BlackMail

Inspiration

"bro these numbers are wrong, redo the totals"

That's how you think it, and between teammates it's fine. But messaging apps keep that first draft forever, where it can be screenshotted, forwarded, or dug up later. Your most unguarded voice becomes the permanent record.

People already paste messages into AI tools to "make this sound professional." So both versions already exist. The problem is which one gets kept. We built BlackMail so the casual one doesn't stay on the record.

What it does

You write one message, and BlackMail sends it in two voices.

Write naturally. Type how you mean it, slang and emoji included.
Send the formal text. AI rewrites your draft professionally. You review it, send it, and it becomes the record. "bro these numbers are wrong" becomes "The figures appear to be incorrect. Could you please recalculate the totals before we send the report?"
Keep the original off the record. Your real wording is encrypted and sent straight to your contact over a private peer-to-peer channel. It clears on refresh, and only the formal record remains. For contacts you haven't paired with, a five-minute pass shares the original instead.

How we built it

Frontend: plain JavaScript, with no framework.
API: Node.js 22's built-in http module, deployed on Vercel.
Formal record: Supabase (Postgres and Auth, with row-level security) stores accounts, contacts and the formal inbox.
Rewriting: Nebius AI produces the formal version.
Original: the browser encrypts it with AES-256-GCM using an ECDH P-256 key exchange, then sends it over a WebRTC data channel. It never touches our servers.
Redis: stores the five-minute passes, rate limits, and the tokens peers use to reconnect.
We built most of the project with coding agents.

Challenges we ran into

Tone vs. meaning. Early rewrites softened blunt messages too much, so we tuned the prompts to keep the original urgency.
Truly temporary messages. The original had to avoid every permanent store, so we split delivery into two channels.
P2P reliability. WebRTC connections are hard to get working across networks. Some networks still block them, and both people need to be online.
Reconnecting. We built encrypted reconnect tokens so you only have to pair once.

Accomplishments that we're proud of

We flipped how messaging works: the deliberate version is the record, and the honest version stays private.
The flow works end to end: write, rewrite, review, send, and deliver the original privately.
The original is protected by end-to-end encryption, and the keys never reach our server.

What we learned

Tone is part of meaning, and a rewrite has to respect it.
A disappearing message is only as private as the most permanent place it passes through.
Coding agents speed you up most when you already know what you're building.