Help and user guide

Scout is an AI email tool, not a person, friend, therapist or emergency service. It can make mistakes, including about what is safe. Review suggestions before using them. You do not need AI to read or write mail, use contacts, calendars or reminders.

Cloud Scout remains unavailable for ages 13–17. Terms acceptance and a guardian checkbox do not enable it. Teen Sent-history use, automatic AI scans and Scout preference learning are also off. Launch countries, local consent rules, appropriate age assurance and provider safeguards still need approval. Do not email identity documents to change an age restriction.

Generated suggestions are checked before they are shown or saved. A failed safety check withholds the suggestion; it does not change or hide the original incoming mail. The check sends generated text to OpenAI for automated moderation under its API data policies. Filters may miss unsafe material or reject safe material. Never follow a suggestion to hurt yourself or others, share intimate information, keep harmful secrets or depend on Scout instead of people.

If something feels unsafe, stop using the suggestion. Talk to a trusted adult or qualified local professional. If you or someone else is in immediate danger, contact local emergency services. In the US, call or text 988 for crisis support; outside the US, use a local crisis service. PonyXpress does not contact emergency services or guardians for you.

Use “Report unsafe Scout output” below to open an email you can review before sending. Include only a safety-check reference if one was shown, the feature used and a brief description. No mailbox content is attached automatically. Do not include passwords, identity documents, attachments or other people’s private mail. If your device has no email app, write to support@ponyxpress.app with subject “Scout safety concern”.

Support reports are handled manually and are not emergency-monitored. We cannot promise a response time. You can turn off AI in Settings → Privacy, separately turn off Ride Ahead consent/history/learning, clear Scout learning, and pause or reset Xpress. Account export and deletion remain available without accepting updated Terms.

Before the sign-in form appears, PonyXpress asks your age band. Under 13 cannot continue. If you are 13 to 17 you must confirm a parent or guardian has given permission. We never ask for a date of birth. The age choice and guardian statement are self-attestation, not verification or a guarantee of compliance everywhere.

After signing in, Agreements and privacy shows the age band remembered on both Guided and Essential setup. A pre-sign-in choice is only a suggestion: confirm it is yours before using it for your account, or use Change to correct it. A shared browser may remember someone else’s choice. If no choice can be recovered, choose your band here. This is a browser convenience, not age verification. Review the Terms of Service and Privacy Notice and explicitly complete the unchecked acknowledgements, including guardian permission for the reviewed documents if you are 13 to 17. The server records the version and final band you accepted. Your workspace, new Google connections and cloud AI stay locked until that receipt exists; teen cloud AI remains unavailable.

Guided setup then offers email connections and optional steps. You can defer optional steps; Essential does not grant Scout permissions. Scout requires selected mailboxes, specific read/action grants and the existing purpose-specific permissions. Existing users get a targeted prompt rather than a forced new setup. Finishing setup or reaccepting documents never enables Voice, PDF, Xpress or notifications.

Declining a new version does not undo earlier Routes, scheduled sends or alerts. From the agreement screen or Account you can still disconnect mailboxes (cancels their automation) and remove notification devices (stops pushes).

When the documents change, you will be asked to accept the new version. You can view your saved version, time and age band on the Account page.

Accepting the agreement does not turn on AI or notifications. Those are separate choices in Settings.

Your PonyXpress sign-in is your identity. Connecting Gmail is a separate Google authorization for each mailbox, started from Onboarding or Settings.

Google consent opens in a new window or your system browser. After it finishes, that window shows a completion message even if it is not signed in to PonyXpress. Return to your original window; it refreshes on its own.

Contacts and Gmail settings (signatures) are optional permissions that are off by default.

Connect several Gmail accounts and see them in one inbox, or filter to one. Each account has its own color, name and default sender. Batch actions are split by mailbox automatically.

If an account shows Reconnect, open Settings and choose Reconnect. Google may ask you to approve again.

Search uses Gmail search across your connected accounts. You can find mail by attachment filename, but PonyXpress does not search inside attachment contents.

On desktop, hover over a conversation or focus it with the keyboard to reveal Archive and Move to Trash. On touch screens, use the three-dot quick-actions menu, or swipe right to archive and left to move to Trash. Release after the action label appears. A short, diagonal or vertical gesture does not file the conversation.

