Curo

Universal mailbox — Gmail OAuth, Microsoft Graph, or any IMAP account auto-detected, with per-mailbox signatures, Cc/Bcc/from-override, scheduled send, templates, and history backfill

AI triage engine — scores every email 1–10, assigns a category, and drafts a reply; deterministic filters kill bounces and phishing before any token is spent

Voice Engine — deterministic linguistic analysis of your real sent mail builds a shareable Voice Card; a privacy invariant guarantees shared cards carry only derived numbers, never message content

Smart views — a Commitment Ledger that extracts promises and auto-detects fulfillment, a Ghosting Radar, a HEY-style first-contact Screener, and private auto-unsubscribe with no list-server ping

Encryption at rest — Fernet AES-128 protects OAuth tokens, IMAP passwords, and voice snippets (23/23 stored credentials verified to decrypt clean)

Hardware-key security — TOTP and WebAuthn, a Zero-Access Vault, E2EE secure messages with a Trust Center, and OpenPGP mail-to-mail, behind full HTTPS/HSTS headers

Honest data posture — message bodies sit plaintext in Postgres to power AI and search, protected by transport, OS, and localhost isolation rather than at-rest column encryption (disclosed, not overclaimed)

Owner console — a 1,846-line, 401-gated back office showing live spend by provider and model, unit economics per user and per 1k emails, margin and 10x/100x projections, and tenant lifecycle

Billing — LemonSqueezy merchant-of-record with Free, Pro, Power, and Team tiers, an HMAC webhook that fails closed, and plan-to-feature gating

Calendar sync — working Google (syncToken), Microsoft (delta), and CalDAV engines plus Calendly-style bookable links and .ics export

Native mobile shell — a Capacitor iOS + Android app with native push wrapping the web client; built and drafted for the stores, store submission pending