The Architecture: IMAP Transport → Local Storage → Analysis

GravesMail uses your email provider’s IMAP server purely as a transport layer. I never read from IMAP to display messages — that would be slow and unreliable. Instead, here’s what happens:

1. Fetch from IMAP — Messages are downloaded from your provider’s server over an encrypted connection.
2. Stage in DMZ — New messages land in a local staging area (SQLite) before you see them.
3. 7-layer security analysis — Every message and attachment runs through all seven Protection Layers on your machine, including YARA malware scanning.
4. Quick Rules filtering — Messages matching your personal Quick Rules are filed by your rule automatically: set aside in the Spam Trap for review, moved, or deleted.
5. Promote to Inbox, Spam, or Malware — Clean messages reach your Inbox. Spam goes to Spam. Malware-positive messages go to a separate Malware folder with dangerous attachments stripped and held.
6. Delete from server (optional) — If you’ve enabled “Delete from server,” the message is removed from your provider.

SQLite is the single source of truth. Everything you see in the UI comes from your local database, not from IMAP.

Two-Phase Sync for Large Mailboxes

When you first connect an account — especially one with thousands of messages — GravesMail uses a two-phase approach:

Phase 1 (Quick Start): The newest 500 messages per folder are fetched first, typically in under a minute. You can start reading and working immediately.

Phase 2 (Background Sync): The remaining messages download quietly in the background. A progress indicator in the status bar shows completion percentage and estimated time remaining. You can pause, resume, or stop at any time. Progress is saved if you close the app.

The Seven Protection Layers

Every incoming message and its attachments pass through seven independent Protection Layers. Each layer looks for a different kind of problem and decides on its own. If any single layer raises an alarm, the message is treated as spam — there is no averaging and no combined score that has to be reached. One alarm is enough. This is the “7-layer OR” model.

Honest reporting — no false confidence

Open any message’s Properties to see a per-layer breakdown: what each layer scored, the threshold at which it alarms, and its state — Alarmed, Clean, or Not available. When a scanner could not run, GravesMail reports “Not available.” It is never shown as “Clean.” An antivirus that fails to start and then reports clean anyway is the worst kind of security tool, because you trust a verdict that was never actually rendered.

The Security Engine screen (Tools → Security Engine, or Settings → Security Engine on mobile) lets you tune each of the seven layers on its own with a 0–100% sensitivity slider — 0% turns a layer off, 100% is the most sensitive. There is no single global control; you tune the layers individually. The same screen shows live malware-scanner status, a country policy editor, and a read-only inventory of every detector and how strongly it counts.

Geolocation Without the Lookup

The Heuristic layer considers where a message originated. That lookup is purely local. GravesMail ships with an embedded country-to-IP-range table and consults it on your device — there are no DNS queries, no external API calls, and no third-party service in the path. Your message metadata never leaves your device to be geolocated.

You decide what the result means. In the Security Engine screen you can mark countries as Safe (no extra spam signal) or Threat (a strong one). Both lists start empty, so ordinary international mail is never penalized until you choose a policy.

IP geolocation data by DB-IP (db-ip.com), licensed under CC BY 4.0.

External Image Blocking & Tracking Pixel Stripping

When you receive an email, senders can embed external images that load from their servers. When the image loads, the sender learns your IP address, that you opened the email, when you opened it, and what device you used.

GravesMail blocks external images by default. Separately, it detects and strips invisible tracking pixels (1×1 images used solely for read-receipt tracking). These are independent controls — you can load images without loading trackers, or vice versa.

End-to-End Encryption (OpenPGP)

GravesMail supports OpenPGP — the open, interoperable standard for end-to-end encrypted and signed email. You can exchange private mail with anyone who uses PGP, on any mail system (Proton Mail, Thunderbird, gpg, and others), not just other GravesMail users. This is real PGP/MIME, not a GravesMail dialect.

Keys

Generate a key in the PGP Key Manager — Ed25519/Curve25519 is recommended, with RSA-4096 available for compatibility with older PGP software. Export your public key so others can write to you, and import theirs to write to them. After importing, GravesMail shows the key’s fingerprint; confirm it with the person out-of-band — a call, or in person — and mark it verified. An unverified key still works but stays flagged as unverified, because that flag means exactly one thing: you have not yet confirmed this key really belongs to that person.

Keys are identified by fingerprint, not by email address. Having two keys for one address is normal — an old one and a new one, or an RSA and an Ed25519 key side by side — so every action acts on the key you selected, not the first one that happens to match the address.

You can link a key to a contact, so encrypting to that person just works without hunting through the Key Manager. Linking a key does not switch encryption on; you still choose it per message.

