The household
How people join, what every account requires, what everyone can see, and the one thing that stays private until it is filed.
Joining#
Everyone joins by invitation from Settings. Invitations are single use and expire after 48 hours. There are no default credentials anywhere.
Every account#
A password of at least twelve characters and an authenticator app. There is no password reset by email; the ten printed recovery codes are the way back if a phone is lost. Sessions are visible in Settings and can be revoked. Sensitive actions—such as inviting someone, resetting access, changing an email address, or downloading everything—require your password again.
What everyone sees#
Everyone you invite can see every filed document. There are no per-document household access roles. Invite only people who should have that access; use a shared link when someone needs selected documents only.
What stays private#
Mail that has not been filed. Candidates from a connected inbox and held mail are visible only to the person who connected that mailbox, because until it is filed it is their correspondence, not the household's paperwork. Filing is the deliberate act of sharing.
The record#
Every sign-in, invitation, and change to a document is logged, and each document's page shows who changed what.