who arrives later watches. A bar across the top says who is doing what: You’re operating with the names of the people watching on the operator’s screen, and the operator’s name on everyone else’s.

• Watchers look, they do not change. They can orbit the 3D view, switch to the plan or the elevations, select things to read their sizes and open the quote. If they move something anyway, it slides back with a note that someone else is operating.
• Follow is on by default. A watcher’s view follows the operator’s, so you are both looking at the same wall. Turn Follow off to wander and on again to catch up.
• Asking for the wheel. A watcher presses Request control, and the operator — or the owner — gets a card with Allow and Decline.
• Handing it over. The operator passes control to anyone in the design from Hand over ▾; their last change is saved first.
• The owner can always take it back. Take back needs nobody’s permission — it is your design.
• Walking away hands it home. If the operator’s tab sits in the background for two minutes, control goes back to the owner.

While other people are in the design, a few things belong to the operator alone: saving, rendering photos, and running AI Design or AI Suggestion. Anything that rewrites the whole design or spends coins has one person’s name on it.

Say “this one” and mean it

Half of every design conversation is pointing. The operator’s mouse appears on everyone’s screen as an open hand that closes into a fist while it drags. It is placed in the design’s own coordinates rather than the screen’s, so it sits on the same cabinet whatever each person’s zoom — in the plan, in 3D and in the elevations.

Watchers get a pointer of their own. Press 🔦 Point and the operator is asked to allow it; the owner does not have to ask. Then click to drop a “look here” ripple, or drag to circle something — the mark fades after a few seconds. A pointer only points. It cannot move or change anything.

Chat, voice notes and calls, beside the design

• Chat. Every saved design can have its own chat, at the top of the Chats tab under This design. Nobody is put in it just by opening the design: if the design has none yet, Start there begins one; once it exists, everyone who can work on the design — you, a designer you hired, our sales team and any contact you invited — sees Join there and joins only if they choose to, in Chrome; they need not be each other’s contacts. Only you, the design’s owner, can add people to it. Someone in it who is not in your contacts shows by their Community name and their part in the design — owner, FlipKitchen sales, designer or invited — never by their email; ⋮ → Members → Add contact sends them a contact request. It is always end-to-end encrypted, and the top of the chat names anyone who cannot read it yet. Emma, our AI assistant, is in it too: type @Emma and she answers, reading the design as it was last saved. Any chat the design had before 16 October 2026 sits folded at the top as Earlier messages in this design (not encrypted), read-only. During a live session, 🏠 Design chat at the top of the panel opens it, and, once you are in it, it opens by itself the first time someone joins you. Your own chats with each person are listed below it, as in Community Messages. A message can run to 2,000 characters. In an encrypted chat, 📎 also sends a Photo, a File of up to 25 MB or This design as a card, and you can reply, react, and edit a message within 15 minutes of sending it; anything you sent can be deleted for everyone within an hour.
• Voice messages. With the message box empty, press 🎤, talk, then press Send, or the bin to throw the clip away; at two minutes it sends itself. In Chrome a transcript is written as you speak and shown under the clip. Our server keeps the recording for 30 days; the transcript stays.
• A voice call. During a live session, 📞 Voice call at the top of the panel starts a call that anyone in the design can Join — up to six people — with Mute and Leave. The browser asks for the microphone only when you start or join a call. The audio goes browser to browser, encrypted — through a relay when a firewall blocks a direct line — and is never recorded. A call is not end-to-end encrypted the way the chat is: the browsers do not yet check the set-up details our server passes between them.
• A call to one person. In a one-to-one chat in Chrome, 📞 calls that person. The call shows in a card at the bottom right of the designer — it rings even with the panel closed — with Answer and Decline, then Mute and Hang up while you keep designing; its audio is encrypted and never recorded, and when you both call from Chrome with chat set up it is end-to-end encrypted too: each side checks the other’s signed connection keys, and the card’s 🔒 says End-to-end encrypted once that check passes (our app checks its calls the same way from an update that is still to come). It is one call at a time: while you are on the design’s call, a one-to-one call to you gets Busy.
• Translation. Each person reads other people’s messages in the language their planner is set to — English, Chinese or French — with Original and Translation to flip between them. It helps when the homeowner, the designer and the installer do not share a first language. Encrypted messages are translated on your own computer by Chrome’s built-in translator (where it has none for that pair of languages, you see the original); messages that are not encrypted are translated by our AI translation service.

