Built for macOS 26 Tahoe· Gmail · Microsoft 365 · IMAP
Troxic is a keyboard-first email client written natively in SwiftUI for macOS 26 — for Gmail, Microsoft 365, and any IMAP mailbox. Real Liquid Glass chrome. A split inbox that classifies the sender, not every message. Phishing verdicts on the conversation you’re reading. And AI that runs on your key, or on this Mac — because there is no Troxic server to run it on.
Synced just now · 3 accounts
Live preview — it plays itself until you click in. Then jk move ·e archive · s star ·⇥ lane · ab gatekeeper ·⌘K paletteLive preview — tap a lane or a conversation. The real thing runs on the keyboard.
Every colour in Troxic comes from a resolved ThemeTokens struct — atmosphere, glass tint, accent, split-lane colours, text, separator, star. Views never invent a colour. Pick a theme and the whole page re-tints, because this page reads the same tokens the app does.
In the app: Settings → Appearance, or ⌘K → “Use Ember Theme”.
Chrome uses the macOS 26 .glassEffect APIs with a GlassEffectContainer per cluster — never a faked Material. The list itself is glass now: floating date chips, rows that sit straight on the atmosphere, a concentric selection pad. Message bodies always sit on an opaque reader.
A full-window MeshGradient drifts slowly behind the chrome, with the theme’s accent nebula anchored where that theme wants it — bottom-trailing for Aurora, straight overhead for Noir. Glass needs something to sample.
HTML mail gets an inversion dark reader instead of a white slab. Reduce Transparency swaps every glass surface for a solid card, Reduce Motion stills the atmosphere, and every text pair is checked against WCAG AA in all eight appearances.
Archive, star, snooze, reply, accept, block, jump, unsubscribe — all of it under the home row. Actions apply optimistically and land on the server a moment later; if you change your mind, ⌘Z reverses the exact call that was made, batch or single.
Multi-select with ⇧J/⇧K and one undo covers the whole batch. Selection advances after archive and trash, so a hundred newsletters is a hundred e presses — not a hundred round trips to the mouse. Spotlight knows “Search Troxic for…” and “Compose in Troxic”, too.
Sorting every message forever is a losing game. Troxic decides once, per sender, and remembers. Newsletters land in Other and stay there; people you actually write to are promoted from your own Sent history; strangers wait at the gate.
People. Not automated — no List-Unsubscribe, no Precedence: bulk, not a noreply@ — or a sender you’ve written to before, starred, or pinned as a VIP.
People waiting on you. The last message is inbound, from a human, and you haven’t answered it. Ranked above ordinary unread inside every date group.
First contact. With the Gatekeeper on, an unknown sender waits outside the inbox until you press a to accept or b to block — the person, or the whole domain. ada+news@ is still Ada.
Noise. Newsletters, receipts, notifications. Two or more threads from the same sender collapse into a single bundle row you can expand or archive whole.
Their own folders, sorted by Troxic’s own conservative, sender-based detection. A model may shelve mail in Ads; nothing is ever auto-filed as Spam.
Build a lane from deterministic rules — from, to, subject, label, has-attachment, is-automated, with exclusions, all-or-any — and choose whether it hides matching mail from Inbox and Other. Add a plain-English prompt and Troxic asks your model once per sender, then caches the verdict forever.
/ is an instant local filter with real operators — from:, to:, subject:, label:, tag:, filename:, has:attachment, after:, larger:, is:unread, OR groups and negation — with paged results when the cache runs out.
Troxic already fetches the List-Unsubscribe header, so the Subscriptions pane ranks everything mailing you by volume. It prefers the mailto: target and sends it on your normal compose path. An https: target opens only after you confirm — a silent background fetch is a tracking signal, not a courtesy.
