Frequently Asked Questions

It's not the framework. It's the engineering.

Electron gets a bad reputation, and some of it is deserved. But the framework itself isn't the problem; lazy engineering is. VS Code, Slack, Discord, Figma, and Notion are all built on Electron, and millions of people use them daily without complaint. The difference is in how you build on top of it.

Box is performance-engineered from the ground up. Virtualized message lists mean only the visible rows are rendered, no matter how large your mailbox is. Aggressive caching keeps repeated views instant. A dual IMAP connection strategy handles sync and user-initiated operations in parallel without blocking. And because there's zero telemetry, there's zero telemetry overhead. No background analytics, no tracking payloads, no wasted cycles phoning home.

The result is a desktop email client that idles at around 250MB of RAM (roughly 20% less than Thunderbird on a typical Ubuntu install) and launches fast. That's not an accident; it's the result of careful architecture decisions and constant profiling.

We didn't choose Electron and hope for the best. We chose it and then did the work.

Sustainability over ideology.

Because sustainability matters more than ideology. Open source is wonderful, and Box depends on a huge number of open-source projects. But building and maintaining a polished desktop email client takes sustained effort, and that effort needs to be funded.

Box offers a generous free tier: one account, full functionality, no time limit. If you need multiple accounts, the license is $10 once, not a subscription. That one-time purchase funds continued development, bug fixes, and new features.

We have deep respect for the open-source ecosystem and contribute back where we can. But we believe the best way to keep Box alive and improving is to build a product good enough that people are happy to pay for it. And at $10 once, with no subscription, it costs less than your last trip to Starbucks.

You don't have to.

Box is free for one email account with full functionality. No trial, no feature restrictions, no expiration. If one account is all you need, you never pay a cent. If you need multiple accounts, the license is $10. Once. No subscription, no renewal, no upsell.

Thunderbird and Evolution are solid projects with decades of history, and if either one is working well for you, there's no reason to stop using it. We're not here to talk anyone out of a tool they're happy with. But if you've ever wished your email client felt more modern, looked a little sharper, or took privacy more seriously out of the box, that's exactly the gap we built Box to fill.

It's a different kind of email client: cleaner, faster, and designed with care from the ground up. The best way to see if it's for you is to try it.

Box doesn't need us to keep working.

We have no intention of abandoning Box; we use it every day. But even if we did, your email client wouldn't skip a beat.

Box has no cloud dependency. Your email is stored locally in SQLite. Your credentials are in your OS keyring. Box connects directly to your mail servers and nothing else. There is no Box server sitting between you and your email.

There's no subscription to lapse and no remote kill switch. Box checks in with the licensing server every 14 days to catch revocations, but if the server is unreachable, the check is silently skipped and your app continues functioning normally. Your license token is verified locally on each launch using an Ed25519 cryptographic signature with no expiration date. If the licensing server disappeared tomorrow, every existing license would keep working with unlimited accounts, indefinitely.

Even in a worst-case scenario where development stops entirely, Box would continue to function as a fully capable email client for as long as your mail servers support standard IMAP and SMTP. That's not a promise; it's how the architecture works.

If it runs Linux, it runs Box.

Any modern Linux distribution. Box is distributed as an AppImage, which runs on virtually every Linux distro without installation. Just download, make it executable, and run. This includes Ubuntu, Fedora, Debian, Arch, Linux Mint, Pop!_OS, Manjaro, openSUSE, and many others.

A .deb package is also available for Debian-based distributions if you prefer a traditional dpkg install.

If you run into issues on your specific distro, reach out to us and we'll do our best to help.

Don't take our word for it. Check for yourself.

Email is inherently private. Who you write to, what you say, and when you read it is nobody's business but yours. Box is built on that principle, and we've made it verifiable.

Box includes a built-in Connection Log that shows every outbound connection the application makes, in real time. It's not buried in a debug menu; it's a first-class feature. Open it anytime and see exactly who Box is talking to: your mail servers, and nothing else.

