Encrypted-container email for Apple platforms and Android
Beacon Mail
Private email built around an authenticated encrypted container, with automatic safeguards that can wipe its encryption keys and make protected local mail, contacts, and calendar state permanently unreadable.
In development for Apple platforms and Android.
Everyday mail
The tools to use the mailbox you already have
Read plain text and hardened HTML where supported, with attachments and the message details needed to understand the conversation.
The core difference
The private data lives in an encrypted container
Beacon Mail starts with a random 256-bit content key and uses authenticated AES-256-GCM encryption for supported local records. Integrity checks and account-specific context are designed to make altered or misplaced ciphertext fail closed.
Authenticated encrypted mail
Supported messages, attachments, drafts, indexes, and operation records are encrypted individually inside the container.
Encrypted Beacon contacts
Beacon-owned contacts stay device-local and encrypted instead of becoming a developer-operated address-book service.
Protected calendar state
Private calendar projections used by Beacon can live in the encrypted container without putting mail or tracker data into widgets.
Credentials kept separate
Credentials use platform-protected storage and are kept separate from the encrypted message cache and the encryption keys that protect the container.
Analysis stays local
Tracker classification, safe URL handling, search, and message processing run on the device without a tracker-lookup backend.
Direct provider connections
Mail travels directly between the device and the provider you configure. Beacon does not relay, queue, or store it.
Automatic safeguards
Auto-wipe the encryption keys
When enabled, time-away, daily schedule, Lock Now, restart, and supported USB or YubiKey events wipe the encryption keys that unlock the protected container.
Time-away lockThe timer counts only while Beacon Mail is minimized, backgrounded, or closed—not while you are actively using it.
Schedule and restartDaily scheduled revocation is checked before protected access resumes, and a device restart revokes the current authorization grant.
Security-event triggersSupported USB and YubiKey events can trigger the same encryption-key wipe, with detection limits that vary by platform.
What auto-wipe means: Beacon Mail destroys the encryption keys that make the container readable. Encrypted files may remain as ciphertext, but the protected local mail, contacts, and calendar state cannot be decrypted or recovered without those keys.
Direct by design
Your provider gets the connection. Beacon does not.
Incoming and outgoing mail uses encrypted IMAP and SMTP connections directly from your device to Gmail, iCloud Mail, or another compatible provider. There is no Beacon account to create. No Beacon server in the middle.
No mail relay
Potato Studios does not receive or hold a developer-side copy of your mailbox through Beacon Mail.
No notification relay
Background refresh is best effort because Beacon does not operate a push-notification service for your mail.
No tracker lookup
Detected links and message content are not sent to Potato Studios or a reputation service for classification.
Everyday mail
The tools to use the mailbox you already have
Multiple accounts and folders
Switch between unified, account, and folder-specific inboxes, with labels, search, and direct refresh controls.
Complete message reading
Read plain text and hardened HTML where supported, with attachments and the message details needed to understand the conversation.
Reply and send
Reply, forward, save drafts, add attachments and signatures, and send directly through the configured SMTP provider.
Visible tracker findings
Remote images are blocked by default, while pixel trackers, remote images, and tracked links are reported according to what the app found.
Provider-specific sign-in
Use supported app passwords, browser authorization, provider presets, or manual IMAP and SMTP settings without creating a Beacon identity.
Offline control
Eligible Offline folders can keep mail only on the device, with explicit export, restore, and deletion safeguards for the only-copy risk.
Honest limits
The security boundary is part of the promise
Your provider still existsYour provider retains synchronized mail and applies its own authentication, retention, and privacy rules.
Unlocked means readableEncryption protects retained files and revoked or restarted states; it cannot retract plaintext already displayed on an unlocked device.
System stores stay separateContacts and Calendar records placed in operating-system or provider accounts remain governed by those selected stores.