# The deal, and what enforces it

> A desktop email client with a battery you set: drop it and the inbox narrows, notifications hold, and your undo window widens. Encrypted on your own machine. Private beta on macOS.

Credentials go device to provider and stop. A SQLCipher store and a search index encrypted at rest. AI consent per feature and per account. Any message exports as .eml. No ads, no analytics, no tracking pixels. The price is undecided, and lifetime is never promised.

Why believe a one-person client?

You shouldn’t, on my word — so this page doesn’t ask you to. Every promise below names the mechanism that enforces it: where your password goes, what a model may touch, how you leave, and how this gets paid for. What isn’t shipped isn’t on this page.

## The commitments

### Your password

From this machine to your provider, and it stops there — held in the OS keychain, or in an encrypted file only your account can open. Clients that relay it through a cloud of their own hold a copy of your mail there too; there is nothing here to relay it through.

### The store

Your mail is a SQLCipher file on your own disk. The key is in your keyring, or behind an Argon2id envelope your passphrase opens — and the search index is encrypted at rest under a key derived from that same one.

### What a model may touch

Nothing, until you connect one. Consent is per feature and per account, in three tiers — full, envelope-only, or off, where off means no model reads that account at all. Tightening it deletes what was already derived; an account you add starts at full.

### When it leaves

Sending a conversation to a provider you configured raises a notice naming it, once per conversation. Your own draft and your own search terms don’t raise it — those are your words, not your correspondent’s.

### What an agent may do

Read, search, file and draft. Sending is off until you grant it and the refusal happens in Rust, not the interface. Every action lands in an audit trail with a Revert beside it; the two with no reverse — a draft and a send — refuse instead of pretending.

### The exit

Any message writes out as .eml from the bytes that arrived, and says so in its own header where those weren’t kept. Mail comes back in from mbox and .eml. There is no whole-mailbox export button: the store is already one file you hold.

### Nothing is watching

No ads, no analytics, no telemetry. Remote images stay blocked until you allow the sender, tracking pixels are stripped even for senders you allowed, and nothing you send carries one. Crash reports are off until you switch them on, and the only address it reaches on its own that isn’t your provider is GitHub, asking about updates.

### What it speaks

IMAP with CONDSTORE and QRESYNC, JMAP with push and server-side Sieve, Gmail over its own API, Microsoft 365 over Graph, POP3. OpenPGP signs and encrypts both ways, fetching keys from your correspondent’s own domain. S/MIME only reads — it verifies and decrypts, and never signs.

### The part you can read

The capacity model the battery runs on is @kumbatio/energy-system — MIT, on npm and on GitHub, so what decides when your mail is held is readable. The client itself is not open source: no license has been chosen yet.

## How this gets paid for

### The price

Undecided. There is no number on this site, no plan table, and nothing to pay — the beta asks for an address and nothing else.

### Ruled out already

Never a lifetime license — it is the promise this category breaks most often. Never a paywall on snooze, send-later, undo, rules, unified inbox or search: charging for those is charging you for being an email client.

### Not paid for by

Ads — there is no ad code in the app. Your mail — no subject, sender or body is sent anywhere but your provider. Resale — nothing is collected that could be resold.

### If I stop

Your mail is a SQLCipher file on your own disk with a key you hold, and every message writes out as a standard file. Nothing about leaving requires me to still be here. What you won’t get is a shutdown plan I haven’t built.

### This page’s form

It keeps your address, what you use now, and what you hate about it. That is the whole table.

## Pages

This page as HTML: https://meltemi.email/trust

- [The battery](https://meltemi.email/index.md): Tell it how much you have left.
- [Triage](https://meltemi.email/triage.md): The pile, and finding anything.
- [Sending](https://meltemi.email/sending.md): You are also a sender.
- [Privacy](https://meltemi.email/privacy.md): Yours, and it stays yours.
- [Request beta access](https://meltemi.email/beta.md): macOS · no account · no card

## Language

- [Ελληνικά](https://meltemi.email/el/trust.md)
- [Français](https://meltemi.email/fr/trust.md)
- [Deutsch](https://meltemi.email/de/trust.md)
- [Español](https://meltemi.email/es/trust.md)
- [Italiano](https://meltemi.email/it/trust.md)
- [Português](https://meltemi.email/pt/trust.md)
- [العربية](https://meltemi.email/ar/trust.md)