Pins and a to-do list for after the call

A call ends; the list of things to change should not. The 📍 button in 2D, 3D and the elevations pins a comment — typed, or a voice note with Hold to talk — to the exact spot it is about, and every pin goes on the design’s shared Comments & to-do list. A pin’s text stays for as long as the design does; a voice note or screenshot on it is kept for 14 days, so type whatever has to last.

• Four states. A pin moves through To do, In progress, Check it and Done. Whoever picks it up presses I’m on it, then Done — please check, and only the person who raised it can Confirm done or Reopen it.
• What changed for it. Once a pin is marked Done — please check, See changes (N) outlines in 3D the cabinets that were changed for it, so the person who raised it can look before pressing Confirm done.
• Who can write them. Pins need edit access: you, a designer you hired through Community, and our sales team. An installer you hired and a contact you invited can read every pin; a contact answers in the design’s chat.

Every render of a saved design also goes into the design’s album; you find yours under 📂 Load → Album. If an encrypted chat is open when a render finishes, the chat offers it with New render · Send it to this chat? Nothing is sent until you press Send. Whoever renders uses their own coins, and each picture counts against the storage space of the person who made it. On a free account the album takes five pictures per design and then stops taking more; with a membership, or a Designer or Studio account, it keeps the latest 300. With a membership, or a Studio account, the pictures are kept while that account is active; on a Designer or free account each one made from 19 October 2026 is kept for 180 days from when it was made and shows the date it will be deleted in its last 60 days, so download the ones you want to keep longer.

When two people changed it at once

A live session saves the operator’s work for you — whenever control changes hands, and thirty seconds after the last change. While two or more people are in a design, nobody can overwrite it from a separate copy; that save is refused with a note to ask for control in the bar at the top. Two moments still need a decision from you:

• You changed it on your own first. If you had unsaved changes when someone else turned out to be working on the same design, you see Someone else is editing this design right now. Save mine as a copy keeps your changes as a new design; Drop mine & join lets them go and joins the session.
• A session ended before it saved. The next time you open the design: Changes from the last time you edited together were never saved, with Discard or Load and save them.

When the last other person leaves, the bar says Everyone else left — back to editing on your own, and the planner behaves exactly as it did before.

For the person who will never sign in

Not everyone wants an account to look at a kitchen — a parent, a countertop shop, a condo board. Two things work for them:

• A PDF. ⬇ Export builds a drawing set — the elevations, the top view, the countertop drawing, 3D photos — that opens on anything. It is a snapshot, so send a fresh one after big changes. How to read the drawings.
• The gallery. 🌐 Publish to Community — the globe on the design’s card in Load — makes the design public: anyone can open it and look round, with no account, and it appears under a nickname rather than your email. Keep it for designs you are happy to have public.

What is kept, and for how long

Deleting a design deletes the design’s own chat too, for everyone in it; your other chats stay. In an end-to-end encrypted chat, which the design’s chat always is, our server holds only the encrypted messages, photos, files and voice clips — which it cannot read, except anything sent to Emma, our AI assistant — for 30 days, then deletes them; the readable copies are on the devices in the chat, and that is where they are translated. Messages that are not encrypted — the invitation line, and those in a chat where someone has not yet opened chat in Chrome or the app — are kept for up to a year after the chat’s last message, their voice recordings for 30 days (the transcript stays), and they are translated by an AI translation service whose result is cached, so the same line is not sent twice. The chat each design had before 16 October 2026, now folded read-only at the top of the design’s chat, is deleted with the design, or a year after its last line if that comes first. A pin’s voice note and screenshot are kept for 14 days and its text stays. Voice calls are not recorded; a one-to-one call leaves only a line in the chat with its length, or that it was missed. The privacy policy lists the services involved. Your mouse and pointer are shown only to the people in the design while you are in it.