Write now. Delivered if the rapture comes.

Step 1

You write, we seal

You write your letter and name the person it should reach — by email address, by postal address, or both. The letter is encrypted with a key unique to it before it is stored.

That encryption protects your letter from anyone who steals our database. It does not protect it from us: to deliver your letter at a moment when you are not there to unlock it, we hold a key that works without you. Access is restricted and audited, and the privacy page explains what that means.

In practice that means envelope encryption: a fresh key generated for your letter alone, then that key wrapped under a separate master key we hold apart from it. Rotating the master key means re-wrapping those per-letter keys, not re-encrypting every letter already stored.

Step 2

What triggers delivery

Nothing in the world announces the rapture in a way software can read. There is no feed to subscribe to, no signal, no test. Anyone who tells you their system detects it is describing something that does not exist.

So we do the only honest thing available: a person decides. Delivery is started by hand, by one of a named group of administrators, and by nothing else. There is no timer, no heartbeat, no automatic condition anywhere in the system that can start it on its own.

Starting it takes two separate actions a day apart. The first records who is declaring and why, and sends nothing. A full day has to pass before the second is even possible, and during that day any administrator can call it off. Only the second action delivers, and it delivers everything at once and cannot be undone. The delay exists so that a mistaken click, or one stolen login in a single sitting, is not enough to empty the system.

Step 3

Who can act, and what's on the record

Only a named group of administrators can arm the system or cancel an arming already in progress. No one else can, and nothing automated can either — there is no service account, no scheduled job, and no code path anywhere that starts delivery on its own.

Every arm, cancellation, and delivery is written to an audit log naming who did it and when, the same log described on our privacy page. That record exists because a decision this large should never rest on trust alone.

Step 4

If the administrator is wrong

The delay is the only real safeguard, and it is a human one, not a technical one. If an administrator arms the system by mistake — or is themselves mistaken about what has happened — the letters still go out to living people, including that administrator, once the second action is taken, and that second action cannot be undone. We say so because pretending otherwise would not be honest. Two actions a day apart, cancellable by any administrator in the group, are built to make a rash decision hard. They cannot make it impossible.

Step 5

What your recipient receives

Your letter, unedited, with a short note at the top explaining who it is from and why it has arrived. The person you name never asked to hear from us, and a message from someone who has vanished would be frightening without context. We send once. We do not add them to anything.

Step 6

The labor after the decision

Once the second action fires, sending is not done one click at a time. A queue drains itself automatically, in batches of 50, every five minutes, until every letter has gone out. What stays manual is the decision to start, not the work of carrying it out — automating the sending removed a real bottleneck without touching the safeguard, which is still the two actions a day apart that get the system to that point in the first place. A send that fails partway through is marked for a person to review rather than retried automatically: we cannot always be certain whether a letter reached anyone, and sending a second copy to someone recently bereaved is not a risk we are willing to take by machine.

Step 7

You can change your mind

Until you seal it, you can change who receives your letter, rewrite it, or delete it outright. Sealing fixes both the words and the person — but not where they are: for as long as we hold the letter you can keep their email or postal address current, and once a year we will ask you to check a postal one is still right. Deleting stays open to you at any time; it removes the letter from our store, and we cannot recover it afterwards, and neither can anyone else.