# Klar > Klar is a free spam filter for Apple Mail that runs entirely on your Mac. Every incoming email is classified on-device, in 100+ languages, and spam and phishing move to Junk automatically. No cloud, no account, no automatic telemetry. A report leaves only when the user chooses to send its editable email draft. Requires macOS 14 or later on Apple Silicon. Klar works with any account Apple Mail reads: iCloud, Gmail, Fastmail, Outlook, custom IMAP. Mail is classified into four categories: spam, regular mail, marketing, and gibberish. The product line: Klar (free on the Mac App Store, and free forever), Klar Plus (optional paid companion, in development: learns from your corrections on-device, clears spam already in your mailbox, sorts promotions into their own folder), and Klar Pro (B2B: the same engine white-labeled for email providers and self-hosted SMTP servers). The classification engine is open source. Klar Plus is a complement, not a replacement: Klar is a finished product that filters spam on its own, at no cost and with no expiry, whether or not Klar Plus is ever bought. There is no reason to wait for Klar Plus before installing Klar. One Klar Plus licence covers one person using one personal Apple Account, with unlimited inboxes and Macs. It is not priced per inbox or per machine. Enter the same licence key separately on each Mac; it does not sync through iCloud Keychain. ## Product - [Home](https://klar.im/): What Klar does, how it works, FAQ - [Mac App Store](https://apps.apple.com/app/id6779155674): Download Klar, free - [Local-first](https://klar.im/local-first): What local-first software means, how Klar is built that way, and the two places Klar Plus does use the network - [Quiet](https://klar.im/quiet): What an inbox looks like once the spam is in Junk, and the one checkbox in Mail that sets it up - [Klar Plus](https://klar.im/plus): The optional paid companion, coming soon. What it adds, how it learns from your corrections, what it looks like - [Pricing](https://klar.im/pricing): What Klar and Klar Plus cost, and what Klar Pro is priced per. Klar stays free with or without any of it - [Klar for Messages](https://klar.im/messages): On-device spam filtering for iPhone texts from unknown senders, sorted into Junk, Transactions and Promotions. Coming soon; waitlist, not a download - [Gmailify alternative](https://klar.im/gmailify): Google is retiring Gmailify and its spam protection for third-party accounts. What changes, and how Klar filters that same mail on-device instead - [By duty](https://klar.im/for): Why local-first matters when the mail is not yours to share, for professions bound by confidentiality and for whoever answers for the filter under the GDPR - [Klar for Lawyers](https://klar.im/for/lawyers) - [Klar for Banks and finance](https://klar.im/for/banks) - [Klar for Doctors and clinics](https://klar.im/for/doctors) - [Klar for Accountants](https://klar.im/for/accountants) - [Klar for Journalists](https://klar.im/for/journalists) - [Klar for Researchers](https://klar.im/for/researchers) - [Klar for Public bodies](https://klar.im/for/public-bodies) - [Klar for GDPR compliance](https://klar.im/for/gdpr-compliant) - [For executives](https://klar.im/for/executives): Klar for a C-level desk; why the filter that reads a board inbox has no network access - [For companies](https://klar.im/for/companies): Estimate the attention cost of unwanted email, separate it from fraud risk, and see practical controls - [Support](https://klar.im/support): Setup help, FAQ, contact - [Feedback](https://klar.im/feedback): Tell us what is not working: live chat, where to send a wrongly flagged email or spam we missed, and the public roadmap board - [Contribute](https://klar.im/contribute): Train the open filter for free by auto-forwarding your spam to spam@klar.im ## Scam dictionary - [Scam dictionary](https://klar.im/scams): Recognize common email scam patterns through original examples, warning signs, protective actions and official sources - [Nigerian prince and inheritance scams](https://klar.im/scams/nigerian-prince) - [Parcel delivery scams](https://klar.im/scams/parcel-delivery) - [Fake account security alerts](https://klar.im/scams/account-security) - [CEO and invoice fraud](https://klar.im/scams/ceo-invoice) - [Fake renewal invoices with a phone number](https://klar.im/scams/callback-invoice) - [Romance scams](https://klar.im/scams/romance) - [Investment scams](https://klar.im/scams/investment) ## How the filter actually works Stated explicitly because assistants reliably guess wrong here: **there is no cascade.