Sending and reading

Compose has a Security control with three modes — Sign, Encrypt, or Sign + Encrypt (recommended for private mail). It defaults to off, so ordinary mail is unchanged. Encrypted mail you receive is decrypted automatically and shows a closed padlock 🔒; signed mail shows its signature status, and an invalid signature is shown loudly rather than quietly. A message encrypted to a key you don’t have on that device says so explicitly instead of showing you a blank body.

When you send encrypted mail, GravesMail also encrypts it to your own key, so the copy in your Sent folder stays readable by you. Without that, your own retained copy would be undecryptable. This is always on.

The rule that doesn’t bend

If you choose to encrypt and a recipient has no usable key, the send is blocked. GravesMail stops and asks: cancel, or explicitly choose to send unencrypted — a deliberate second action that names the at-risk recipients, never a default and never automatic. There is no code path in which choosing encryption quietly produces a plaintext send. That is enforced in the engine itself, not just in the interface, and it is covered by an automated test.

What PGP protects, and what it doesn’t

PGP encrypts the message body and attachments. It does not hide the subject line, the To/From/Cc, or when a message was sent — those travel in the clear. That is the same limit every PGP/MIME system has, including Proton; it is not a GravesMail shortcoming, but you should know it before you rely on it.

PGP protects your mail in flight — from interception and from your mail provider. It is not an anti-forensics tool: once decrypted, mail is cached in GravesMail’s local encrypted database so you can search and read it offline.

Two further limits, stated plainly: GravesMail does not do automatic keyserver or WKD lookup and has no web-of-trust — you import keys yourself and verify fingerprints yourself, which is a deliberate choice to avoid trusting a network service about who someone is. And inline clearsigned messages are shown as readable text without signature verification; GravesMail displays them rather than claiming a signature it hasn’t actually checked.

Interoperability

GravesMail’s PGP is verified bidirectionally against GnuPG — the reference OpenPGP implementation — using GravesMail-generated keys, for both Ed25519 and RSA-4096: GravesMail encrypts and gpg decrypts, gpg encrypts and GravesMail decrypts, and signatures verify in both directions. That is an automated test suite, not a one-off manual check.

Proton Mail is confirmed too — by hand rather than by automated test. Real encrypted mail has been sent and read in both directions between GravesMail and a live Proton account. That testing is also what found and fixed three real defects along the way: Proton’s strict key validation rejecting GravesMail’s Ed25519 keys, a key-expiry bug, and attachments being silently dropped from encrypted mail on decryption. All three are fixed, and Proton interop works in both directions.

Thunderbird I have not tested for PGP specifically, so I won’t claim it here. It is a standard OpenPGP client and it should work, but “should” is not the same as verified, and I’d rather tell you what has actually been checked.

Password-Protected Email (No Key Needed)

PGP is the right tool when your correspondent also uses PGP. When they don’t — and most people don’t — use the password-protected option below instead.

Sometimes you need to send something private to someone who has no encryption keys and no special software — just an ordinary email account. GravesMail’s Password-protect (no key needed) option seals your message and any attachments inside a real, standard AES-256 encrypted ZIP, which the recipient opens with free, ordinary software on any platform.

This uses the industry-standard WinZip AES-256 (AE-2) format — the same strong encryption 7-Zip, Keka, and the mobile archiver apps already understand. It is not a GravesMail-only container, and it is not the weak, crackable “ZipCrypto” that older ZIP tools used. Interoperability is proven against real standard archiver software, with the archive’s AE-2 encryption format pinned by automated test — so what goes out is a genuinely standard file, not something that only appears to work between two copies of the same app.

What actually goes out is a single attachment, protected-message.zip. Your real message and every attachment are encrypted inside it; the visible email body carries only plain-language instructions for opening it. Attachment names inside the archive are replaced with neutral placeholders, with the real names held in an encrypted manifest that appears once the recipient enters the password — so the file names don’t leak either.

When you send, GravesMail asks you to set a strong password (at least 12 characters with upper and lower case, two digits, and two symbols), with a live checklist and a confirm field so a typo can never lock the recipient out. Afterward it shows the password once, with a Copy button, and reminds you to pass it along out-of-band — by phone, text, or chat. GravesMail never offers to email the password, and never stores or transmits it anywhere. GravesMail can also open protected messages it receives, in place, on every platform.

Quick Rules: Your Personal Email Triage

Quick Rules let you create one-click triage rules for specific senders, domains, or subject patterns. Each rule gets its own toolbar button. When you apply a rule to a message, the sender is automatically added to that rule’s match list — the rule grows smarter as you use it.