One window, mixed providers, all accounts at once or just the active one. Each connector is hand-written over URLSession — Gmail REST, Microsoft Graph, IMAP with IDLE — and the table says exactly what each can do, because they are not all the same and we would rather you knew.
| Behaviour | Gmail | Microsoft 365 | IMAP / SMTP |
|---|---|---|---|
| Connect | OAuth, PKCE, one restricted scope | OAuth, PKCE, one consent | Host, port, password — in the Keychain |
| Live arrival | History-based sync | Graph delta sync | IDLE when the server advertises it, polling otherwise |
| People | A local directory per account. You add people yourself — from the People workspace or from any address in a message — and edit the contact card. Troxic never imports a provider address book. | ||
| Send as | Primary, plus accepted send-as aliases | Primary, plus SMTP aliases — tenant policy applies | Identities you manage, marked as unverified by the server |
| Export EML / mbox | Yes | Yes | Yes |
| Import EML / mbox | Yes, under gmail.modify | Not for received mail — Graph won’t take it | Yes, via APPEND |
| Server rules & vacation replies | Gmail filters, edited losslessly | Exchange rules and automatic replies | Not in the protocol; Troxic explains instead |
| Calendar | Google Calendar, separate consent | Microsoft calendars, same consent | — |
A manual directory, per account, with a real contact card: labelled phones, emails and URLs, related names, notes, a photo. “Add to People” from any address in any message. Nothing syncs anywhere unless you export it.
Every attachment across every account in one searchable lane, filtered by PDF, image, document or other. space previews it the way Finder does; a double-click does the same.
Provider labels stay provider labels. Tags are local, colour-coded and yours — Work, Personal, Follow up. Both are one ⌘K away, and the sidebar files by drag.
Edit the server’s own filters — Gmail’s or Exchange’s — losslessly. A rule Troxic can’t express stays visible and read-only rather than silently mangled. Automatic replies live in the same pane, per account.
Export a conversation, or a mailbox, as EML or mbox — user-initiated, staged atomically, quarantined. Import with a bounded preflight, dedupe, an explicit destination, and resume if it stops halfway.
Archive on the train. Every mutation is an outbox entry with a retry policy: it lands when the network does, it survives a relaunch, and a stuck provider gets a recovery state instead of a spinner.
Also new: replies dock under the conversation, composed mail gets a format bar, the From picker is just addresses, ⌫ moves to Trash, and one Sync button covers mail and calendar.
Connect Troxic to DFIR Lab and any suspicious message gets an incident responder’s read — headers, authentication results, reply paths, links — on demand, on the conversation in front of you, never as a background scan of your mailbox.
Add your own DFIR Lab key in Settings → Integrations. The shield in the reader — or p — exports the open message as RFC 822 and posts it to api.dfir-lab.ch under your key. The verdict and its reasons come back inline, so you decide before you reply.
From: "Priya Raghavan (ForeGuards)" <accounts@fg-secure-login.com> Reply-To: collect@mailer-relay.ru To: giuseppe@foreguards.com Subject: Action required: re-validate your keychain access Date: Tue, 2 Sep 2026 07:58:12 +0200 Authentication-Results: spf=softfail dkim=none dmarc=fail List-Unsubscribe: (absent) X-Mailer: PHPMailer 6.9 Links: https://bit.ly/3xQ… → fg-secure-login.com/verify (×2)
Suspicious
The verdict is Phishing, Suspicious, Legitimate — or Unknown, when the service can’t say. The check runs only when you press it, only on that message, and the key you added is validated against /health before anything is sent.
Clicking a URL in a message opens a sheet, not your browser. Send that one URL through Safe Browsing before you go, skip it, or cancel — or set link checks to run when a conversation opens. Opening always hands off to your default browser, never the in-app view.
Opening a message never tells the sender you opened it. Every remote reference is blanked before render — quoted, unquoted, srcset, CSS url(), entity-encoded, quoted-printable. The banner says what was withheld and which hosts it would have contacted. Correspondents you write to can be allowed, per sender, and revoked.
App Sandbox, Hardened Runtime, ATS. HTML mail renders in a locked-down WKWebView with no arbitrary JavaScript. Bodies and tokens are never logged; Authorization is redacted. PKCE is S256 only, never plain.
Google gets gmail.modify and nothing broader. Troxic deliberately never requests mail.google.com, which makes the app structurally incapable of permanently deleting your mail — delete moves to Trash, where Gmail can still undo it. Rules, vacation replies and send-as ask for gmail.settings.basic separately, only if you use them.
