Private development · Sign-ups closed

Roadmap

Four lists: what runs today, what is next and in what order, what is planned without a place in that order, and what we are not going to build. Nothing moves between them because we announced it. It moves when it works.

Being straight about what is not built is the product working as intended — it is the same product that will never send a mail you did not approve.

Runs today

Exercised by running the application. Not operated in production — nothing here has been — but written, tested and used.

Your own domainLiveThe approval boundaryLive

  • Receiving. Mail arrives on a domain you control, through Cloudflare Email Routing in your own Cloudflare account.
  • The client. Folders, threaded conversations, search with from:, to:, subject:, in:, is:unread, is:starred, has:attachment, before: and after:, rich-text compose, drafts, reply and forward, inbound attachments, per-mailbox settings.
  • Access control. Workspaces; owner, admin, operator and viewer roles; per-mailbox grants; invitation-only membership; revocation that takes effect on a live session.
  • The agent. One per mailbox. Reads, searches, triages and drafts, and stops at a server-rendered approval card before any draft, draft revision, draft discard, move or mark-as-read. It has no send tool and no tool that deletes a message you have received.
  • Inbound safety. Prompt-injection scanning that gates automatic drafting, failing closed. What that does and does not cover.
  • MCP. 14 scope-gated tools over OAuth 2.1 with PKCE, with owner- and admin-managed clients. Reading and drafting a new message work outright; the seven that change something stop and ask a person first, over the protocol's own confirmation round-trip. A client that cannot carry that round-trip is refused.
  • Installing it. It adds to a home screen and launches without re-fetching the interface. What is cached is the build; nothing of the mailbox is, on purpose, so with no connection it says it is offline rather than showing stale mail.

How the agent is contained today

Next, in this order

This order changed recently, and the change is worth naming: verified sending used to be first. It is not, because a stranger is owed the ability to take their mail out and delete their account before they are asked to put mail in.

Export and deletionNext — the next thing on the list, not built yetA spend capNext — the next thing on the list, not built yet

  1. A bounded bill, and somewhere real to run

    A per-mailbox spend cap that refuses model work over the limit and says so, a gateway that records what every call actually cost, rate limits on the mail API and the agent socket, and a written restore path for all three stores. The meter in the pricing model is built on that counter; if the counter is wrong, the pricing is wrong.

  2. Export, and deleting your account

    Every message as a standard mbox, every attachment, the folder structure, the settings and the agent’s activity record — and later the rules it learned, as readable JSON. Then account and workspace deletion, extending the mailbox erasure that already exists upward through grants, invitations, MCP clients and tokens. Being free to leave is what makes it reasonable to invest in staying.

  3. Somewhere safe to keep a provider credential

    Before any account can be connected there has to be a vault that holds the tokens for it, with revocation that reaches the provider rather than only our own database.

  4. Microsoft 365, then Google Workspace

    Microsoft first, and not because it is the larger market. Acting on a Gmail account — reading it and filing what the briefing decides — needs one of Google’s restricted scopes, and a restricted scope needs app verification plus a third-party security assessment that has to be renewed at least every twelve months. Until that clears, an app still in testing issues refresh tokens that expire after seven days, which a twice-daily briefing cannot survive. Each provider lands one at a time, and this page will say which.

  5. The briefing

    The queue, the cards, the sections, the schedule. It is drawn in full here, and every word of that page is in the future tense until this line moves.

  6. Cross-account identity, and verified sending

    A reply has to leave from the right account, with the right signature, in the right register — one reply from the wrong address costs more trust than ten good briefings earn. The outbound pipeline is written: persisted before publishing, durable jobs, bounded retries, dead-letter queues, provider message IDs recorded. What it has never had is a live provider on the other end, including the bounces and the ugly cases, so we go on calling it unverified.

  7. Cheap detection, and the meter

    The light pass that notices something will not wait until this evening, and the frequency meter the pricing shape describes.

  8. The learning loop

    Rules proposed in the open, a rules list you can edit, the sample handed back for correction, and the learned policy exported with everything else.

