diff --git a/cmd/appendkeyfile/main.go b/cmd/appendkeyfile/main.go
index 85bddd5..84c7db3 100644
--- a/cmd/appendkeyfile/main.go
+++ b/cmd/appendkeyfile/main.go
@@ -18,6 +18,7 @@ import (
 const keyfileName = "authorized_keys2"
 
 func quit(msg string, code int) {
+	// TODO print to stderr
 	fmt.Println(msg)
 	os.Exit(code)
 }
diff --git a/cmd/help/main.go b/cmd/help/main.go
index b14eb46..14f494e 100644
--- a/cmd/help/main.go
+++ b/cmd/help/main.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"log"
 	"os"
 	"os/exec"
 	"strconv"
@@ -117,6 +118,10 @@ func (p *Prompter) Select(prompt string, opts []string) (int, error) {
 }
 
 func _main(cs colorScheme) error {
+	logFilename := fmt.Sprintf("/town/var/log/help/%d", time.Now().Unix)
+	logFile, err := os.OpenFile(logFilename, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	l := log.New(logFile, "", log.Ldate|log.Ltime|log.LUTC|log.Lshortfile)
+
 	db, err := connectDB()
 	if err != nil {
 		return fmt.Errorf("could not connect to database. please let root@tilde.town know about this.")
@@ -148,9 +153,9 @@ func _main(cs colorScheme) error {
 
 	switch c {
 	case 0:
-		return collectEmail(db, cs, p)
+		return collectEmail(l, db, cs, p)
 	case 1:
-		return redeemCode(db, cs, p)
+		return redeemCode(l, db, cs, p)
 	case 2:
 		return nil
 	}
@@ -171,7 +176,7 @@ func emailToUsername(email string) (string, error) {
 	return stdoutBuff.String(), nil
 }
 
-func collectEmail(db *sql.DB, cs colorScheme, p *Prompter) error {
+func collectEmail(l *log.Logger, db *sql.DB, cs colorScheme, p *Prompter) error {
 	fmt.Println(cs.Header("We can send a authorization code to an email associated with your town account."))
 	email, err := p.String("email to send reset code to?")
 	if err != nil {
@@ -191,12 +196,12 @@ func collectEmail(db *sql.DB, cs colorScheme, p *Prompter) error {
 		}
 	}
 	if found != len(mustHave) {
-		// TODO log
+		l.Printf("corrupt email '%s'", email)
 		return nil
 	}
 
 	if _, err = emailToUsername(email); err != nil {
-		// TODO log
+		l.Printf("no user for '%s'", email)
 		return nil
 	}
 
@@ -208,30 +213,30 @@ func collectEmail(db *sql.DB, cs colorScheme, p *Prompter) error {
 	}
 
 	if err = ac.Insert(db); err != nil {
-		// TODO log
-		return err
+		l.Printf("database error: %s", err.Error())
+		return errors.New("the database was sad")
 	}
 
 	if err = sendAuthCodeEmail(*ac); err != nil {
-		// TODO log
-		return err
+		l.Printf("mail send error: %s", err.Error())
+		return errors.New("email sending failed")
 	}
 
 	return nil
 }
 
-func redeemCode(db *sql.DB, cs colorScheme, p *Prompter) error {
+func redeemCode(l *log.Logger, db *sql.DB, cs colorScheme, p *Prompter) error {
 	fmt.Println(cs.Header("redeem an auth code and add a new public key"))
 	c, err := p.String("paste your auth code and hit enter to submit:")
 	if err != nil {
-		// TODO log
+		l.Printf("failed to prompt: %s", err.Error())
 		fmt.Println(cs.Error("sorry, I couldn't read that."))
 		return nil
 	}
 
 	parts, err := codes.Decode(c)
 	if err != nil {
-		// TODO log
+		l.Printf("failed to decode auth code: %s", err.Error())
 		fmt.Println(cs.Error("sorry, that doesn't look like an auth code..."))
 		return nil
 	}
@@ -243,7 +248,7 @@ func redeemCode(db *sql.DB, cs colorScheme, p *Prompter) error {
 
 	err = code.Hydrate(db)
 	if err != nil {
-		// TODO log
+		l.Printf("hydrate failed: %s", err.Error())
 		return errors.New("the database is sad")
 	}
 
@@ -254,14 +259,14 @@ func redeemCode(db *sql.DB, cs colorScheme, p *Prompter) error {
 
 	username, err := emailToUsername(code.Email)
 	if err != nil {
+		l.Printf("could not find user: %s", err.Error())
 		fmt.Println(cs.Error("That code doesn't seem to match an account."))
-		// TODO log
 		return nil
 	}
 
 	key, err := p.String("paste your new public key and hit enter to submit:")
 	if err != nil {
-		// TODO log
+		l.Printf("failed to prompt: %s", err.Error())
 		fmt.Println(cs.Error("sorry, I couldn't read that."))
 		return nil
 	}
@@ -282,27 +287,19 @@ func redeemCode(db *sql.DB, cs colorScheme, p *Prompter) error {
 	stdoutBuff := bytes.NewBuffer([]byte{})
 	cmd.Stdout = stdoutBuff
 	if err = cmd.Run(); err != nil {
-		// TODO log error
-		//return fmt.Errorf("appendkeyfile failed with '%s': %w", string(stdoutBuff.Bytes()), err)
+		l.Printf("appendkeyfile failed with '%s': %s", stdoutBuff.String(), err.Error())
 		return errors.New("adding to keys file failed")
 	}
 
 	err = code.MarkUsed(db)
 	if err != nil {
-		// TODO log err
+		l.Printf("failed to mark used: %s", err.Error())
 		return errors.New("database was sad")
 	}
 
 	return nil
 }
 
-// TODO db plan:
-
-// add new db, codes (modeled after invites)
-// add new helper, emailtouser, that can access town.db and report on what user matches a given email
-// drop table from town.db
-// update sshapps.md
-
 func main() {
 	cs := newColorScheme()
 	err := _main(cs)