Undertow — FAQ

Answers about the app and service design as currently implemented. Production deployment, retention scheduling, backup handling and provider-side practices still require verification; this FAQ is not a promise of zero retention.

How does Undertow work?

You sign in to Undertow with Apple, then separately connect Gmail on your iPhone with an app password. The phone checks message headers locally, asks which likely publications you approve, and only then relays sanitized newsletter text from those approved publications to Undertow. An editor — a language model working only from those issues — writes four to eight cards, and your phone gets a generic notification when the deck is ready.

Each card is one finding, with its sender, its issue and a link to the original underneath. You swipe up through the deck, and it ends.

What does Sign in with Apple access?

Sign in with Apple identifies only your Undertow account. It does not sign in to Gmail, authorize Google access or expose your Gmail credential to Undertow. Undertow uses Apple's signed account identifier, not a client-supplied email address, as the account identity.

Why a Gmail app password instead of "Sign in with Google"?

Local-relay mode connects directly from your iPhone to Gmail with an app password you generate in your Google Account. The app password is a credential, not a read-only permission scope; the app opens its IMAP session in read-only mode. You can revoke the app password from your Google Account.

The app password is separate from your Google password. Its permissions are determined by Google; do not treat it as a technical read-only scope. Revoke it from myaccount.google.com → Security → 2-Step Verification → App passwords. Your Gmail address and app password are stored in the iPhone Keychain and are not sent to Undertow in local-relay mode.

Undertow currently supports Gmail through this app-password flow.

What actually happens to my email?

• The iPhone opens the mailbox read-only; the feature is not designed to archive, delete, move, label, mark read, reply or send.
• During discovery the iPhone requests headers only. This is a heuristic, not a guarantee; personal messages may be misclassified. Newly discovered publications are not approved automatically.
• Only after you explicitly approve a publication does the phone request bounded text/plain or text/html leaf parts. It excludes attachments, other non-text parts and attached messages, converts accepted content to sanitized plain text, and relays that bounded text to Undertow.
• Imported issue text is stored to make decks. The service code defines a 30-day default, but production cleanup scheduling and configuration must be verified before this can be treated as an operating guarantee.
• To write cards, excerpts of shortlisted issues go to Anthropic's API. Newsletter excerpts can contain personal information. Gmail credentials are not part of the generation prompt. Anthropic's applicable API retention practices are separate and are not changed by Undertow.

The full detail, with the file names, is in the privacy policy.

Something personal got treated as a newsletter. Now what?

The header-based detection is a heuristic. Personal messages can match it, so review the publication list carefully before choosing Approve.

During setup, choose Approve or Exclude for each discovered publication. You can change those choices later in Settings → Approved publications. If discovery is still running or failed, use Retry discovery; unfinished discovery is not treated as approval. Contact undertow@flapp.ist if you need help.

When does Undertow check Gmail?

Undertow requests a best-effort background check when Gmail is connected, but iOS may delay or skip it. The app can also check for new issues when you open it or return to it. Your delivery time does not guarantee an exact or unattended Gmail check.

How do I change what time my deck arrives?

In Settings, choose your ritual time and time zone. The server schedules deck work before your selected time using approved issue text it has already received. Your delivery time does not force a Gmail check on your iPhone. Available content, processing and service limits can delay or prevent a deck or notification.

There is one notification a day and no way to get more.

What does "Deepen" do?

Press and hold a card. You will see "Deepening — tomorrow's deck."

It is the strongest signal you can give: not just "keep this", but "go further". The next night's deck leads with a follow-up on that thread — the editor sees your deepen requests from the last three days before it picks anything else. If you type a note with it ("specifically the benchmark dispute"), the editor reads the note too.

Keep and Skip are the quieter version of the same loop: a sender you have skipped every time gets muted for you automatically, so the deck stops spending a card on it.

Why was my deck short — or missing entirely?

Because the night was thin, and the editor is instructed to kill rather than pad. A real editor's note from a five-card deck:

"Thin night — mostly ads and a Bloomberg political roundup — but a live-built job-search agent, an inside look at how Anthropic's own engineers work, and new data that complicates the Clay citation trick from two weeks ago made the cut."

If nothing arrived that was worth your time, you get no deck and no notification — the app says "Quiet night — nothing worth your time. Enjoy it." and shows you the last one you read. That is the product working, not a failure. A deck padded to twelve cards on a night that deserved four is how this kind of app becomes the thing it was built to replace.

Two other reasons a deck can be short: you have dropped most of your senders, or you have only just connected and the first backfill is still running (the onboarding screen shows the count as it climbs).

Is yesterday's deck still there?

Yes — Settings → Read yesterday's deck. Today's and yesterday's are cached on the device, so both work with no signal. Older decks are not browsable in this version.

What if I do not open it for a while?

After seven days without opening a deck, Undertow stops generating them for you. Open the app and the next night resumes as normal. Imported source text and generated decks have separate service-code retention defaults; see the privacy policy for the caveat about production scheduling.

How do I cancel?

Through Apple, because Apple does the billing:

Settings app → your name → Subscriptions → Undertow → Cancel Subscription.

Undertow's own Settings screen has a link that opens the same sheet. Cancelling stops the next renewal and you keep access until the end of the period you have paid for. Turn auto-renew off at least 24 hours before the period ends, or that renewal still goes through.

Refunds are Apple's to give: reportaproblem.apple.com. Write to us anyway if something went wrong — we will help.

How do I delete everything?

Settings → Delete account → confirm. The app asks the active service to delete account-owned source records, decks, feedback, device registrations, sender decisions and profile data. It clears the local session/cache only after a confirmed completed response. If the request fails or its result is unclear, the app retains a retry receipt and offers the same deletion request again; it does not show deletion as complete.

The service retains a tombstoned account identifier, revoked session hashes, deletion receipt and signed ledger event for idempotent retries and backup-restore reconciliation. Deletion does not guarantee removal from historical backups, logs or Anthropic systems that already processed excerpts. Production backup and ledger reconciliation procedures still require verification.

The client also removes the local Gmail credential during completed account deletion. Two things to do separately:

1. Revoke the app password in your Google Account, so Google's credential no longer permits future access.
2. Cancel the subscription in the Settings app. Deleting the account does not cancel billing, and we cannot cancel it for you.

What does Disconnect Gmail do?

Disconnect disables future local relay and deletes the Gmail address and app password from the iPhone Keychain. It keeps your Undertow account and session, and it does not restore any old server-held credential. Google does not let Undertow revoke an app password on your behalf, so revoke it separately in your Google Account if you want that credential invalidated there.

Accounts moving from the legacy server-connection design use an explicit migration step. Enabling local relay removes the encrypted server-held Gmail credential and its verification state atomically. Production migration and deployment still require separate verification.

Can I use Undertow with Outlook, Fastmail, or iCloud Mail?

Not yet. This version connects to Gmail. Every other mailbox needs its own connection path and its own testing, and shipping one badly would be worse than not shipping it.

Do you have an Android app? A web version?

No, and none is planned. One person builds this, and building it twice would make it worse.

Something is wrong with a card.

Tell us: undertow@flapp.ist. Include the deck date and the headline. A card that misread its source, invented a connection, or picked something from a sender you would never read is the most useful bug report we get — it is the one quality bar the whole thing is measured against.