Why believea one-person client?

The commitments

Your password

From this machine to your provider, and it stops there — held in the OS keychain, or in an encrypted file only your account can open. Clients that relay it through a cloud of their own hold a copy of your mail there too; there is nothing here to relay it through.

The store

Your mail is a SQLCipher file on your own disk. The key is in your keyring, or behind an Argon2id envelope your passphrase opens — and the search index is encrypted at rest under a key derived from that same one.

What a model may touch

Nothing, until you connect one. Consent is per feature and per account, in three tiers — full, envelope-only, or off, where off means no model reads that account at all. Tightening it deletes what was already derived; an account you add starts at full.

When it leaves

Sending a conversation to a provider you configured raises a notice naming it, once per conversation. Your own draft and your own search terms don’t raise it — those are your words, not your correspondent’s.

What an agent may do

Read, search, file and draft. Sending is off until you grant it and the refusal happens in Rust, not the interface. Every action lands in an audit trail with a Revert beside it; the two with no reverse — a draft and a send — refuse instead of pretending.

The exit

Any message writes out as .eml from the bytes that arrived, and says so in its own header where those weren’t kept. Mail comes back in from mbox and .eml. There is no whole-mailbox export button: the store is already one file you hold.

Nothing is watching

No ads, no analytics, no telemetry. Remote images stay blocked until you allow the sender, tracking pixels are stripped even for senders you allowed, and nothing you send carries one. Crash reports are off until you switch them on, and the only address it reaches on its own that isn’t your provider is GitHub, asking about updates.

What it speaks

IMAP with CONDSTORE and QRESYNC, JMAP with push and server-side Sieve, Gmail over its own API, Microsoft 365 over Graph, POP3. OpenPGP signs and encrypts both ways, fetching keys from your correspondent’s own domain. S/MIME only reads — it verifies and decrypts, and never signs.

The part you can read

The capacity model the battery runs on is @kumbatio/energy-system — MIT, on npm and on GitHub, so what decides when your mail is held is readable. The client itself is not open source: no license has been chosen yet.