A sealed inbox on your machine.

What it is

What the app does

Mail, built in

The CUBE Contact desktop app carries a full email client. It is a real IMAP/SMTP client for mailboxes you already own, with the sealed store underneath: messages sit encrypted at rest on your machine, and reading them never needs a network round trip.

A relay, not a server

The middle is deliberately dumb: it pairs sealed circuits by CUBE coordinate, keeps a bounded mailbox for envelopes addressed to someone who is offline, and holds the public listing index. It never holds an account record, a contact list, or anything it can read. The one thing it keeps on purpose is a sealed envelope for an offline friend, bounded in time, deleted on delivery or expiry.

cube-contact --relay 127.0.0.1:9444 --relay-store ~/cube-mailbox

location = /relay {
    proxy_pass http://127.0.0.1:9444;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
}

cube-contact --reach "relay.example.org:80/relay, cubelinux.com:80/relay"

[Unit]
Description=CUBE relay
After=network-online.target
[Service]
ExecStart=/usr/local/bin/cube-contact --relay 127.0.0.1:9444 --relay-store /var/lib/cube-mailbox
Restart=always
[Install]
WantedBy=multi-user.target

The comparison below is the honest one: an IRC server anchors identity and state; this relay anchors nothing but a route.

Install it

Pricing

The CUBE mail server is open

Mailboxes on our own server are available now: US$5 a month per domain, sealed at rest on a LUKS volume whose key is sealed in CUBE. Receiving works two ways. Standard: any mail client, IMAP/SMTP with TLS. Sealed relay, included free with CUBED-mail and CUBE-Contact: new message bodies arrive sealed to a key that exists only inside the app, so the server never holds a readable body for that account — the mail-only client, CUBED-mail, was built with exactly this in mind.

Open a CUBE mailbox — US$5 a month What CUBE Mail is Hosting and relay, priced apart

The relay is opt-in per account, off by default. Thunderbird and other clients still work on the same mailbox; sealed messages show there as an envelope that asks the reader to open them in CUBED-mail or CUBE-Contact.

Bugs found — and fixed

Kept as we go: each entry names the fault, the fix and the day the fix shipped. Found by use, reported by users, or caught in our own testing — same list, same standard.