For those who prefer external auditing, run ss, netstat, Wireshark, or nethogs while Box is running. You'll see connections to your configured mail servers and, during license activation or periodic license validation, a request to our licensing service, Locksmith (locksmith.buxjr.com). That's it. No analytics endpoints. No telemetry servers. No mystery traffic.

This isn't a privacy policy that could be reversed with a config change. There is no telemetry code in Box because none was ever written. No analytics SDK, no usage reporting, no crash reporting that phones home. The absence is structural, not a setting we promise to leave off.

Read the full details in our Privacy Architecture.

The minimum necessary, and nothing more.

When you activate a license, Box sends your license key and a machine identifier to Locksmith (locksmith.buxjr.com), our licensing service. Locksmith validates the key, generates a signed token, and returns it. Box stores that token in your OS keyring and verifies it locally on each launch using an embedded Ed25519 public key. No network connection required after activation.

Every couple of weeks, Box performs a brief check-in with Locksmith. This exists for two reasons: to catch user-requested license revocations, and to detect stale machines so that if a device is ever lost, stolen, damaged, or reinstalled, that seat is automatically freed up for you. Each license supports up to 5 machines, and stale machines are automatically released after 90 days of inactivity.

These check-ins send only your license key and machine identifier. No email content, no credentials, no IP address logging, no usage data. If Locksmith is unreachable, the check is silently skipped and Box continues working normally with all your accounts.

For the full technical breakdown, see our Licensing Transparency page.

Box doesn't disappear when your connection does.

Yes. After the initial account setup and sync, Box works fully offline. All your email data is stored in a local SQLite database, so you can read, search, and browse your messages without a network connection.

If you compose or reply to an email while offline, it goes into the outbox and sends automatically when connectivity returns. Folder operations and flag changes are queued in a deferred sync system that retries gracefully when your connection is restored.

Licensing also works offline. Your license token is verified locally on each launch using an Ed25519 cryptographic signature. The periodic Locksmith check-in is silently skipped when there's no connection, and Box continues working normally with all your accounts.

Your data, your disk, your rules.

Everything Box stores lives in ~/.config/Box/. The main database is a standard SQLite file at ~/.config/Box/box.db that you can query directly with sqlite3 anytime you want. Your email account credentials and OAuth tokens are encrypted using your OS keyring via Electron's safeStorage, and the files on disk are locked to your user account with 0600 permissions.

Nothing is ever uploaded, synced to a cloud service, or accessed by anything other than the Box application running on your machine. You can back it up, inspect it, or delete it. It's your data.

Copy a folder. That's it.

Your entire Box installation lives in ~/.config/Box/. Back up that directory and you've backed up everything: your email database, settings, contacts, and trust center preferences.

Box also has a built-in configuration export that creates a .boxconfig file containing your settings, accounts, contacts, and trust center data. This makes it easy to move to a new machine. Passwords and OAuth tokens are excluded for security; you'll re-authenticate each account on the new device.

Your actual email is always on your mail server. When you add an account on a new machine, Box syncs everything down over IMAP. Nothing is lost.

Yes, for the providers that require it.

Gmail, Google Workspace, Outlook.com, and Office 365 all use OAuth2 for authentication. Box handles the entire flow natively: it opens your browser, you authorize access, and Box receives the token via a local callback. No passwords are sent through Box for these providers, and tokens are refreshed automatically.

For providers that still support traditional authentication, Box uses your credentials stored securely in your OS keyring. All IMAP and SMTP connections are encrypted with TLS/SSL.

If it speaks IMAP, Box speaks to it.

Box ships with 32 preconfigured provider presets including Gmail, Outlook, Yahoo, iCloud, Fastmail, ProtonMail Bridge, Zoho, Mailbox.org, Posteo, GMX, Web.de, Yandex, and many more. When you enter your email address, Box auto-detects your provider and fills in the server settings for you.

