How it works

The whole thing turns on one idea: everything you write is sealed, and there are exactly three ways for it to open. You choose which of them are in play.

The three ways it opens

You open it. At any time, for one person or for everyone. If you get a diagnosis, or simply decide the time has come, you sign in and release it. This is the ordinary case and the one most people end up using.

A keeper opens it. You ask somebody you trust — a sibling, a friend, the executor — and they get an account of their own. They can see whether it is sealed or open, and they can open it. They cannot read a word of what is in it, before or after. They are trusted with the door, not with what is behind it.

The timer opens it. Optional, and off unless you turn it on. If you set it to sixty days, then every sixty days you have to sign in and press a button that says I’m still here. Miss it and everything opens on its own. You are warned by email ten days before and again at five days, and your keeper is warned at five days too, so there are three separate chances for somebody to notice you are simply on holiday.

You can use one of these, or all three. With all three off but yourself, this is a private notebook that nobody will ever read — which is a legitimate way to use it, and is what most people do for the first year.

What people see before it opens

This is the part that took the most care to get right.

When you invite somebody, they set up an account straight away — possibly years early, while you are healthy and standing in front of them. They sign in and see a page telling them that there is nothing to read yet and that this is exactly as it should be. Not an error. Not an empty screen that makes them wonder whether they have broken something or you have changed your mind.

That matters because it means the thing can be tested. You can hand somebody their invitation over a kitchen table, watch them set it up, and both of you can stop wondering whether it will work.

Invitation codes

Each person gets a code that looks like this:

FARE-9K2P-7XMT-BQ3D

We email it, but you can also write it down, put it in a card, seal it in an envelope with your will, or read it down the phone. The alphabet has no I, O, 0 or 1 in it, for exactly that reason.

Codes do not expire. One may have to sit in a drawer for twenty years and still work. It can be used once, to set up an account; after that they sign in with their email address like anybody else.

Signing in, years later

The people you write to will use this once, at the worst moment of their life, possibly eight years after they set it up. They will not remember a password.

So a password is optional for them. There is always a button that emails a link which signs them in, and the link lasts two hours rather than the usual fifteen minutes, because “your link has expired” is a cruel thing to show somebody at a funeral.

Letters, and practical notes

Letters are addressed either to one person or to everyone. A letter to one person is visible to that person alone.

Practical notes are the unromantic half: where the will is, who to ring, what to cancel, where the photographs are. Each one is scoped separately — keepers only, everyone, or a named few — because “the bins go out on Tuesday” and “the funeral I actually want” are not the same audience.

Anything you have not finished stays a draft, and a draft is never delivered, even after everything opens. An unfinished sentence should not be able to become somebody’s last word from you by accident.

The emails, when it opens

When everything opens, the people you wrote to are emailed — but not straight away. There is a delay, fourteen days by default, which you can set to anything from zero to ninety.

The gap is the whole point of the feature. Nobody’s first news of a death should be an automated message. The delay leaves time for the people who ought to be told in person to be told in person, by somebody who loves them.

The email itself says nothing. There is something here for you; sign in when you are ready. No title, no excerpt, nothing that could appear on a lock screen and tell somebody how they were loved before they were ready to read it. And if it is sealed again inside the delay, nothing is ever sent.

What we will not do

We will not open somebody’s notes because we were asked to. If a stranger emails us to say that you have died, we will not act on it. We have no way to verify it, and the consequences of getting it wrong are not recoverable.

That is precisely why keepers exist. If you want a human being to be able to make that decision, name one — and choose them as carefully as you would choose an executor.

Languages

You can write a letter in English and hand-write a Spanish or Chinese version yourself, and the person set to that language gets your words. Where you have not, a machine translator is available for any language at all.

Your version always wins. A machine can carry the meaning of a farewell letter; it cannot be trusted with the tone, and in a letter like that the tone is most of what you were sending.

Machine translation is off by default while somebody is reading a letter, because using it sends the text of that page to Google. It is offered with that said plainly, and only turned on if the reader asks.

The honest limitations

This is not a will. It carries no legal weight and cannot direct your estate. Use a lawyer for that and this for the words.

It is not encrypted against us. Somebody with our hosting credentials could read what you write. That is a deliberate trade: encrypting it properly would mean a key that has to survive you and be usable by a grieving non-technical relative, which reintroduces the exact failure this exists to prevent. Write down where things are and who to ask — never the passwords themselves.

Delivery is not guaranteed. Email is spam-foldered, addresses go stale, and services close. We have written down what we will do if this one closes — see the terms — and the short version is that you get everything back, and everybody gets told, before anything is switched off.

If you want to know why this exists at all, and who built it — that is written down too.