Every product we ever ship keeps all five. An agent that can't doesn't ship.
Every claim below is a pinned engineering law, not a policy.
Your approval is the send. Automation is earned, never assumed.
Approve & send runs a visible ~10-second hold with a real Undo. A failed send lands safely in your Drafts. There is no auto-send code path to toggle today. If sending ever becomes automatic for one of your processes, it will be because you walked it up every level of trust and turned it on yourself. Never on a model's judgment.
Every refusal speaks. A failed send lands in your Drafts, never lost.
Every refusal speaks, no dead buttons, undo on every destructive verb. Every claim the product makes shows its receipts.
Four decisions, receipts attached. Empty is success.
Every thread lands in one of four decisions: Do · Plan · Handoff · Let go. Each placement carries a receipt, every verdict names its signals, and your correction outranks the machine's opinion. Permanently. The empty state is the goal state: "Nothing needs you this morning."
Metadata only, on your machine. Your mailbox stays the system of record.
Message bodies never touch our disks, and the AI runs on your own account, not through our servers. The full custody map is below.
Approved, sent, and off your plate. You end the day seeing what moved.
Approve → hold → undo → sent, under your byline. The chain runs to done, and the day shows what moved.
These aren't slogans. Each one maps to an engineering law inside the product, so keeping them is systematic, not heroic.
Your mailbox remains the system of record. Deliberate keeps metadata only; message bodies are never written to its disk store.
There is no Deliberate cloud reading your mail. The app reports only that it's running and how it's behaving, never what's in it: no message content, no subjects, no calendar entries, and raw records expire after 30 days.
Analysis runs through your own Claude subscription, on your own machine. Deliberate never proxies your content or resells AI access.
Nothing sends on a machine's judgment. Approve → hold → undo → your byline. The hold is a visible ~10 seconds, with a real Undo.
Yes. During alpha, Google's testing-mode tokens expire weekly. Reconnecting is one calm click, but you'll do it every week until we exit testing mode. Microsoft accounts don't have this quirk.