Swiping is off while selecting multiple conversations. Quick actions apply to the complete received/sent conversation in its own account, not just the messages visible in the list. Unsent drafts are left unchanged. Archive is not offered in Archive, Spam or Trash; quick actions never permanently delete mail.

A confirmed action offers Undo for ten seconds. Undo restores the previous Inbox or archived location of each affected message, without changing stars, read status or Mailbags. If the conversation has since changed, review its current folder instead. If a mailbox operation cannot be confirmed, review Inbox, All mail and Trash before trying again; PonyXpress does not automatically retry it.

Open a conversation to read the full thread. Reply, reply all and forward keep thread references. Drafts autosave and sync to Gmail once valid.

New messages and replies start with a rich-text editor: select text to change its email-safe font, size, color, emphasis or alignment; add lists, quotes, links and images. Paste keeps supported formatting while unsafe content is removed. The plain-text option remains available.

Signatures use the same editor and can include logos, links and formatted text. Choose defaults separately for new mail and replies, per mailbox or verified sending address. Saved drafts keep an editable copy of the chosen signature; reopening one does not append it again.

Upload a PNG, JPEG or WebP up to 2 MB to insert a logo. Images are resized and embedded in outgoing mail, without a public hosting requirement. Public HTTPS image links are also supported, but loading those images contacts their host and a recipient’s mail app may block them. Gmail signature export requires public image links rather than uploaded logos.

Drag files into a compose or reply window to attach them below the message. Drop a PNG, JPEG or WebP up to 2 MB directly into the body to insert it at the drop caret; plain-text messages switch to rich text automatically. GIFs and larger supported images become regular attachments instead. Existing file type, count and size limits still apply.

Right-click an inline image (or tap it on a phone) and choose Send as attachment. The image stays in your message until attaching succeeds. Edit image offers the same action for keyboard use. During the current edit session the original file is used when available; after reopening a draft, conversion uses the optimized embedded image, not the full-resolution original. Linked remote images must be downloaded and attached manually; PonyXpress does not fetch them for you.

Email apps may substitute fonts or block images. PonyXpress sends a readable plain-text alternative alongside formatted mail. Custom downloaded web fonts are not supported.

Delayed and scheduled sends are run by PonyXpress, not Gmail. Cancel a pending send from the job list before its time. If a send outcome is uncertain, PonyXpress will not retry automatically; check Gmail Sent.

Select an attachment to preview PNG, JPEG, GIF, WebP, PDF, UTF-8 text or CSV on this device. Preview is limited to 10 MB, with separate image-dimension limits. PDFs have page controls and a text alternative when available; PDF links, forms and scripts are not activated. Text and CSV are shown literally, not as executable content.

Download original keeps the file’s bytes and uses the authenticated mailbox download path. HTML, SVG, scripts, Office files and unsupported or password-protected documents remain download-only. Preview is not a malware scan. Close the preview and use Open in Gmail for files above the 25 MB download limit. Demo previews/downloads are clearly labeled generated fictional samples, never real mailbox files.

Preview bytes stay in memory only and are released when the preview closes or the account identity changes. Previews never send attachment content to AI or an external document viewer. Only Scout Voice PDF review, a separately enabled permission, sends a PDF you select and confirm. HTML mail remains sanitized and remote images stay blocked unless you choose otherwise.

Mailbags are your Gmail labels for one mailbox. A message can be in several. Removing a Mailbag never deletes messages.

A Route files new incoming mail by one rule: exact sender, sender domain, or subject text. Turning a Route on requires a fresh preview of up to the latest 100 messages.

Select several conversations and choose Create Route to use their specific sender addresses or domains. Edit the list, choose a Mailbag for each account, preview, then confirm. Each distinct sender or domain creates an independently manageable Route.

Saving a Route handles future mail. Bulk setup has an optional Also file selected matching messages now checkbox, which changes only the reviewed selection. To organize other existing matches, use the separate Also organize existing matches preview and confirm it.

Domain Routes have an Include subdomains option. example.com can then match hello.example.com, but never notexample.com. Changing this setting requires a new preview.

Routes never send, forward, delete or use AI. Pause or delete a Route at any time.

With the Contacts permission, view and edit Google Contacts per account. When a message contains new or changed contact details, the People popover can suggest an update card, including associating a phone number. Nothing is saved until you review it.