A rule can send matching mail to the Spam Trap to be set aside for review, move it to a folder, delete it, or auto-delete it after a number of days. Rules can be set to auto-apply during sync, so matching messages never reach your Inbox, and you can scan entire folders in seconds to catch old mail in bulk. Anything a rule caught can be reviewed, restored, or purged at any time.

Your rules take precedence over the spam filter. A message matched by one of your rules is filed by your rule before the spam filter can divert it — so a sender you have written a rule for won’t be wrongly sent to Spam. The filter still runs and still scores the message, and you can see its verdict in Properties; it simply doesn’t override your rule. The one exception is malware: the malware scan always wins, so a rule can never deliver a dangerous attachment to your Inbox.

The Filtered list shows everything caught across all of your rules within a rolling time window (1 to 96 hours on the desktop, 24 by default). Each review list — Rules, Filtered, and Spam — has its own search box.

Open a caught message and the first tab is Safe Preview: the message rendered as it would look in your reading pane, but with scripts neutered, tracking pixels blocked, and remote images loaded only for trusted senders. It has Reply, Reply All, and Forward buttons, so you can answer a caught message without restoring it to your Inbox first — the message stays where it is and your reply goes out as a normal message.

Held Attachments

When YARA or your system antivirus detects malware in an attachment, GravesMail takes the following actions automatically:

• Message set aside — moved to a dedicated Malware folder, separate from Spam.
• Attachment stripped — the dangerous file is removed from the message. The message body is retained so you can see who sent it.
• Data preserved — the attachment bytes are kept locally. You can review each held item, see why it was held, save it to disk if you trust it, or permanently delete it, via Held Attachments. Held items are kept until you decide; they are never lost silently.
• Full explanation — the message properties show exactly which YARA rule or AV engine triggered, what file was affected, and what action was taken.

You can also right-click any attachment at any time and choose Scan for Malware to run an on-demand scan. YARA rules can be updated manually in Settings or automatically on a weekly schedule.

Automatic Encrypted Backups

GravesMail automatically creates encrypted backups of your whole profile — not just your mail database, but your contacts, calendar, rules, safe and blocked lists, tuned thresholds, sender reputation, trained spam filter, PGP keyring, and saved account credentials. (Files that ship with the app and are replaced on update, such as the geographic lookup table and the baseline spam model, are deliberately left out.)

• Full backups — a complete profile copy, AES-256 encrypted
• Differential backups — only what changed since the last full backup; restoring one automatically walks back through the chain
• Pre-operation snapshots — before any destructive operation (Quick Rules scan, purge, clear trash)

You control the schedule from the Backup Manager: either an interval (off, daily, weekly, or a custom number of hours, with a full backup every N days) or a weekly grid where each day is set to None, Full, or Differential. Retention limits for full, differential, and snapshot backups are configurable and never prune your only copy.

How These Backups Are Encrypted

GravesMail’s own scheduled and manual backups are sealed with a Backup Master Key that the app generates and manages for you. The key itself is never written to disk in the clear — only wrapped copies are stored, and it is wrapped two ways:

• Your device’s secure keystore — so routine backups happen silently, with no password prompt, ever.
• Your recovery passphrase — which unwraps the same key on any machine, with no keystore involved.

That second wrap is what makes these backups device-independent. Earlier versions tied automatic backups to one physical machine; they are no longer restorable only where they were made.

You set the recovery passphrase once, the first time you make a backup. It is required, not skippable — a backup will not complete until one is set, precisely so you can never end up holding backups you cannot recover. After that, backups run with no further prompt. You can change it at any time from the Backup Manager, and changing it keeps every existing backup restorable.

The Backup Manager lets you browse any backup’s contents, search across all backups, compare with your current database, and selectively recover individual messages. A restore verifies the backup is complete and intact before touching your current profile — a truncated or damaged backup is refused with your existing data left untouched — and when it finishes it shows you what came back, dataset by dataset.

Deletion Log & Recovery

Every deleted message is captured in a local deletion log with full body content. You can browse, search, and one-click recover deleted messages for up to 90 days (configurable). No backup file needed — recovery is instant from the deletion log.

Community Spam Intelligence (Opt-In)

If you choose to participate, GravesMail can share anonymous spam pattern data — just word-frequency scores, never email content — to help improve the filter for all users. This data is combined into a shared baseline that ships with each new version, so new users start with the combined knowledge of the community.

It’s Your Choice

Sharing is completely optional. It’s turned off by default. You can turn it on or off at any time in Settings. If you don’t participate, your personal filter still learns and improves on its own. You still benefit from the shared baseline that shipped with your version. The same opt-in telemetry is available on the iOS and Android mobile app.