Encryption and sealed data

Mail is sealed the moment it reaches Mailcycle, and the server cannot open it after that. Content is sealed with keys derived from your recovery phrase, and no key that opens it is ever stored on the server.

Sealed

These come back from the API as sealed blobs:

Message content: sender, subject, body and attachment details.
Attachment bodies.
Address labels, in meta.
Device names, tags and notes, in profile.
API key names, in meta.
Support requests: every subject and message, sealed twice on the device that wrote it, to the account’s support key and to the support team’s. See Support.

Incoming mail is sealed by the mail server to the address’s public key as soon as it arrives. The copy of a sent message kept in the Sent folder is sealed the same way before it is stored. Only the matching private key opens it, and that key is derived from the recovery phrase on a device. Labels and names are sealed on the device with a key only the account’s devices hold.

In the clear

Some things cannot be sealed, because the service has to act on them:

Email addresses, because a mail server has to read the envelope to deliver.
When a message arrived, how big it is, whether it has been read, which folder it is in and whether it is starred. For sent mail, sentVia: whether it went from the app, an API key, a device, an agent or a team member.
Retention settings, because the server enforces deletion.
A device’s platform and when it was last active, to five minutes, stamped by the server.
For support requests, which account wrote, when, who wrote each message, and whether the request is open.
Plans, dates and payment records.

What this means for your code

There is no server-side search over message content and no ?q= parameter. Search in your client, after decrypting.
Opening sealed content needs keys derived from the recovery phrase. The easiest way is an SDK (TypeScript, Python, Go, Rust, Swift, PHP, Java, .NET or Ruby), which derives the keys on your machine and opens mail, labels and attachments. Without one, a script can manage addresses, devices and metadata, or implement the encryption format itself.
The server cannot help if the recovery phrase is lost. Nothing it stores can recover the keys.