Every product we ever ship keeps all five. An agent that can't doesn't ship.
Under each promise: what it means in the product, and how we check it.
Your approval is the send, and nobody on the other end is dealing with a machine. Automation is earned, never assumed.
Approve & send runs a visible ~10-second hold with a real Undo. A failed send lands safely in your Drafts. There is no auto-send code path to toggle today. If sending ever becomes automatic for one of your processes, it will be because you walked it up every level of trust and turned it on yourself. Never on a model's judgment.
A test fails if the code that writes your drafts can reach anything that sends mail. Another fails if anyone adds a setting to send without your yes.
Every refusal speaks. A failed send lands in your Drafts, never lost.
Every refusal speaks, no dead buttons, undo on every destructive verb. Every claim the product makes shows its receipts.
A test fails if a Gmail or Outlook error would show up as an empty inbox. A lockout, a slowdown and a missing message each get their own name and their own sentence.
Four decisions, receipts attached. Empty is success.
Every thread lands in one of four decisions: Do · Plan · Handoff · Let go. Each placement carries a receipt, every verdict names its signals, and your correction outranks the machine's opinion. Permanently. The empty state is the goal state: "Nothing needs you right now."
A test fails if any email could be sorted without a named reason. Another checks that when you route a kind of mail yourself, it lands where you said.
A short record on your Mac, never the full text. Your mailbox stays the record.
The full text of your mail is never saved, on your Mac or on ours. The AI runs on your own account, not through our servers. The full custody map is below.
A test puts a full private email into the app's mail record and fails if that text reaches your Mac's disk. Another fails if the app runs Claude without telling it not to save a copy of the session.
Approved, sent, and off your plate. You end the day seeing what moved.
Approve → hold → undo → sent, under your byline. The chain runs to done, and the day shows what moved.
The byline law. A test fails if a draft is shown without its byline, the line that says who wrote it. It checks who stands behind each draft, not how much work moved.
These aren't slogans. Each one names its check, so keeping them is systematic, not heroic.
Your mailbox remains the system of record. On your Mac, the app keeps who wrote, when, the subject and the first lines of each email, plus short summaries and drafts it wrote. The full text of your mail is never saved.
There is no Deliberate cloud reading your mail. What comes to us is your account, which Macs you use, the addresses of the inboxes you connect, basic facts about each Mac like its macOS version, and counts of how the app is running and how much mail it sorted. Never your mail, its subject lines, your calendar, or who you write with.
To read and draft, Deliberate sends the emails it is working on to Claude, under your own Claude account. It never sends your mail to us. We never resell AI access.
Nothing sends on a machine's judgment. Approve → hold → undo → your byline. The hold is a visible ~10 seconds, with a real Undo.
Yes. During alpha, Google's testing-mode tokens expire weekly. Reconnecting is one calm click, but you'll do it every week until we exit testing mode. Microsoft accounts don't have this quirk.