Email, from IMAP to the inbox

An email developer who ships the client, the templates and the inbox placement

IMAP and SMTP clients, transactional templates that render in Outlook, SPF, DKIM, DMARC and BIMI set up so the brand lands where it should, suppression lists at terabyte scale. I was the principal engineer of an AI-native email client that reached the App Store in four months and passed CASA Tier 2. Check your own domain below.

Book a free 30-min call Email me instead

Available from November 2026 · Wrocław, Poland (CET), remote

“someone you can always count on”public LinkedIn recommendation
“a true bias for action”client CTO, on LinkedIn
15+ yearsshipping software
Free call, no pitch deck30 minutes, then you decide

4months from first commit to the App Store

300+ GBof production data on one platform I led

9years of TypeScript, React and Node.js

15+years shipping software

Clients that speak IMAP for real

IDLE, CONDSTORE, partial fetch, servers that lie about capabilities, OAuth for Gmail and Microsoft 365. Patriot Mail talks to real mailboxes on web, iOS and macOS and treats every incoming message as untrusted input, including for the AI that reads it.

Templates that survive Outlook

React Email or MJML, tables where tables are still needed, dark mode, a plain-text alternative, previews checked across clients before anyone hits send. The template lives in the repo and ships with the feature.

Authentication and deliverability

SPF, DKIM, DMARC with reporting, BIMI with a verified mark when the brand wants its logo in the inbox. Bounce and complaint handling, list hygiene, a warm-up plan that does not torch the domain.

Scale and compliance

A suppression-list platform for a UK email publisher grew past 300 GB in production with constant-time sign-up, zero-downtime deploys and a compliance feature that landed before the deadline existed.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Patriot Mail: from first commit to the App Store in four months

The problem: A greenfield AI-native email client for web, iOS and macOS had to reach real users fast, pass Google’s CASA Tier 2 security assessment and work for older people.
What I did: I was the principal engineer. I wrote the delivery plan, shaped the product vision and treated prompt injection through untrusted email as a design constraint before any model touched a mailbox. CASA and OWASP ASVS controls became a Playwright suite that runs on every pull request. WCAG 2.2 AA sits behind an automated axe gate.
Result: Public App Store release in four months. CASA Tier 2 passed and the yearly questionnaire turned into a check on every PR. Text scaling to 200% and a calm-email mode shipped for older users.

4 months CASA Tier 2 WCAG 2.2 AA Open ↗

See also: SaaS & MVP · Mobile & desktop apps

Suppression-list platform: MVP to product, 300+ GB in production

The problem: A UK email publisher needed suppression lists at terabyte scale with constant-time sign-up and zero-downtime deploys.
What I did: I led three engineers from MVP to the full platform. Postgres partitioning by tenant and list, parallel request pipelines, blue/green deploys. One-click unsubscribe shipped four months before Google and Yahoo required it.
Result: 300+ GB and millions of events in production, zero-downtime deploys, and a compliance feature that landed before the deadline existed.

300+ GB team of 3 blue/green

WCAG 2.2 AA behind an automated gate

The problem: An email client for older users had to stay usable at 200% text scaling and with a screen reader, release after release.
What I did: axe in CI as a hard gate, keyboard paths tested in Playwright, a calm-email mode that strips noise.
Result: WCAG 2.2 AA held across releases without a manual audit each time.

WCAG 2.2 AA axe gate

See also: React · Mobile & desktop apps

One foot in the door

Not ready for a project? Start smaller.

Two ways to see how I work before you commit to a sprint. Fixed scope, a number in writing after a short call.

Email codebase audit, one week

I read the repo, CI, tests, security and the parts the team avoids. You get a written report with findings ranked by risk, a plan with milestones and a go or no-go you can defend. I have run this for a large software house before its clients saw the code.

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line-level comments, the three things I would change first and whether I would merge it.

Ask about an audit Free 30-minute call first. If an audit is the wrong tool, I say so on the call.

Live demo

Check your domain’s email posture

Type a domain. The Worker behind this page asks Cloudflare’s DNS over HTTPS for MX, SPF, DMARC, BIMI and the common DKIM selectors, then grades what it finds. Nothing is stored.

Demo loading…

Try your company domain, then a competitor’s. A DMARC policy of “none” is the most common finding.

How it works

Three steps from this page to a running project.

1
A 30-minute call
You describe the product and the problem. I ask the questions I would ask on day one. If I am not the right person, I say so and point you to someone who is.
2
Scope in writing
A short written plan follows: what we build first, what we measure, how we work together and what it costs. No slide deck.
3
Something to touch in week one
The first slice ships in the first week: deployed, measured, reviewable. From there the work is paced by what the numbers say.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

You need a senior who owns delivery, not a pair of hands
The product has to ship and be measured, with or without a product manager
A solo engagement or a team of up to four
TypeScript, React, Node.js, Cloudflare, Postgres, PostHog

Probably not when

A program that needs a ten-person vendor team
A stack built around Java, Python or a cloud I do not sell
Body leasing by the hour with no say in how the work is done
A start before November 2026

Working style

How I work

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Review as a craft

Hundreds of pull requests reviewed. I review for the product and its reasons. The code comes second.

Measured, not assumed

PostHog in every project from day one. A tracking plan per feature and dashboards leadership actually reads.

FAQ

Questions people ask before they book

Can you build an email client?

Yes. I was the principal engineer of Patriot Mail, an AI-native client for web, iOS and macOS: IMAP sync, OAuth, prompt injection through untrusted email treated as a design constraint, WCAG 2.2 AA behind an automated gate. Mobile delivery is covered on the mobile and desktop page.

Transactional email for our SaaS?

Templates in React Email or MJML, one provider adapter so you can switch senders, every send logged as an event in PostHog, bounces and complaints handled from day one. The rest of the product side is on the SaaS page.

Our emails land in spam. Can you fix it?

Usually. I audit authentication, sending patterns, list quality and content, then fix in that order. What I will not promise is a number before I have seen the domain, because reputation takes weeks to rebuild and some lists are beyond saving.

Is BIMI worth it?

Only after DMARC is at quarantine or reject, which is the real work. The verified mark certificate costs money every year. I will tell you when the logo in Gmail is not worth that bill.

Email and AI?

An LLM that reads mail reads attacker-controlled text. Patriot Mail was designed around that: tools with narrow scopes, no action on email content without a human, evaluation data from real mailboxes. More on the AI and agents page.

How soon can you start?

November 2026. Book the call and bring the domain that worries you.

Let’s find out in 30 minutes

A free 30-minute call. You bring the problem, I bring questions. No prices on this page because scope comes first.

If I am the wrong person I will say so on the call and point you to someone better.