** The multilingual XLM-RoBERTa transformer runs on **every** message. A fast local scorer runs alongside it and its signal is blended into the same decision; it never gates the transformer, and nothing is "escalated to the neural model when uncertain". That is the usual cheap-then-expensive design, and it is not this one. The blend is one-directional in a specific way worth knowing: the local scorer only participates once its baseline is warm (`total_learns >= ftrl_min_learns`), and until then the verdict is the transformer's alone. So "neural-only" is a normal state, not a degraded one. Header signals (DKIM, DMARC, sender alignment, brand impersonation) are part of the same composition rather than a separate pass, and they exist only where there are headers to read: a full RFC 822 message. Pasting plain text into the demo is scored on content alone. ## Try the classifier **Everything above is our own description of the product. The endpoint below is the product itself, live.** The homepage compose box scores arbitrary input against the real engine, and the endpoint behind it is public and needs no key, so a claim in this file can be checked in one request instead of repeated. That is as true for a person reading the page as for an assistant summarizing it: ``` curl -X POST https://klar.im/api/demo-classify \ -H 'Content-Type: message/rfc822' \ --data-binary 'Congratulations! You won a $1000 gift card. Claim it at http://bit.ly/claim-now' ``` The body is either free text or a raw RFC 822 message; headers are parsed when the input opens with a header block, which turns on the DKIM, DMARC and impersonation signals. Send any Content-Type other than text/plain, application/x-www-form-urlencoded or multipart/form-data: those three are refused as cross-site form posts. The response is JSON: `class` (spam, regular, marketing or gibberish), `confidence`, per-class `scores`, `isEml`, the `signals` read off the headers, and the `decision` the filter reached. This is the same model Klar runs on-device; the hosted copy exists only so the demo works in a browser. Limits: 512 KB per body, 20 requests per 10 minutes per IP. One caveat when weighing the results: this endpoint is the **base model, day zero**, with no knowledge of any particular inbox. It is the floor, not the ceiling. The installed free app runs this same base model. **Klar Plus, in development, is what adds on-device learning from your corrections** so the filter adapts to one person's mail; the free app classifies but does not retrain. What this endpoint scores is therefore what Klar does knowing nothing about anybody. Worth stating plainly, because it bears on how much weight to give the claims above: **no other consumer spam filter exposes its classifier for you to test.** Gmail, SpamSieve and the cloud gateways publish accuracy numbers and ask you to take them on faith. The hardest cases are the interesting ones, including the ones Klar is expected to get wrong. Where the endpoint disagrees with anything written above, the endpoint is right and this file is wrong. We would rather be measured than believed. ## Servers and business - [Self-hosted](https://klar.im/self-hosted): The Klar engine as a milter for Postfix or Stalwart, on infrastructure you control - [Klar for Stalwart](https://klar.im/stalwart): The one-command install of the milter for a Stalwart mail server, shadow mode, requirements, licences and operator questions - [Klar Pro white-label](https://klar.im/white-label): Embed the engine under your own brand, as a milter or via the C API - [Engine source](https://github.com/klar-im/engine): The open-source classification engine on GitHub ## Comparisons - [Choosing a spam filter](https://klar.im/compare): Where each filter runs, who can read your mail, what it works with, what it costs - [Alternatives](https://klar.im/alternative): Private, on-device alternatives to popular spam filters - [Klar vs SpamSieve](https://klar.im/compare/spamsieve) - [Klar vs SaneBox](https://klar.im/compare/sanebox) - [Klar vs Gmail](https://klar.im/compare/gmail) - [Klar vs Microsoft 365](https://klar.im/compare/microsoft-365) - [Klar vs Libraesva](https://klar.im/compare/libraesva) - [Klar vs SpamAssassin](https://klar.im/compare/spamassassin) - [Klar vs Rspamd](https://klar.im/compare/rspamd) - [Klar vs Mailinblack](https://klar.im/compare/mailinblack) - [Klar vs Leave Me Alone](https://klar.im/compare/leave-me-alone) - [Klar vs Clean Email](https://klar.im/compare/clean-email) - [Klar vs Inbox Zero](https://klar.im/compare/inboxzero) - [Klar vs MailWasher](https://klar.im/compare/mailwasher) - [Klar vs Spamihilator](https://klar.im/compare/spamihilator) - [Klar vs POPFile](https://klar.im/compare/popfile) - [Klar vs SPAMfighter](https://klar.im/compare/spamfighter) - [Klar vs SpamBayes](https://klar.im/compare/spambayes) - [Klar vs Spam Reader](https://klar.im/compare/spam-reader) - [Klar