Planned, without a place in that order

Named here so nobody has to guess whether they are quietly in progress. They are not, and the first four are gaps a reviewer would find in ten minutes.

UndoPlanned — not built yetKeyboard shortcutsPlanned — not built yetPricingPlanned — not built yetYour own Cloudflare accountPlanned — not built yet

  • Undo, and the reversibility tiers. There is no undo anywhere in the product today, which is why the agent asks before every change rather than acting on the reversible ones and reporting them. Undo has to exist before that loosens.
  • Keyboard shortcuts and a command palette. There are none. Not a reduced set — none.
  • Multi-select and bulk actions in the client. Also none. Triage above about fifty messages a day is unpleasant without them.
  • Spam classification. The folder exists and nothing fills it. On a domain you route in yourself, somebody has to filter, and it protects the agent’s context as much as your inbox.
  • Your own Cloudflare account for inference, which is what the top pricing tier is. A narrow credential holding one capability, not a deployment into your account.
  • Pricing, plans and billing. None of it exists. There is nothing to buy.
  • Calendar peek — parsing an invitation, showing the event, accepting by reply. Not a calendar; see below.
  • Any certification or external audit. Not started.

Not building, and why

A roadmap that only lists intentions tells you nothing. These are the ones somebody will otherwise ask for, with the actual reason rather than “not on the roadmap at this time”.

IMAP and POP — an architecture reason, not a scheduling one

IMAP’s push mechanism, IDLE, needs a TCP connection held open. A Cloudflare Worker cannot hold one across requests. A Durable Object can, and per Cloudflare’s own documentation an open TCP socket keeps that object in memory and incurs duration charges for up to fifteen minutes per connection — so every connected mailbox would bill wall-clock around the clock whether or not any mail arrived.

Google and Microsoft are HTTPS with delta queries: nothing is spent while idle. And a product that acts twice a day does not need a socket. It needs a cron. IMAP is also the long tail of a market that is overwhelmingly those two, so the cost would buy the fewest users at the highest price. If that calculation changes, this paragraph changes with it.

The agent sending or deleting unattended

There is no roadmap item for it, at any tier, behind any setting. If you do not open the briefing, your mail goes unanswered — Keelpost makes responding fast, it does not respond for you. Nor will there be an “approve all” that can reach an irreversible action, or a rule that lets a model auto-approve its own tool calls. A standing rule is something a person wrote once that the server thereafter applies with no model in the path, which is a different thing entirely.

Read receipts and open tracking

They need a tracking pixel — the exact thing the sandboxed reading frame in this product blocks on the way in. Native receipts require the recipient to consent on Outlook and Google Workspace, Apple Mail does not support them, and Apple’s Mail Privacy Protection makes a large share of the remaining signal fictitious. It is a feature that lies to the user about whether they were read, and we would rather not ship one.

Zoho, and a third provider integration generally

This site used to list Zoho as planned. It is not, and saying so is the point of this section: a third provider means a third set of quotas, a third verification regime and a permanent maintenance cost, for a fraction of the people this is for.

A full calendar, and multi-channel

Calendar sync across CalDAV, Google and Microsoft is a multi-month project with its own conflict semantics — a different product wearing this one’s clothes. SMS, WhatsApp and social channels make a support desk, which is a different buyer. Neither is a gap; both are refusals.

Certifications, for now

No SOC 2, no ISO 27001, no HIPAA, no audit of any kind, and no badge we did not earn. There is a full list of what we do not claim on the security page.

About dates

There are none, and we are not going to invent any. We do not promise quarters, we do not promise a beta window, and the order above is the current best order rather than a commitment — two items in it can swap, and something under “planned” can jump ahead if it turns out to be the thing blocking real use. What will not happen is a line moving up because it would look better on this page.

The one commitment: this page will not describe anything as working before it has been tested end to end, and the waitlist gets one email when sign-ups open.

Join the waitlist

Sign-ups are closed. Leave an address and we will write once, when they open.

We store the address you type, plus a hashed form of your IP address so the form can be rate-limited. One email when sign-ups open, and nothing after that. We do not share the list, and there is no analytics or third-party script on this site.