• 2026-10-26 — Search found the pages and never the mail. The old mail search had been removed, leaving its dead /mail/search route behind, so an address or subject you remembered could not be found at all. Fix — one box now searches both: every folder of every account (sender address, recipient, subject, body) above the pages list, newest first, up to 100 hits; the dead route is gone.
• 2026-10-26 — The list gave no sign which mail was unread. Unread lived only in a counter, so unread mail looked exactly like read mail. Fix — a small green dot marks each unread row; opening the message clears it, saves the read state in the sealed store and, best effort, sets \Seen on the server so it survives the next sync.
• 2026-10-26 — The nav bar led with chat. The mail pane — the product's centre — was one click off every page (owner's correction). Fix — mail first, chat second, then groups, search, publish, files, relay, call, on every page.
• 2026-10-26 — Syncing one folder emptied the others. The single-folder trim compared its stale records against the folders planned for the run instead of the folders actually fetched, so a one-mailbox sync wiped the stored copies of INBOX, Spam, Trash and Sent. Fix — the trim now walks only the folders fetched in that run; the emptied folders were re-fetched from the servers the same day.
• 2026-10-26 — Trash sat above INBOX, and a freshly added account showed no INBOX. Folders were ordered by stored index alone, and folders exist only after a first sync. Fix — a ranked leaf order (INBOX 0, Sent 1, Drafts 2, Archive 3, Junk/Spam 4, Newsletters 5, Trash 6, the rest alphabetical, local/shared last), one row per account and name with the server row preferred, and an INBOX seated for an account that owns none (owner's correction).
• 2026-10-26 — A new message had three doorways: the "new message" pill above the list, a button beside the folder picker, and a "Send an email" link in the reading pane — different in style and wording. Fix — one "Send new message" button beside the folder picker carries the picked folder into /mail/compose; the other doorways and their CSS are gone.
• 2026-10-26 — The all-accounts "All mail" view was noise. Every account's mail mixed into one strip blurred the folder tree and the counts (owner's correction). Fix — the unified view is removed for good, and the pane opens on a real folder.
• 2026-10-26 — Opening the app bounced the reader back to the loading page. The start-up sweep synced every folder in the background while holding the store lock. Fix — start-up syncs only each account's INBOX, first account first, and every other folder is fetched when it is opened (with a cooldown), so the page is usable after about a second.
• 2026-10-24 — A designed newsletter opened as a column of plain text. The reader always started on the text part, so an HTML mail looked like it had lost its layout until the full HTML tab was found. Fix — a message that carries an HTML part now opens in the HTML view (scripts, forms and remote images removed, links via the system browser), with a plain text tab for the text part.
• 2026-10-24 — Message rows collapsed to 18-pixel slivers after the batch-filing release: the row that gained the new checkbox was laid out as a flex item whose text cells (overflow hidden, single line) offered no intrinsic width, so every sender, subject and date was squeezed out of view. Fix — the row is a grid (checkbox column + one flexible text column), which cannot collapse; verified with the rendered layout, not by eye.
• 2026-10-24 — Reopening the app looked like every account had no mail. With several accounts the pane opened on the first folder named INBOX — which can belong to a secondary account and hold nothing — while the counter next to it showed the whole store's totals, and a long recovery log was replayed at every start. Fix — a store with more than one account opens on All mail, the counter states the shown folder's own messages, and an oversized recovery log is compacted once at startup.
• 2026-10-24 — Every issue of a daily newsletter was filed as junk and marked dangerous although it was ordinary mail: its HTML carries inline event handlers for click tracking, and that signal alone scored as high as the junk threshold. Fix — inline handlers, forms, frames, javascript links, data URIs and meta refreshes are now mild signals that cannot file a message by themselves; only a real script block, a program disguised as an attachment, or a look-alike link still reaches junk on its own.
• 2026-10-24 — Filing a message into Newsletters answered "that message has no account to act on" even though the move had in fact happened: the picker's change event and the file button could submit the same move twice, and the second submission went looking for a message that was no longer in its folder. Fix — a submission for a message that has already left its folder now says so and changes nothing, and a stored copy with no server id is filed locally with a note instead of an error page.
• 2026-10-23 — Add account posted to nowhere. A missing quote in the form's action made the browser post to /mail/settings><input…, so every save answered 405. Quote restored; the rendered form is now checked, not assumed.
• 2026-10-23 — A new account appeared empty. Folders exist only after a first sync, so a just-added account had none to show. Adding now starts the first sync, and an unsynced account is named in the mail pane with a pointer to its sync button.
• 2026-10-23 — "File into Newsletters" did nothing. The picker offered another account's folder (the move was refused as cross-account), and the preselected option never fired a change event. Fixed with a shared local Newsletters folder, targets limited to local and the message's own account, and an explicit file button.
• 2026-10-23 — The window froze during setup and sync. Gmail discovery took ~50 s and a first sync minutes, both on the thread that paints the window. Both now run in the background behind a step page: connecting, signed in, folders to fetch, fetching each folder, done.
• 2026-10-23 — Automatic setup found nothing for Gmail and the error named only three sources. Discovery now consults Mozilla's ISPDB and probes the first MX host, and the error lists every source tried with a hint for providers that need an app password.
• 2026-10-23 — Saved passwords were not reused. Auto-configuring an address that already had an account asked for the password again, and re-adding could create a twin account. The saved password is reused when the field is left empty, and an existing account is refreshed in place.
• 2026-10-23 — XOAUTH2 accounts could not be saved, and editing a new account offered "save changes". Validation now follows the sign-in mode, and the editing state comes from the stored record instead of the form.
• 2026-10-23 — HTML mail rendered an empty body. The engine read the IMAP text part through the wrong fetch accessor; it now reads the message as sent and decodes MIME (quoted-printable, base64, multipart) before storing.