Contacts with an exact shared email address appear once across accounts. Names alone never group people, and ambiguous shared addresses within an account remain separate. Choose a saved account card before editing, writing or deleting; grouping never merges the Google records.

Available Google contact photos replace initials. Account colors form the avatar outline (multiple segments for multiple accounts); account names are also shown. Missing, blocked or failed photos fall back to neutral initials. Photos load directly from approved Google image hosts without a referrer; no third-party avatar lookup is used.

The main editor and email contact card support labeled emails, multiple phone numbers with separate extensions, home/work/custom addresses and a birthday with an optional year. Extensions round-trip to Google as part of the phone number. Birthdays do not create calendar items automatically. Photos are read-only here; this is not a photo-upload editor.

CSV exports include separate account records, structured detail columns and birthdays; export is not a backup of every Google Contacts field. To import, open Contacts in guided setup or the Contacts page. Choose a CSV or UTF-8 vCard 3.0/4.0 file, review the parsed fields, select individual people or all eligible entries, choose one Google account and confirm. Files are limited to 2 MB and 1,000 records. Nothing is uploaded when you choose a file or allow device access; only selected, reviewed fields are sent after final confirmation. iPhone/iPad also offers a system picker for contacts you choose one at a time. A browser contact picker appears only when supported; a file remains available. Device photos and attachments are not imported.

Google Contacts editing permission is separate from device access; if missing, reconnect the chosen Google account with Contacts enabled, then select and review again. Exact email duplicates in that account are skipped without merging or overwriting cards; phone-only entries need individual review and cannot be matched by name. An unconfirmed Google save stops the run: check the account before any new import, never repeat it blindly. Import alone does not start background device syncing, Scout, analytics or sharing contacts with another account. Existing sharing rules require a new explicit review before they may copy an imported card.

Use Update all cards for a one-time combined update, or Link cards & keep synced to keep selected details matched across personal and work cards. You can start from unsaved edits in the main contact editor. Select 2–10 existing cards, one per account; manually choose a card when the emails differ. Names alone never establish identity.

Review the combined emails, phone numbers/extensions and other selected details before confirming. Different names, companies, titles, birthdays and notes remain visible for review. Notes, birthdays and addresses are private fields: select them explicitly to share them. Photos and Google record identities are never merged or copied by this action.

A linked pair syncs approved fields both ways, checked about every five minutes while the backend service is running. It is not an instant Google merge. Independent conflicting edits pause for review; deleted cards are not recreated and deletions never propagate. Include all already-linked cards when changing the group, or stop the other links first.

Stop syncing on the contact card to unlink a pair without deleting either record or its saved details. Separate account-wide sharing rules, if enabled, still apply. An unconfirmed update may have saved only some cards: refresh and inspect each account before starting a new review; the app does not automatically retry uncertain writes.

Contact sharing between accounts needs a preview and explicit approval. Deletions never propagate.

Open Ride Ahead → Talk it through, choose an account and catch-up interval, then type a question such as “Which messages need a reply?” or “Help me draft a response to this conversation.” Cloud sessions need adult eligibility, configured AI, ordinary Scout analysis consent and the relevant account/action grants. Results may cover only part of the mailbox; check the counts and sources.

Scout Voice in Ride Ahead is opt-in. The natural AI voice is its own permission, off by default and separate from the microphone. When on, the words Scout reads to you, including email content and your agenda, are sent to OpenAI to make an AI-generated voice (Sage, Coral or Alloy). The audio plays and is not stored. If it fails, Scout shows an error and the text; it never silently switches voices.

You can instead choose your device's own on-device voice for the visit. If none exists, everything stays as text. Your permissions and voice choice stay saved to your account until you turn them off, but speech never starts by itself: tap Start, Resume, Read today or Preview.

Microphone transcription is optional and off by default. Short clips go through PonyXpress to OpenAI; PonyXpress does not store the raw audio. In manual recording mode, review and submit the editable transcript. Start conversation is a separate session action: spoken questions are submitted when you pause, and Scout listens again after answering. Speech alone never confirms a mail change or draft save.

