The household
How people join, what every account requires, what everyone can see, and the one thing that stays private until it is filed.
Joining#
Everyone joins by invitation from Settings. Invitations are single use and expire after 48 hours. There are no default credentials anywhere.
Every account#
A password of at least twelve characters and an authenticator app. There is no password reset by email, on purpose; the ten printed recovery codes are the way back if a phone is lost. Sessions are visible in Settings and can be revoked. Sensitive actions, inviting someone, resetting access, changing an email, downloading everything, ask for the password again.
What everyone sees#
There are no roles. A filed document belongs to the household, and everyone you invite sees every filed document.
What stays private#
Mail that has not been filed. Candidates from a connected inbox and held mail are visible only to the person who connected that mailbox, because until it is filed it is their correspondence, not the household's paperwork. Filing is the deliberate act of sharing.
The record#
Every sign-in, invitation, and change to a document is logged, and each document's page shows who changed what.