Private email for every device, at any scale.
Programmable, privacy-first email built for individuals, automation, and large-scale device fleets.
Create an email address in seconds, pair a device by scanning a code, and manage every address and device you own from one account. Your mail is sealed with a key we never hold.
Nothing to sign up with · Free tier, no card · Unlimited devices on every paid plan
The same Mailcycle at every size.
The account that holds your one private address is the account that provisions a thousand devices.
1address
A private address of your own, created in seconds.
10devices
A phone, a laptop, a few test handsets, all on one account.
100devices
Tagged, searchable, managed in bulk from one console.
1,000+devices
A fleet provisioned and controlled by one Operator.
Built for one address. Capable of ten thousand.
Five ways to use the same product.
Individuals
A private email address. Create one and read your mail.
Read moreDevelopers
Programmable email for applications and workflows. The console runs on the same API you get.
Read moreAutomation
Email addresses for automated systems, test environments and processes that need to receive real mail.
Read moreTeams
Manage email identities across devices and workflows from one account. Several people on one account is planned.
Read moreDevice fleets
Provision and control email addresses across hundreds or thousands of connected devices. Devices need no accounts.
Read moreOne platform. Every inbox. Every device.
See all five in detailOne place to manage every device and email address.
Mailcycle runs in one of two roles: the Operator who owns the account, or a Worker device attached to it.
Operator
The account, unlocked with the recovery phrase. An Operator manages devices, email addresses, assignments, plans, usage and account settings, and reads the mail for any address remotely, from a phone or a desktop.
Worker
A connected device or browser that receives mail for one or more email addresses. Scan, connect, assign. A Worker has no user account or password. It holds a credential scoped to that one device, and can be revoked without affecting the rest of the fleet.
How a device joins an account
Worker device
Opens Mailcycle, shows a code
QR or pairing code
Scanned or typed, single use
Operator
Confirms the device on the account
Address assigned
One address, or several
Ready
Mail arrives on the device
The handshake is modelled on the OAuth device flow. Pairing codes work once and can be cancelled, an unclaimed code is cleared after 14 days, and a credential is minted only after you confirm the device.
Everything a thousand devices needs, and nothing a single mailbox doesn't.
Instant addresses
Create an address in seconds and assign it or leave it unassigned. One action in the console, one call over the API.
Device pairing
Connect a device with a QR code or an 8-digit pairing code. The device needs no account or password.
Centralized management
Devices, email addresses, assignments, plans and usage all live in one Operator account, on any platform.
Several addresses per device
Assign one email address to a Worker, or several on Personal and above. Plans count addresses, not devices or seats.
Built for scale
Search, tag and filter the fleet, select many devices at once, and disable, enable or remove them in one action on Operator and above.
Cross-platform
iOS, Android and the web, from one codebase. A device that cannot install an app pairs in the browser.
The four decisions everything else follows from.
The architectural choices behind Mailcycle's privacy, and what each one costs.
Your account is twelve words
There is no sign-up form. Your device generates 128 bits of entropy, turns it into a twelve-word recovery phrase, and derives an opaque account id and a public key from it. Signing in answers a challenge against that key. The phrase and anything that opens the account never leave your device.
What it costs: we can't reset your account. If you lose the phrase, the mail is gone. The first sign-in on a new device takes about 40 seconds.
Mail is sealed before it is stored
Each email address has its own public key, derived on your device from your phrase. Our mail server seals every incoming message to that key before storing it, and only your devices hold the private half. Address labels and device names are encrypted on your device before we see them.
What it costs: a message is readable in our mail server's memory for the moment it takes to seal it, and server-side search is impossible. Searching runs on your device.
Trackers never fire
Remote content in mail is never fetched. Your device strips tracking pixels before it shows a message, and tells you what was removed and which host wanted it.
Deletion is the default state
Every email address has a retention window of 24 hours, 7 days, 30 or 90 days. An hourly sweep deletes mail past it; nothing is archived. Deleting your account erases its mail and devices immediately, with no grace period.
Some metadata is unavoidable, so we reduce it: device activity is rounded to the hour, and email addresses end in a random token, not your name. On Scale and above you can choose the whole name. The full architecture is written up here, including what we can still see and the design's limits.
If it can be done in the console, it can be done over the API.
Mint email addresses, list and patch devices, assign and reclaim addresses, read mail, send from addresses you own. Every screen in Mailcycle is built on the same HTTP API, authenticated with a session from the recovery-phrase handshake.
iOS, Android and the web.
One product, three platforms. Devices that cannot install an app run Mailcycle in the browser and pair the same way. The iOS and Android apps are not in the stores yet. The web app works on phones.