What Letos is built on

Example

Mail search is purely local. We know it's a limitation — if you have ten years of mail sitting on a server, Letos only finds what's already downloaded to the device. A server-side index would fix that in an afternoon. We won't build it. It gets solved another way instead — through download scope and retention — a slower road to the same destination, but without breaking the promise. It's the same reason the web app has tasks and calendar but not mail: mail on the web would mean IMAP running on our server.

In practice

Every new feature gets asked "what has to leave the device for this to work?" If the answer isn't "nothing, or an encrypted blob," the proposal gets reworked, not shelved for later. That applies to AI too: it runs on your computer, or only with your explicit confirmation in a dialog.

What we will never do

Sending user data to a third party secretly or by default (analytics with content, a cloud AI "just as a fallback", a crash report with a message body). External AI may only exist as an optional feature you switch on yourself and confirm in a dialog.

Example

Local AI is in the free plan — and it isn't a taste. Thread classification, thread/day/week summaries, replies drafted in your own style, tone rewriting, email → task, action-item extraction, subtask suggestions, smart snoozing, natural-language quick capture and voice input — all of it free. Competitors turn that into three pricing tiers because every call is their variable cost. Our AI runs on the customer's own hardware, so there's nothing to charge for. What you pay for is sync, extra devices, and attachment storage — and a second mailbox, because a second mailbox means a work tool, not personal use.

In practice

We will never charge for these, even if fewer people pay for Letos: local AI, any of the three modules, the yearly layer and home screen, local history, full-text search, working offline, the interface for AI assistants.

What we will never do

Locking any of that list behind a paid version — or, the opposite mistake, justifying a paid item with "competitors charge for it too".

Example

The inbox is virtualized, triage has a five-second undo window with an optimistic hide and a delayed commit — you never wait on the mail server. The module switcher has no router, because a router would add a frame. Double-clicking a thread opens a native window, not a modal. The "Letos" home screen has to render from the local database before a loading spinner even has time to appear — otherwise it isn't a home screen.

In practice

"It works" isn't done until it works without visible waiting. A latency regression gets treated as a bug, not deferred as debt.

What we will never do

Adding a dependency that doubles the app's size for the sake of polish.

Example

An earlier piece of research claimed that connecting to Gmail required a paid security audit every year. We asked "really?" and the answer from the primary source was: no, not for a client that keeps mail on the device. One unverified line would have cost hundreds of dollars a year and a bad decision. The same standard applies outward: when something doesn't work with a particular mail server, we say so, instead of hiding behind "we support all IMAP servers."

In practice

Every change gets an independent verifier (a test, another person, another tool). Self-reporting never closes the loop. A marketing claim needs something to point to.

What we will never do

Calling something done without proof — twice.

Example

The sync server is simple, simply deployed, and configured with a single file. Not because more elaborate infrastructure is out of reach, but because at 3am it has to be fixed by one tired person following their own documentation. Launching on five platforms at once is a deliberate tension with this value — which is why we have an explicit order of what drops first if the deadline pushes back.

In practice

Every proposal gets costed in support-minutes per customer per month. If a feature raises that budget, something else has to save the same amount elsewhere.

What we will never do

Shipping a feature whose operation depends on "we'll somehow handle it by hand for now."