Each recording is capped at 30 seconds/4 MB and requires browser microphone permission. Conversation mode has a visible microphone indicator and End conversation control, pauses after silence and ends after ten minutes or when you leave the page. Nothing listens in the background. Microphone support varies; the packaged desktop companion blocks it and offers typed sessions. A saved permission never starts recording automatically.

PDF review is a separate permission. Only a PDF you select and confirm is read: the first 6 pages of a file up to 8 MB are rendered and that text and those page images are sent to OpenAI.

Session transcripts are encrypted and kept up to 7 days, are included in account export and deletion, and turning Voice off clears current sessions. OpenAI does not train on API data by default; abuse-monitoring retention can be up to 30 days with legal and safety exceptions. Scout Voice never sends mail.

Review full recipients and contents to confirm a reply or forward proposal into a saved draft. Sending remains a separate composer action. Voice has no access to real encrypted messages: that feature is not available. Confirming a PDF does not authenticate its signature, cover pages after the first six, or guarantee an accurate answer.

In the reader, Scout starts as one collapsed row showing how many recommendations it found. Open it to see suggested dates, reminders, events and contact reviews. These on-device findings do not use cloud AI.

Summaries and draft replies use cloud AI only after you opt in. Always review the result.

Ride Ahead reviews your inbox in bounded batches and sorts conversations into priorities such as urgent, next, updates, cleanup and review. It needs its own consent, separate from one-message summaries.

The first time you open Ride Ahead, Settings opens automatically. Choose your preferences and click Save settings before running. Changes are not applied until saved. You can return to Settings anytime; Privacy Policy and Terms and Conditions links are provided there.

Ready replies open in the normal composer. Ride Ahead never sends mail.

Cleanup starts with nothing selected, allows up to 25 conversations per reviewed batch, and requires confirmation. Trash is not permanent deletion.

Correct a category to teach Scout. Learning and Sent-mail examples are separate, off-by-default settings, and you can forget learning per mailbox in Settings. Learning personalizes your results; it does not train a general AI model.

Cloud AI, including Ride Ahead, is unavailable to the 13 to 17 age band for now.

Dates in mail become buttons. Creating an event always opens a review. Check the date, year and timezone before saving; a date range includes its return day.

Draft titles combine the dated passage with the sender and subject: for example, a merchant delivery or a meeting at a named venue. Locations are suggested when supported by the email. A delivery with no stated time is proposed as all-day; reminders remain private alarms.

If a clock time omits AM/PM, choose one of the two time buttons. Meeting senders can appear as suggested guests: Add guest only fills the guest list. Sending still requires the separate invitation checkbox and final review. Delivery and no-reply senders are not suggested as meeting guests.

Saved events and reminders show a strip above Scout with a link back. Calendar entries keep a link to their source email.

Reminders are private alarms stored by PonyXpress, not Google Tasks or Calendar events, and they do not block busy time. Snooze moves the same reminder; Done keeps a completed record.

When a later email mentions moving or cancelling a plan, use Review change / cancellation above Scout, or the email’s event action. Nothing is changed by receiving, opening or analysing the message.

Only saved links from the exact receiving mailbox and conversation are considered, even when you saved the item to another connected calendar account. Similar titles, dates and senders are not matches. If there are several links, choose the item yourself. Missing, incomplete, inaccessible or changed links stay manual: find the plan in Calendar rather than create a replacement.

Select a linked item to load its latest saved details. Compare Currently saved with Proposed for review and read the source message. Keep the existing title, notes, guests, video call and source association unless you explicitly edit them. Unclear dates and times remain blank for you to choose; enter location changes manually. For events, choose an end time, check the date and timezone, then Review and Save changes. Guests still need the separate invitation/update checkbox.

Cancellation needs its own confirmation. Only an event you organize on an editable calendar can be cancelled here. If it has guests, separately approve their cancellation emails. Repeating events affect only the displayed occurrence. A private reminder cancellation deletes only the PonyXpress alarm, not a Google event, and never emails anyone. Earlier calendar-based reminders remain events; they are not converted.

A changed event or reminder must be reopened and reviewed before trying again. If a write cannot be confirmed, PonyXpress does not automatically repeat it or its guest updates. Close the review and check Calendar or Reminders first. The source email is never deleted or changed.

Try the fictional Trail planning coffee reschedule and Garden visit cancellation conversations in a fresh or reset demo. Demo saves and guest updates stay in your browser; nobody is notified.

