Hand over to your family

Settings → Hand-over. One card writes a letter to your family: where your accounts are, who to call and where the papers are, on pages they can read without Badlen, without your password and without this server still running.

The letter passes on information to someone you chose, and nothing more. It opens no account, gives nobody a right over anything, and makes no one an heir.

The four boxes

Four free boxes, each printed under its own heading, and left out of the letter while empty:

A word for your family: where to start, what is not urgent.
Who to call: the notary, your bank, and the person who knows how to keep this server running, if that is not you.
Where the papers are: statements, contracts, title deeds, the will if there is one.
What Badlen does not track: a joint account, a car, an account abroad.

Two rules are written above the boxes, because the letter will be read by someone else:

No secret. Write where a password, a code or a recovery phrase is kept, never the thing itself. The letter is a sheet of paper or a file; anyone holding it reads all of it.
No wishes about who receives what. That is what a will is for, and a letter would not stand in for one.

Your accounts in the letter

Badlen adds the list itself from what you track. Every open account is ticked; untick the ones that have no business in the letter. Closed accounts are left out.

The letter groups them by institution, or by type when no institution is set, and gives for each one its type in words, the IBAN masked down to its last characters, the month it was opened and, for a loan, the property it finances. Two remarks are added on their own where a relative would otherwise go wrong:

a life insurance contract goes to the beneficiaries it names, outside the letter;
a crypto wallet is lost without its recovery phrase, and the letter points to Where the papers are.

Show the amounts prints the last value of each account and a total of assets and debts, with a sentence saying these are your figures, as of the day of printing, and that the institutions’ own statements are what count. Switch it off and the letter carries no figure at all.

Printing it

Open the letter saves what you typed and opens the letter as a PDF in a new tab, where the browser prints it or saves it. It is written in the language the app is set to.

Print it and keep it with your papers, or leave a copy with your notary. A printed letter is the one copy that does not depend on this server: a self-hosted instance stops when nobody pays for it or keeps it switched on, which is precisely the situation the letter is for. The date at the top says when it was printed; the card says when you last saved it, so you can tell when it is due for another read.

The letter is part of your export, and so is which accounts it leaves out: a restore puts both back.

The relay

A second card, Relay to a relative, sends that same letter by email to someone you name, if Badlen hears nothing from you for a long time. It needs two things from the instance, and says so when one is missing: a mail server (The mail server) and a PUBLIC_URL your relative can open from their own home.

Setting it up asks for your relative’s name and email address, then your password and, when two factor authentication is on, a code: the same proof a change of email address asks for. Changing the relative, the code or the silence later asks for it again, and so does stopping the relay. Each change is confirmed by email at your own address and written to the card’s journal. A relative you replace is not told.

Badlen then writes to your relative once, to confirm the address: a typing error must never send your letter to a stranger one day. The relay waits until the address is confirmed. The same page lets your relative decline the role, which stops the relay and tells you.

The opening code is optional. Tick it and Badlen draws twenty characters, in five groups of four, with no letter or digit that reads as another (no I, L, O, 0 or 1). The PDF your relative receives and their online copy then open with that code alone, so someone reading their mailbox cannot read the letter. Without a code, the link in the email is enough. The same relative keeps the same code when you change something else; a new relative gets a new code.

Attach the full export too is only possible with a code, and the box says so while the code is not ticked. Off by default, it is for a relative who would take Badlen over: the message then carries, beside the letter, the same file as the encrypted export, all your data included, sealed under the opening code by the same argon2id envelope. It cannot be read as it is: your relative opens it in a Badlen, their own or one installed for the occasion, under Settings → Data → Import a file, with the code as the passphrase, dashes included. The file carries neither the code, nor your relay, nor your password. Above 10 MB it would be too heavy for most mailboxes: the message then leaves with the letter alone and says so.

The code on paper

Code on paper shows the code again, after your password and your two-factor code, with a button that prints it on an A4 page: a slip to cut along the dashed line and fold with the code inwards. It says who it is for, that it comes from you, what the code is for and how to use it (the PDF, the online page, the export if attached), and nothing else: no amount, no list of accounts.

The code is never in an address, the answer carrying it forbids any caching, it is written to no log and never leaves by email. The card’s journal only notes that it was shown. It leaves the screen as soon as you close the panel.

The same step can draw a new code: the old one opens nothing any more, and the paper already handed over is void, which the box says before you tick it. An email confirms it, without the code. This is no longer possible once the letter has left, since it is sealed under the code your relative already holds.

The trial

Send a trial sends to your own address, never to your relative, the exact message they would receive if the letter left today: the same letter, under the same code, the export if attached, with Trial in the subject and a sentence at the top that says so. The button in the message leads to your relative’s page, which refuses this trial link: a way to check that your instance opens from outside. The trial asks for your password, like the relay’s other settings, is written to the journal, and changes neither the relay’s step nor its dates. Three trials a day. Without a mail server, the card says so and the trial is not offered.

The calendar

Every step waits a set number of days after the one before it actually happened. The table follows the default silence of 90 days:

Day	What happens
0	your last sign of life
83	a banner on every page of the app: A sign of life, please
90	first email to you
93	second email
97	third email
104	last notice: In 7 days, your relative will receive your file
111	the letter goes to your relative, attached as a PDF, and an email tells you
201	the online copy closes; the PDF already received stays readable

The silence before the first reminder is 60, 90 or 180 days, chosen in the same Change form as the rest of the relay and under the same proof. The reminders and the last notice keep their pace after it, so the letter leaves 81, 111 or 201 days after your last sign of life, and the form gives that date before you save. Saving counts from that day: a silence shortened between two reminders never sends the letter sooner than the last reminder said, and the opening code stays the same. The change is written to the journal. Under 180 days the form warns that an instance nobody pays for any more often stops before then, the relay with it, which is what the printed letter is for.

A sign of life is signing in with your password, and your code when you have one, or pressing I am here, in the banner or on the page a reminder links to. Any of them puts the relay back at day 0. An API key, the MCP server or a script does not count, since they run without you, and neither does a session that renews itself in an open tab. Opening a reminder’s link does nothing until the button on its page is pressed, because some mail filters open links on their own.

Nothing your relative does can bring the letter forward: their two pages confirm an address or open a letter already sent, and nothing else.

After a long stop, the relay takes only the next step and gives it its full delay: an instance switched off for three weeks sends one reminder when it comes back, not the letter.

The letter, the email and the online copy

On day 111, or 81 or 201, one email with the letter attached as a PDF, the same one you print, the full export if you asked for it, and a link to an online copy that stays open for 90 days. The message never says death: Badlen only knows that nobody answers, and a stay in hospital looks the same. Each opening of the online copy is written to your journal and reported to you by email, and five wrong codes in a day close the page for twenty-four hours, which you are told about too.

If the letter left by mistake, sign in and stop the relay: the online copy closes at once. The PDF already sent cannot be taken back, which is what the code is for.

If the instance stops

The relay runs on this instance. When it stops, server switched off or subscription unpaid, the relay is silent and nobody is told. Nothing outside your instance can stand in for it: Badlen contacts no server of this project. The card shows the date of the relay’s last run so a stopped instance shows, and the printed letter is the one copy that survives the machine. If you are the only one who runs the server, name in Who to call someone who could.

A relay does not travel in an export: after a restore it has to be set up again, with your password and a fresh confirmation. After a restore under another SECRET_ENCRYPTION_KEY, an opening code can no longer be read; the card says so, and Code on paper draws a new one.