It can reach the button.
It never presses it without you.
That press is yours.
It lines the whole task up — the mail written, the forty renames listed, the reply typed — and then it stops at a card. Nothing goes until you press there. A button on a website that sends, pays or posts is pressed by the app only after that card, and there is no setting that skips it.
- An email goes out only after you have read every word of it and pressed send. An out-of-office is the same: you read the reply, the account and the days first, and then Gmail answers everyone who writes until the day you set.
- Every change waits for your press. A change to your files comes back in one press; a sent email or a payment cannot, and the card says so.
- Nothing is deleted for good — what it clears goes to the Trash.
- “Forget everything about me” is one press, which means it.
One press puts it back.
Every change to your files is journalled, and Put it back returns them in one press.
“Forget everything about me” is one press, which means it.
Nothing is deleted for good — what it clears goes to the Trash, and it stays there until you empty it yourself.
What we’d tell you before you asked.
A plan can misread what you meant. That is not a footnote to the design — it is the reason for it. Every change stops at a card you read first, and undoes in one press.
Your files stay on your Mac. The part of a task that has to be reasoned about goes to a model and comes back — and the app tells you as it happens, counting the words that go.
Money that has moved, an email that has arrived, a form a website has already taken. Undo cannot follow those out into the world, so nothing that leaves is ever done without your press.
How it is built, in full.
The security page sets out the split between what reads and what acts, the six-folder boundary, and why the text on a page is treated as data rather than instruction, in the order a skeptic would ask.