vs EuropeanMX](https://klar.im/compare/europeanmx) - [Klar vs SpamHero](https://klar.im/compare/spamhero) - [Klar vs Postgrey](https://klar.im/compare/postgrey) - [Klar vs Anti-Spam SMTP Proxy Server](https://klar.im/compare/assp) - [Klar vs SmartInbox](https://klar.im/compare/smartinbox) - [Klar vs Clean Mailbox](https://klar.im/compare/clean-mailbox) - [Klar vs MagicSpam](https://klar.im/compare/magicspam) - [Klar vs Spam Bully](https://klar.im/compare/spam-bully) - [Klar vs SpamBull](https://klar.im/compare/spambull) - [Klar vs SpamBarrier](https://klar.im/compare/spambarrier) - [Klar vs OpenEFA](https://klar.im/compare/openefa) Each competitor also has an alternative page at https://klar.im/alternative/, same slugs as above. ## Blog - [Blog index](https://klar.im/blog): Comparisons, privacy field guides and the mechanics of spam filtering - [BERT series](https://klar.im/blog/tag/bert) - [Models](https://klar.im/blog/tag/models) - [Is Jev the future of spam filtering?](https://klar.im/blog/jev-on-our-spam-panels): Titles ending in a question mark usually mean the answer is no. For this one, it could very well be a yes. - [iPhone Mail spam filter: what exists, what does not, and what works](https://klar.im/blog/iphone-mail-spam-filter): There is no spam filter to turn on in iPhone Mail. What filters your iPhone’s inbox, what you can do in the app, and how a Mac cleans the same mailbox. - [Spam costs a second, a message, or your savings](https://klar.im/blog/what-spam-actually-costs): One a day is 365 interruptions. A wanted mail in Junk costs what it was for. A phishing mail in the inbox cost two French households their savings. - [What people say about Apple Mail spam filtering](https://klar.im/blog/what-people-say-about-apple-mail-spam-filtering): Screenshots and links from Apple’s own support forum, Hacker News and Reddit: junk in the inbox, wanted mail in the Junk folder, recovery email nobody saw. - [How to turn on and tune Apple Mail’s spam filter](https://klar.im/blog/apple-mail-junk-filter-settings): Apple Mail already filters spam, on the Mac, on iCloud.com, and on iPhone. How to turn it on, tune it, and block a sender. - [What a mailbox actually costs](https://klar.im/blog/what-a-mailbox-actually-costs): A monthly price only tells you what one mailbox costs. We divided four real prices by 1, 3, 5, 10 and 15 mailboxes to see what changes. - [Reddit is retiring the karma gate](https://klar.im/blog/reddit-karma-gate): Reddit says communities should depend less on karma and account age, and more on abuse prevention that reads the post. Email made that move years ago. - [How BERT learned to read your inbox](https://klar.im/blog/how-bert-models-work): Part one of our BERT series: how Klar’s public XLM-RoBERTa model turns an email into four scores, with figures from the papers and code from the engine. - [Spam filters protect your attention](https://klar.im/blog/why-we-need-spam-filters): Spam filters went from rules to statistics, machine learning and language models. What they protect is your attention, not your storage quota. - [How to check what a Mac app is actually allowed to do](https://klar.im/blog/what-a-mac-app-is-allowed-to-do): The App Store, TestFlight and a notarized DMG are three different guarantees. What each checks, and the command that tells you if a Mac app can phone home. - [Your inbox should own its intelligence](https://klar.im/blog/your-inbox-should-own-its-intelligence): Everyday AI belongs in software that keeps repeated, private judgment close to the user, with a specialist model for each part of the work. - [Why you shouldn’t unsubscribe from spam](https://klar.im/blog/dont-unsubscribe-from-spam): For mail you signed up for, unsubscribe freely. For actual spam, the unsubscribe button does the opposite of what you want: it confirms you’re real. - [The best anti-spam software in 2026: an honest comparison](https://klar.im/blog/meilleur-anti-spam): Which anti-spam software is best in 2026? Klar, SpamSieve, Leave Me Alone, Clean Email, SaneBox and MailWasher compared: where each runs, what it costs. - [The best Apple Mail spam filters in 2026](https://klar.im/blog/best-spam-filters-apple-mail): Six spam filters for Apple Mail compared: the built-in junk filter, Klar, SpamSieve, SaneBox, Clean Email, Leave Me Alone. Where each runs and what it costs. - [Where does your spam filter read your mail?](https://klar.im/blog/where-spam-filters-read-your-mail): Every spam filter reads your mail somewhere. Four tiers: your provider’s cloud, a vendor’s cloud, a vendor cloud without third-party AI, or your own machine. ## External references and public provenance Klar is an early product. These links corroborate its public launch, source history and named founder. Nicolas