Multi-account email, without the model in the middle.

Canary Mail and Epistles share a lot of shape. Both are multi-account clients on multiple platforms, both sell themselves on privacy, and both have to make hard architectural calls about where your mail goes. The place the two products genuinely diverge is what they do, and don’t do, with artificial intelligence.

What Canary does well

Canary is a mature, multi-platform mail client. It runs on macOS, iOS, Android, and Windows, with a single license covering all of them and up to five devices on the paid tiers. It speaks to Gmail, Outlook, Office 365, Exchange, iCloud, Yahoo, Zoho, and ProtonMail, and the unified inbox across all of them is the feature that has carried the product for years. For someone juggling a personal Gmail and a work Microsoft mailbox on a phone and a desktop, Canary has been a credible answer for a long time.

The product’s second commitment is to a particular vision of AI in email. Canary’s Copilot composes drafts in your voice, summarises long threads, categorises mail automatically, and offers an AI-assisted search across the inbox. Whether or not you want any of that in a mail client is a question of taste, but the work is real, the features are shipping, and the team has been refining them for several releases.

Canary also ships native PGP for end-to-end encryption between users who have keys, and a separate SecureSend mode aimed at HIPAA-style compliance use cases. The PGP work predates the AI push and remains one of the more accessible PGP onramps in a consumer mail client.

Where the products diverge

Canary’s thesis is that AI is a productivity multiplier and the inbox is where it pays off. To deliver Copilot, summaries, and AI search, some portion of the message content has to be available to a model provider at the moment of inference. Canary’s public materials do not detail which provider, on-device or cloud, processes which feature, and that opacity is itself a design choice we want to name plainly rather than read minds about.

Epistles makes the opposite call. There is no Copilot, no AI compose, no AI summary, no AI inbox triage, and no plan to add any of them. The reason is not that we think the technology is uninteresting. It is that the rest of the product, a local-first SQLite cache encrypted at rest, and a zero-knowledge Cloud Vault that holds account credentials in ciphertext we cannot decrypt, only works if mail content does not get forwarded to a model. The architecture and the feature set have to agree. We picked the architecture, so the feature set follows.

A user who genuinely wants AI summaries of their mail should use Canary, or one of the other clients that have made that bet. A user who wants their mail to stay between them, their provider, and their own device should not.

What Epistles ships that Canary doesn’t

A native Linux build. Epistles ships a signed .deb and self-hosted APT, DNF, and Flatpak repos built on Tauri 2, with the same engine and the same vault as the macOS app. Canary’s site lists macOS, iOS, Android, and Windows; Linux is not among them.

ProtonMail without Bridge. Epistles connects directly to Proton’s API, performs OpenPGP decryption on device, and stores the mailbox passphrase in the OS keychain only. There is no separate Bridge process to install, run, and keep alive in the background. Canary lists ProtonMail as a supported provider, and the public site does not say which path it takes; the practical effect for the user is one less moving part in our case.

A zero-knowledge Cloud Vault for cross-device sync. The credentials for every account you connect, OAuth refresh tokens, IMAP passwords, JMAP session blobs, are wrapped on your device with a key derived from your Epistles password and stored on our servers as opaque ciphertext we cannot read. Sign in on a second machine, type your password once, and the inboxes are already there. Per-device account setup is not a step you have to repeat.

No telemetry. Zero analytics SDKs, zero crash reporting SDKs, zero metrics pipelines. The only network calls Epistles makes to our own infrastructure are functional ones, vault sync, push relay, support form submissions, and we publish what they are.

An open-source intent. Epistles is built in the open and the core engine is licensed for community inspection and audit. Canary is closed source.

Where Canary wins

Canary ships AI features that Epistles does not, and will not. If your working week genuinely benefits from a model summarising long threads or drafting replies in your voice, Canary delivers that today and Epistles never will. That is a real choice, not a feature gap to be closed later.

Canary also ships a Windows build today; ours is in development and honest about the wait. And Canary is the older product, so the long tail of small refinements, rules, integrations, contact profiles, custom thread actions, is more developed. A younger application has not had time to match all of those.

The matrix, plainly

Platforms shipping today

Canary: macOS, iOS, Android, Windows. Epistles: macOS, Linux, iOS, Android. (Epistles Windows and web in development; Canary does not list Linux.)

Email providers

Canary: Gmail, Outlook, Microsoft 365, Exchange, iCloud, Yahoo, Zoho, ProtonMail. Epistles: Gmail, Microsoft 365, Fastmail (JMAP), ProtonMail, IMAP/SMTP.

AI features

Canary: AI Copilot, AI compose, AI summaries, AI categorisation, AI search. Epistles: none, by design.

Local-first storage

Both clients store mail on the device and work offline. Epistles relies on your operating system's disk encryption (FileVault, BitLocker, Data Protection, FBE) for the local SQLite cache, the same model the security page describes.

ProtonMail support

Canary: listed as supported; path not specified publicly. Epistles: direct Proton API with on-device OpenPGP, no Bridge.

Cross-device account sync

Canary: per-device account setup. Epistles: zero-knowledge Cloud Vault wraps account credentials under your password and carries them between devices.

Pricing

Canary: free tier with limits, Growth $36/yr, Pro+ $100/yr (PGP and SecureSend live in Pro+). Epistles: free for 3 accounts, $35/yr Pro for unlimited, 15-day trial with no card.

Open source

Canary: closed source. Epistles: open-source core.

Telemetry

Canary: not specified publicly. Epistles: zero analytics, zero crash SDKs, zero metrics; only functional API calls, documented.

Who should pick which

If AI in your mail client is something you actively want, a Copilot that drafts replies, summaries that compress a long thread into three lines, a smart-search that understands intent, then Canary is built for that and Epistles is not. Pay for the tier that includes Copilot and use Canary. We are not pretending to be a strict superset of a product whose headline features we have intentionally declined to build.

If you want a multi-account, multi-platform mail client whose architecture is honest about where your mail lives, on your device, in a local cache, and with credentials wrapped under a key only you hold, then Epistles is the answer. The absence of AI is part of why the rest of the architecture can make the promises it makes. Pulling on one thread would unravel the others.

If you read mail on Linux, the choice is forced today: Canary does not ship there and Epistles does. If you read mail on Windows, the choice is also forced, in the other direction, while we finish that build.

A line at the end

Canary and Epistles are different answers to the same question about what an email client should be. Both answers are defensible. We picked ours and we are willing to live with the consequence, which is that we will not be the client people pick for AI features. If a quiet, native, multi-account client without a model in the middle is the shape of the thing you wanted, our front door is here.