On your machine, by default
Mail, conversations, memory, documents and the search index are stored locally. Once you have signed up, everything already on your machine stays readable and usable with no connection at all.
Trust
Built to be handed real correspondence
Email is not a low-stakes surface. These are the specific commitments the product makes about where your data lives, what it is allowed to do, and how you stop it.
Where your data lives
The search index never leaves
Semantic retrieval runs on your device. Nothing is uploaded to make search work, because search does not need a server to work.
Bring your own AI provider
Use your own API key with the AI provider you choose. Model calls go straight from your machine to that provider — never through us — and an on-device model is planned for those who want nothing to leave at all.
No telemetry, and no mail on our servers
The application sends us no usage statistics and no crash reports. Your mail, drafts and memory never pass through a server of ours. Credentials live in your operating system's keychain — never in plaintext on disk, never in logs. If usage statistics are ever added, they will stay off until you turn them on.
Portable, not captive
Signing out only locks the workspace; your local data stays on your machine. Your mail stays in your own mailbox with your own provider, so any other mail client can still read it, whether or not you keep using the product.
One small server, and what it holds
We run a directory for accounts: your sign-in address, your handle and your public key, so people can find and verify you. It never receives mail. If you use shared Pods with other people, their names, members and posts are stored there too, readable by our server — not end-to-end encrypted.
What it is allowed to do
Manual Only
Analysis and advice. It reads, explains and recommends. It drafts nothing and does nothing.
Semi-Auto
It drafts and stages. You approve every send. This is the ceiling — autonomous execution is not part of this release.
Three safeguards you cannot switch off
- Sending requires a frozen preview of exactly what will go out, plus a second, consequence-named confirmation.
- Anything touching money, attachments or a VIP contact is forced down to a draft for human review, whatever the settings say.
- One click drops a single superworker — or all of them — to advice-only, effective immediately.
How you stop it
- One click drops a single superworker — or every one of them — to advice-only, effective immediately.
- Pausing or stopping a superworker takes effect at once: new work stops, drafts already made are kept, and nothing is left half-sent.
- Every authorisation is set per capability and can be lowered at any moment, with no cooling-off period and no penalty.
What you can check afterwards
Every file operation and every autonomous action lands in an append-only log with a single global viewer. Each approval keeps a record of what was shown to you and what you decided. The trail is not summarised or rotated away.