My Mission

I built GravesMail because I was tired of email providers scanning my messages, tracking when I read them, and selling my data to advertisers. I wanted an email client that treats my email as mine — stored on my computer, analysed locally, never uploaded anywhere.

GravesMail is my answer to that. It’s a privacy-first email client that uses IMAP purely as a transport layer. Your email is downloaded to your machine, analysed by a 7-layer spam and malware detection engine running entirely on local compute, and then deleted from the provider’s server if you choose. No cloud service holds your mail. No analytics, and no tracking of how you use the app. No third party gets access to your messages.

GravesMail has no telemetry. Your mail travels only between your computer and your own mail server, and nothing about you or your mail is sent to me or to anyone else.

I’m one developer building this because I believe email privacy shouldn’t require a subscription or a PhD in security. GravesMail is available on Windows, macOS, Linux, iOS, and Android.

How GravesMail Started

GravesMail was never supposed to exist. It was born out of frustration, after every other option had been tried and failed.

First, I Asked the Email Providers for Help

It started the way most people would start. I contacted the major email providers — the companies whose platforms carry billions of messages every day — and asked them to do more. My inbox was being flooded with spam, and much of it wasn’t just unwanted marketing. It was malicious. Phishing attacks. Fraud attempts. Messages that were flat-out illegal for the sender to have sent in the first place.

I asked the providers to step up and protect their users. Not a single one responded. Not one.

Then, I Went to the Authorities

I contacted law enforcement and cybercrime agencies at every level I could reach — local, county, city, state, federal, and international. I didn’t just file vague complaints. I did the investigative work myself. I traced the bad actors to specific addresses, specific buildings, specific people. I found their names, their phone numbers, their social media profiles. I collected forensic data and laid out exactly what they were doing, step by step, in detail that would hold up as digital evidence.

Almost nobody responded. The few who did took no action. The evidence sat there, untouched.

Then, I Went After the Bad Actors Myself

I scanned their infrastructure. I traced their IP addresses and mapped their operations across data centres and cloud services. When they moved, I followed. I chased them from one hosting provider to another. But that’s the problem with playing defence against people who have nothing to lose — they just keep moving.

Finally, I Realised the Only Answer Was to Build Something

The providers won’t help because it doesn’t make them money. Law enforcement can’t or won’t act because the problem crosses too many borders. Confronting the criminals directly is an endless game of whack-a-mole. None of these approaches solve the problem.

So I sat down and asked a different question: What if the technology itself made spam and phishing obsolete?

Spam exists because it’s cheap to send and enough people fall for it to turn a profit. If you can break that equation — if the messages never get seen, never get clicked, and never generate a single cent of revenue — the economics collapse. The criminals don’t stop because someone asked them to. They stop because they can no longer afford to operate.

That’s the idea behind GravesMail. Every installation learns the spam its own user receives and stops it before it is seen. The more GravesMail spreads, the more expensive it becomes for bad actors to succeed.

They die by cost.

What I Believe