Global Chat Mailbox
Your mail, as a conversation. On your machine.
An email client for the mailboxes you already own. It renders threads as chat, keeps everything in a local store so it works offline, and connects straight to Microsoft 365 or Gmail. There is no GlobalOrizon server in the middle — we never receive your mail, and could not produce it if asked.
What it
does
The mailbox
Threads as conversations
A mail thread renders as a chat, not a stack of quoted replies. The same messages, read the way you already read everything else.
Microsoft 365 and Gmail
Connect the mailboxes you already own. Nothing above the provider layer knows which provider it is talking to, so both behave identically.
Works offline
Conversations, messages, attachments and drafts are held in a local SQLite store with its own search index, so your mail is there when the network is not.
Where it runs
No server, no shared database
There is no backend to breach. Each person installs the app and signs in as themselves; mail moves directly between the device and the provider.
Your machine, your files
A single local folder holds the cache and the encrypted tokens. Delete it and every account is signed out; uninstall and nothing is left behind.
Desktop, built on Electron
Electron 44 ships Node 24, whose built-in SQLite means no native modules to compile and no rebuild step. Mobile slots in behind the same interface.
Security by construction
Your password is never typed here
Sign-in happens in your own browser through OAuth authorization code with PKCE (RFC 8252). The app receives a token; it never sees a password.
Tokens encrypted by the OS
Refresh tokens are sealed with DPAPI on Windows and Keychain on macOS. Where OS encryption is unavailable they are not written to disk at all.
The UI holds no keys
The renderer never sees a refresh token, never contacts a token endpoint, and reaches the database only through named bridge methods.
Mail you can trust to open
Every message sanitised
Email HTML is attacker-controlled by definition. All of it passes through DOMPurify before a single pixel renders.
Remote images blocked
Images stay blocked until you ask for them. Loading them silently tells the sender that you opened the mail, and exactly when.
A readability pass
Layout tables are unwrapped, tracking pixels and hidden preheaders dropped — guarded, so a message that would be stripped to nothing keeps its sanitised original.
Stays on
your device
Everything the app knows lives in one folder on your own machine. Nothing is transmitted anywhere except to your email provider. Deleting that folder signs every account out and clears the cache; the app rebuilds it the next time you sign in.
Exactly what
it asks for
Delegated permissions only. The app reads the mailbox of whoever is signed in, with exactly their rights, and nobody else’s.
Microsoft
Any work, school or personal account
- User.Read
- Mail.ReadWrite
- Mail.Send
- offline_access
gmail.modify rather than readonly — marking a thread read is a write
- gmail.modify
- gmail.send
- userinfo.email
- userinfo.profile
Read it, fork it,
run it yourself
The whole client is public under the MIT licence. Every claim on this page — the local store, the sanitiser, the token handling — is something you can go and check for yourself rather than take on trust.
View source on GitHub- Incremental sync using delta tokens and historyId, replacing today's full refresh of the recent window
- Settings — theme, retention window, clear cache
- An outbox worker, so mail queued offline sends on reconnect
- Gmail forwarding with attachments, which needs the MIME tree rebuilt by hand
- iOS and Android, behind the same local-store interface
No server. No tracking. No copy of your mail.
Read how we handle your data — or read the code that does it.