Insights

Notes from the build floor.

How we think about privacy, infrastructure, and shipping. The thesis behind the work — sanitized so we can talk about it without exposing client systems.

Get new posts in your reader of choice — subscribe instructions.

Architecture2026-04-2711 min read

What plausible deniability means in our architecture

We named the company after a phrase. Most privacy products sell hiding; we sell unreliability. What that buys, and the lines we will not cross to ship it.

Engineering2026-04-2710 min read

Why we're building Thundercrab

Consumer mail clients replaced an open filtering standard with ML categorization nobody can read, edit or carry between providers. We build the alternative.

Architecture2026-04-279 min read

Provable-by-construction privacy

Two ways to promise to protect data: a policy you trust, or a property the type system enforces. We pick the second where the engineering allows.

Operating Model2026-04-277 min read

How a written-down doctrine changes what "shipping" means

We wrote our taste down. Every public function carries a BUG ASSUMPTION annotation, every defense a SECURITY annotation, and CI enforces both.

Architecture2026-04-268 min read

Federated rule learning, without ever reading your mail

How sorting rules get smarter from the collective without any provider — us included — ever seeing message content. What we built, and why it matters.