When your device timezone changes, choose local time, keep home time, or decide later. This only changes how times are displayed. Existing events, reminders, scheduled sends and snoozes keep their exact moments. All-day dates stay fixed.

Enroll a browser in Settings, Notifications. Alerts are off by default, previews are off by default, and a generic text option protects your lock screen.

Delivery and sound depend on your browser and operating system. A fully closed browser may not receive alerts. Enrollment expires after 30 days without signed-in use. Use Send test alert to check a device.

Ordinary Gmail is not end-to-end encrypted. Google and PonyXpress process ordinary content for the features you request. HTTPS transport, encrypted credentials and selected encrypted server records are distinct protections; not every workspace field is application-encrypted.

Optional offline copies use their own passphrase and are not encrypted-message delivery. They protect saved text while locked, not an unlocked or compromised device.

End-to-end encrypted messaging is not available yet. The Private messaging preview is an isolated fictional design simulation with no encryption, authentication, key recovery or delivery. Do not enter private content. Its lock screens and simulated verification cannot protect you. There is no ordinary-mail fallback or live secure-content AI/search/export promise to rely on.

Real secure-mode release needs implemented and independently reviewed recipient/device verification, key custody, recovery, metadata disclosures and isolation from ordinary mail, AI and plaintext logs/exports. That work is separate from agreeing to policies.

In Settings → Privacy, use Saved copies for offline reading. Select connected accounts and conversations from the currently loaded list, choose 1, 7 or 30 days, and enter a separate 12–128-character reading passphrase twice. Saving replaces previous copies; nothing is automatically collected.

Limits are 50 conversations, 200 messages and 8 MiB. Only text is saved, not attachments, HTML or remote images. Open saved copies while online first and bookmark the /offline/ reader. A production build and supported secure browser with working IndexedDB and service workers are required for offline cold startup; development previews do not precache Vite modules.

Unlock using your reading passphrase. Saved mail is read-only: no send, archive, delete-provider-data or reconnect write queue. Hiding the tab, five minutes idle or reconnecting locks the reader. Revalidation checks the real sign-in and connected accounts; maximum offline access is seven days before another online check.

Forgotten passphrases cannot be recovered. Forget this device’s saved copies removes local reading copies, not Google mail or independent unsent draft recovery. Sign-out, mailbox disconnect and account deletion erase local reading copies. Other offline devices cannot be erased instantly and must reconnect or expire. Electron can open the same prepared HTTPS reader, but full desktop offline launch is not guaranteed.

Disconnect a mailbox in Settings. That removes the PonyXpress connection, its app copies, Routes, scheduled sends and tokens. It does not revoke the Google grant; remove PonyXpress separately in Google Account permissions (https://myaccount.google.com/permissions). It does not delete Gmail mail, your PonyXpress sign-in, or your agreement receipt.

Use Account to export stored PonyXpress records and uploaded files, or review and confirm permanent account deletion. Export is not a complete Gmail archive. These controls, sign-out, disconnect and notification-device removal remain available without new Terms acceptance. Failed cleanup blocks normal use and can be retried; running or uncertain actions may need reconciliation first.

Deletion removes active app records and identity, not Google mail, events, contacts or Google-synced drafts. Revoke Google permission separately. Minimal deletion-recovery markers, infrastructure backups/logs and provider records have independent unresolved retention requirements; immediate erasure everywhere is not promised. For correction or help with a failed request, email support@ponyxpress.app. Ownership is verified first; do not send identity documents or passwords.

No Mac or Windows installer is available yet. Installers will be posted on the Downloads page only after they are built, signed and tested. Use PonyXpress in any modern browser meanwhile.

The demo uses fictional data kept only in your browser. It never touches your real mail and is separate from your account.

• Stuck on the agreement screen: refresh. If it says the version changed, reload the page to get the current documents.
• Google window blocked: allow popups or use the Open Google sign-in link shown.
• Account shows Reconnect: open Settings and reconnect.
• Scheduled send uncertain: check Gmail Sent before sending again.
• No alerts: check browser and OS notification permission, Focus modes, and send a test from Settings.
• AI unavailable: it may be off, not yet approved on this server, or unavailable for your age band.

Still stuck? Email support@ponyxpress.app.