Troxic has no AI business model, because it has no backend to bill you from. Paste an OpenAI key or pick Apple Intelligence on your Mac, and every request is one you asked for, scoped to one thread, sent with store: false. This is the whole list of what can leave the Mac, and when.
| Feature | What leaves the Mac | When | Cached |
|---|---|---|---|
| Summary line | The messages of that one thread | When you open it, with AI on | Per body fingerprint — reopening sends nothing |
| Brief ⌘⇧B | The thread | When you press it | Yes |
| Inbox headlines | Subject and snippet of the twelve visible rows | Only if you turn it on — off by default | Yes |
| Selection AI ⌘J | The text you highlighted | When you press it | No |
| Write · rewrite · tone | Your draft, and the thread you’re replying to | When you ask | No — drafts come back as editable text |
| My Voice | Up to six recent sent messages, once | When you enable it | The style summary stays on the Mac |
| Ask AI search | Subject, sender and date of up to eighty cached threads | When you ask | No — bodies never leave |
| Lane and split assist | One sender’s headers | When your rules can’t decide | Per sender, forever |
| Anything in the background | Nothing | Never | — |
OpenAI — gpt-4.1-mini by default, gpt-4.1 if you prefer, streamed. On this Mac — Apple Intelligence through FoundationModels, nothing leaves. Automatic picks OpenAI when your key is valid and on-device otherwise. Pick one explicitly and Troxic never substitutes the other — if it isn’t available you get an error, not a quiet upload.
Seven tones — professional, familiar, friendly, concise, empathetic, assertive, neutral — three lengths, and a free-form instruction of your own. Rewrite, shorten, lengthen, proofread. My Voice learns your style from a capped sample of sent mail in one call. Troxic never sends on its own.
Every AI feature stays dark until a key validates against GET /v1/models. The key lives in your Keychain. Spam is excluded from anything a model may assign — it may shelve mail in Ads, never bury it. Sign out and every derived summary is wiped with the cache.
Later today, tomorrow morning, next Monday, in three days, or a date you pick. Follow-ups close themselves the moment a reply arrives — you only hear about the silence.
Set the send delay to 0, 5, 10 or 30 seconds and the toast timeout to 5, 10 or 20. ⌘Z cancels a pending send before it ever leaves the Mac.
Day, work week, week and month grids; drag a range to create an event; RSVP to an invite straight from the reader banner it was parsed out of. Google and Microsoft calendars, and a calendar can be connected without a mailbox at all.
Turn on the companion and Troxic registers as a login item with a menu-bar extra — unread Inbox count, Compose, the next reminder — so a send-later still leaves at 7am whether or not the window is open. Scheduled work fires while Troxic runs and catches up on next launch. Set working hours and new-mail banners sleep outside them.
Spotlight can search Troxic or start a message. A Focus Filter limits notifications to Inbox only, or to one named account. Notifications themselves are Smart, All, VIPs only, or Off — with a Dock badge you scope the same way.
Not “we don’t look at your mail.” There is no mailbox sync, no index, no queue — no place for it to go. Troxic talks to Google, Microsoft or your IMAP server with your own token — or your own password, from the Keychain — and nothing sits in between. Two optional services can each be handed one thread when you ask: OpenAI and DFIR Lab, each under your own key.
IDLE when advertised, TLS requiredThe whole application. SwiftData is the source of truth the UI reads.
Only on an action you took, for the thread you’re in, under your key, with store: false. Or never, if you use Apple Intelligence instead.
Only the message you pressed the shield on, or the single URL you chose to check. Never a background scan of the mailbox.
Disconnecting is real. Sign out revokes the grant and wipes the local mail cache and every derived summary. Your OpenAI and DFIR keys are only deleted if you ask for that too — they’re yours, not ours.
All of this is written down, in full, in the privacy policy — including exactly what each optional service receives and when.
gmail.modifyPlus gmail.settings.basic for rules, vacation and send-as, and calendar.events + calendar.calendarlist.readonly, each only if you use it.Mail.ReadWrite · Mail.SendWith Calendars.ReadWrite and MailboxSettings.ReadWrite, in one consent.
Troxic is in closed testing while Google verification runs. Seats go to people who live in their inbox, love jk, and will tell us when something is wrong.
Requires macOS 26. Gmail seats see an “unverified app” screen on first consent during testing; Microsoft 365 and IMAP accounts connect as usual.