What Alcedo does by default.

Alcedo connects to four kinds of host, and no others:

• Your mail provider. IMAP on port 993 and SMTP over TLS, to the servers you configure. TLS is rustls only; there is no OpenSSL path and no option to skip verification.
• Google or Microsoft, during sign-in. Only if you add such an account. The consent page opens in your system browser using OAuth with PKCE, and the token exchange goes to the provider.
• Hosts named in a message you choose to unblock. If you press Load once on a message, its remote images are fetched from wherever the sender pointed them.
• An AI provider you configured yourself. Only when you press Rewrite in the composer, and only if you supplied a key. See below.

There is no analytics endpoint, no crash reporter, no update check, and no licence server. Alcedo does not contact any domain we control, because it does not need to.

Incoming HTML goes through an allowlist sanitizer before it reaches the renderer. Scripts, embedded objects, form controls, and inline event handlers do not survive that pass. Then two more things happen.

Remote images are off

Every <img> pointing at an http or https URL is removed from the document, and the renderer is told not to auto-load images regardless. A banner tells you the message had remote content. You can load it for that one message.

Tracker pixels are stripped, not deferred

Separately from the remote-image rule, and even when you do choose to load remote content, Alcedo deletes images that look like tracking beacons:

• Any image whose declared width or height is 1 pixel or less.
• Any image whose source matches a known tracker marker: pixel., trk., doubleclick., google-analytics, facebook.com/tr, list-manage.com, mailchimp, sendgrid.net, sparkpost, and mandrill.

An honest limit. That marker list is short and finite. It catches the common commercial beacons, not a determined tracker on a first-party domain sending a 200×100 image. The defence that actually holds is leaving remote images off.

Read receipts and outbound tracking pixels both exist in Alcedo, and both are off. Alcedo will not enable either one on your behalf.

• Read receipts. Outgoing mail carries no MDN request unless you turn it on.
• Outbound tracking pixels. Off, and inert even when enabled until you also supply an HTTPS pixel URL of your own. Alcedo hosts nothing for this.
• Disclosure before send. With either setting on, the composer tells you the message will request a receipt or carry a tracking image before it goes out. You do not find out afterwards.

• Mail, folders, contacts, and calendar data: a SQLite database in your user data directory. Plain local files, yours to back up or delete.
• OAuth tokens and app passwords: the system keyring, through the Secret Service API. Never in SQLite, never in a config file, never in a log.
• Preferences: GSettings, under dev.alcedo.Mail.

The database is not encrypted at rest. It sits behind your user account and whatever disk encryption you already run. Saying otherwise would be a lie, and full-disk encryption is the honest answer here.

When a message contains a one-time sign-in code, the reader lifts it out and offers a copy button. The detection is keyword and pattern matching running in the process on your machine. No message text, and no code, leaves the device for this. There is no service behind it to switch off.

Spell-check runs through Enchant against the dictionaries installed on your system. Same story: local, offline.

Alcedo can ask a hosted language model to rewrite a draft. This is a convenience at the edge of the program, not the point of it, and it is worth being exact about:

• It does nothing until you supply your own API key for Groq, OpenAI, Anthropic, or Gemini. Alcedo ships no key and proxies nothing.
• It runs when you press Rewrite. It sends the draft you are editing to the provider you picked, under your key, subject to that provider's terms.
• It never touches received mail. Your inbox is not indexed, summarised, embedded, or uploaded.
• Nobody trains a model on your mail. Alcedo has no training pipeline and no telemetry to feed one.

Leave the key empty and this entire subsystem stays dormant.

gsettings get dev.alcedo.Mail load-remote-images
gsettings get dev.alcedo.Mail request-mdn
gsettings get dev.alcedo.Mail insert-tracking-pixel

All three answer false on a fresh install. The tracker rules, the sanitizer, and the verification-code detection are a few hundred lines of Rust in the alcedo-html crate, with tests beside them. Alcedo is GPL-3.0-or-later, so you can read every claim on this page in the source and change what you disagree with.

No certifications are claimed. Alcedo has not been through an external privacy audit or a security review, and it is version 0.1.0. What it has is a small, readable codebase and defaults that do not need a settings tour to be safe.