If your provider isn't in the list, you can configure any standard IMAP/SMTP server manually. Self-hosted setups like Postfix, Dovecot, Mailcow, and Mail-in-a-Box all work perfectly. If it supports IMAP and SMTP, Box can connect to it.

Not even close.

Box is not a browser window pointed at a webmail interface. It connects directly to your mail servers using standard IMAP and SMTP protocols, stores your email in a local SQLite database, and renders everything natively. There is no web service in the middle.

Box is built on Electron, which uses Chromium for rendering the UI, but the application logic, email syncing, search indexing, and security features are all custom-built. It's a full desktop application that happens to use web technologies for its interface, the same approach used by VS Code, Slack, and Discord.

You're always in control.

Box checks for updates periodically in the background. When a new version is available, you'll see a notification with the release notes. Updates are never forced or applied automatically; you decide when to download and install. You can also browse all releases on GitHub.

Your settings, accounts, email database, and license are all preserved across updates. Nothing changes except the application itself.

You probably don't need to.

Box syncs your email directly from your mail server over IMAP. If your previous client was connected to the same account, all your email is already on the server waiting. Just add your account to Box, and everything syncs down automatically: messages, folders, flags, read status.

There's no need to export from Thunderbird or Evolution and import into Box. Your mail server is the source of truth, and Box connects to it directly.

Yes. Per-account, with drag-and-drop reordering.

Each account has its own set of inbox rules in Account Settings. Rules follow an IF/THEN structure: match on sender name, email, domain, subject, or body content, then route the message to any folder, spam, or trash. Rules are evaluated top to bottom and first match wins, and you can reorder them by dragging.

Each rule shows a hit counter so you can see how often it fires. You can also right-click any message or address pill and choose "Create Spam Rule" to set one up instantly with the sender's details pre-filled.

Yes. Box builds your address book for you.

Contacts are created automatically from the people you email and receive email from. You can browse them in three tabs: Contacted (people you've written to), All, and VIP. Each contact tracks engagement data like how many times you've corresponded and when, and you can add notes, edit details, or mark people as VIP.

Contacts feed directly into the compose window's autocomplete, so addressing emails is fast and accurate. A cleanup utility lets you remove stale or auto-generated contacts in bulk.

Yes. RFC-compliant, one click, done.

Box detects the standard List-Unsubscribe and List-Unsubscribe-Post headers that mailing lists are required to include. When one is found, a notification bar appears at the top of the message with a single unsubscribe button. It tries the most reliable method first (one-click POST), then falls back to mailto or HTTPS GET.

No more hunting for tiny gray links buried at the bottom of newsletters.

More than you'd expect.

Box supports Light, Dark, and Auto themes. Message list density can be set to Compact, Comfortable, or Spacious. You can choose any installed system font for email display with adjustable font size (8-24px). Preview snippets, date separators, and unread badges are all toggleable.

Sound effects are fully configurable: 53 built-in sounds across categories like mechanical, sci-fi, gaming, and animals, assignable to four events (new mail, sent, deleted, moved). Resizable panels remember their sizes across sessions, and window position is persisted on restart.

Enter your email. Box fills in the rest.

Box ships with 32 preconfigured provider presets covering the major providers (Gmail, Outlook, Yahoo, iCloud), privacy-focused services (ProtonMail Bridge, Fastmail, Mailbox.org, Posteo), regional providers (GMX, Web.de, T-Online, Orange.fr), US ISPs (Comcast, AT&T, Spectrum), and hosting platforms (GoDaddy, IONOS, DreamHost).

When you add an account and enter your email address, Box detects the provider and auto-fills the IMAP/SMTP server settings, ports, and encryption type. For providers not in the list, full manual configuration is available with support for TLS, STARTTLS, unencrypted connections, and self-signed certificates.

We'll resend it.

Contact us with the email address you used when purchasing and we'll send your license key again. Your license is tied to your purchase record, not a specific email, so recovery is straightforward.