What “on-device AI” should mean.

Ask three questions

What local processing looks like

A genuinely local feature can work without sending message content to the app maker’s servers. The model or rules run on the device, results stay local, and your mail still travels only between your device and your configured provider. Local processing can be slower or less capable than a cloud model, but the privacy boundary is much easier to explain.

Read the important details

• “No server” does not mean “no provider.” Gmail, iCloud, Fastmail, and other providers still store and process your mail.
• OAuth is not a privacy guarantee. It is a safer way to grant access, but you should still understand the scopes requested.
• Keychain storage matters. Credentials and refresh tokens should be protected by the operating system, not kept in a plain text settings file.
• AI fallback matters. If local AI is unavailable, the app should say what it uses instead and let you choose whether that is acceptable.

The Suzume boundary

Suzume connects directly to your mail provider over encrypted IMAP/SMTP or provider sign-in. Its local cache and credentials stay on the device, and summaries, reply suggestions, and Smart Search use Apple Intelligence when available or local rules and templates as a fallback. There is no Suzume server receiving your mailbox.