Field Notes

Notes from the build floor.

How we think about privacy, infrastructure, and shipping. The thesis behind the work — sanitized so we can talk about it without exposing client systems.

Get new posts in your reader of choice — subscribe instructions.

Architecture2026-04-27·11 min read

What plausible deniability means in our architecture

We named the company after a phrase. Most privacy products sell hiding; we sell unreliability. What that buys, where it lands, and the bright lines we won't cross to ship it.

Engineering2026-04-27·10 min read

Why we're building Thundercrab

Modern consumer mail clients replaced an open, auditable filtering standard with opaque ML categorization that users can't see, edit, or carry between providers. We're building the local-first GUI for transparent mail rules — and writing about why nobody else has.

Architecture2026-04-27·9 min read

Provable-by-construction privacy

Two ways to promise to protect data: a policy you trust, or a property the type system enforces. We try to pick the second whenever the engineering allows. What that changes about audits, incident response, and the trade-offs people accept.

Operating Model2026-04-27·7 min read

How a written-down doctrine changes what "shipping" means

We wrote our taste down. Every public function carries a BUG ASSUMPTION annotation; every defense-in-depth carries a SECURITY annotation; CI enforces both. Why we think this is the right pace.

Architecture2026-04-26·8 min read

Federated rule learning, without ever reading your mail

How sorting rules can get smarter from the collective without any provider — including us — seeing message content. A note on what we built and why we think it matters.