The Shared Inbox: One Address for Every Family Subscription
Passwords are the visible half of a shared digital life. The invisible half is email — the receipts, the verification codes, the "did you just log in from Toronto" prompts. Almost every household lets that mail pile up in one adult's Gmail and hopes nobody else needs it.
What the shared inbox is
Every WarpDesk family gets one email address. Mail delivered to that address lands in a family-wide inbox that every member can read, search, and mark as read. That's the entire feature.
Why one address per family and not per user
Because you don't want ten forwarding rules. You want to type one address into the "email" field when you're signing up for a new service, and have every family member automatically be able to see the confirmation. Per-user addresses defeat the purpose.
What it's actually for
The three things a household needs shared mail for: receipts (so nobody's guessing what a mystery charge was), verification codes (so anyone can finish a login), and account alerts (so a security notice doesn't sit unread for a week). It is *not* meant as a general-purpose family email account. Personal mail should still go to personal addresses.
How mail gets in
We provision an address at `family-<id>@public.warpdesk.space`. You can either use that address directly when signing up for services, or forward from an existing address (Gmail forwarding, iCloud rules, whatever your mail provider supports).
What happens when a message arrives
Our inbound endpoint verifies the sender path, extracts the plaintext body and any safe HTML, sanitizes the HTML aggressively (no scripts, no external asset URLs left in), and writes a row into the messages table. That row is scoped to the family via RLS, so only members can read it.
The HTML sanitization decision
Email is famously the most dangerous rendering surface on the web. We strip scripts, iframes, event handlers, and remote resources by default. Images can be enabled per-message. Links open with rel=noopener and a confirmation for anything that looks like a password reset (so a phishing message doesn't get one-click clicked).
Search and filters
The inbox supports substring search across from, subject, and body, plus a "unread only" filter. Longer-term we'll add per-service filters (all Netflix mail, all utility mail) using the same service catalog the vault uses.
Retention
We keep messages until you delete them. There's no automatic purge. If your family generates a lot of mail, you can bulk-select and archive/delete from the inbox view.
What we don't do
We don't send outbound mail from the shared address. It's read-only. If you need to reply to a receipt or dispute a charge, you do it from your personal address.
The bill-detection angle
Every receipt in the shared inbox is a candidate for automatic subscription tracking. We're building a lightweight parser that identifies renewal notices and links them to vault entries, so the dashboard can show "next month's renewals" without you having to manually track them. That's shipping incrementally.
Privacy inside the family
By default every family member can read every message. If you need per-message privacy inside the family (rare), the inbox isn't the right tool — that message should have gone to a personal address in the first place.
The threat model
Shared inbox mail is treated the same as vault contents: RLS-scoped, TLS in transit, no cross-family access. The sender path is verified so you can't spoof a message into another family's inbox. And because HTML is sanitized on write, a malicious mail can't turn into a persistent XSS in the inbox view.