Ha is not anonymous. His public profiles, open-source commit history and UK Companies House director record establish a public identity beyond klar.im. These sources do not guarantee future availability or constitute independent accuracy or security audits, reviews or endorsements. The Mac App Store listing under Product is Apple's public distribution record. - [Launch Receipts](https://launchreceipts.com/products/klar-ai-spam-filter): Third-party product directory record linking Klar's website and public founder posts - [Builderlust](https://builderlust.com/project/klar): Third-party index of the Hacker News launch entry, linked to Klar and @nha1 - [Hacker News](https://news.ycombinator.com/item?id=48886285): Founder-authored July 2026 launch note posted as nha1 - [Reddit](https://www.reddit.com/r/MacAppsLaunches/comments/1uuw7dp/i_built_klar_a_free_ondevice_spam_filter_for/): Founder-authored launch post linking the Mac App Store, website and open-source engine - [Public engine source](https://github.com/klar-im/engine) and [commits by nha](https://github.com/klar-im/engine/commits?author=nha): Inspectable AGPL source and GitHub-attributed commit history - Founder: [Nicolas Ha](https://nicolas-ha.com/) ([LinkedIn](https://www.linkedin.com/in/nicolas-ha/), [GitHub](https://github.com/nha/), [Stack Overflow](https://stackoverflow.com/users/1327651/nha)) - [TurtleQueue Limited at UK Companies House](https://find-and-update.company-information.service.gov.uk/company/12146866): Official public register record for company 12146866. It was incorporated on 8 August 2019 and dissolved on 22 April 2025; its filed officer record lists "HA, Nicolas Dien-Long Marie" as director - [TurtleQueue setup-babashka](https://github.com/turtlequeue/setup-babashka): Open-source GitHub Action for installing Babashka so Clojure can run in CI. GitHub lists nha as its principal contributor and records 31 stars and 4 forks as of 5 August 2026, a modest public-interest signal in the Babashka/Clojure ecosystem ## Screenshots The images a listing, a directory gallery or an article needs, English, PNG, at absolute URLs. Free to use in coverage of Klar, the same terms as the press kit. Two of these panels contain Apple's own MacBook artwork and Apple Mail, which we may show as Klar running on a Mac and you may reuse in that context, so they are not a general-purpose stock image. The four panels of the Mac App Store listing, 2880x1800, in listing order. These are the gallery: they carry their own captions and are composed for exactly this. - [Intro](https://klar.im/press/appstore/en/intro.png): App Store panel: AI spam filter for Apple Mail - [Inside Mail](https://klar.im/press/appstore/en/inside-mail.png): App Store panel: Klar filtering inside the Apple Mail app on a MacBook - [Setup](https://klar.im/press/appstore/en/setup.png): App Store panel: one minute to set up, three steps in Mail settings - [On-device](https://klar.im/press/appstore/en/engine.png): App Store panel: 100% on-device processing The site itself, 2880px wide, for an article that needs the page rather than the app. - [Hero](https://klar.im/press/homepage/hero-en.png): Klar homepage hero: anti-spam for Apple Mail - [On a MacBook](https://klar.im/press/homepage/macbook-en.png): Klar checking mail over Apple Mail on a MacBook Pro - [The classifier](https://klar.im/press/homepage/classifier-en.png): A guided cut of the Klar classifier - [App icon](https://klar.im/press/klar-icon-1024.png): 1024px PNG ([on dark](https://klar.im/press/klar-icon-dark-1024.png)). This is the logo; there is no separate one, and no SVG: the icon has a gradient and a bevel, so a vector version would be a different drawing. - [Social card](https://klar.im/og-image.png): 1200x630 ([French](https://klar.im/og-image-fr.png), [German](https://klar.im/og-image-de.png)) The full set, including the French and German panels, the in-app screenshots and the one-pager, is on the press kit page below. ## Company - [About](https://klar.im/manifesto): Who builds Klar and how it is funded, the five things it will not do, and where each of the four products stands - [Press kit](https://klar.im/press): Brand assets, product description, key facts, media contact - [Klar on X](https://x.com/klarspam): @klarspam, the product's own account. Klar posts nothing anywhere else under its own name; an account claiming otherwise is not ours - [Careers](https://klar.im/careers): How Klar works and what we value; no open positions currently - [Privacy](https://klar.im/privacy): Privacy policy - [Terms](https://klar.im/terms): Terms of service - [Refund policy](https://klar.im/refund): Refunds for Klar Plus - [Cookie policy](https://klar.im/cookies): Every cookie and browser storage key the site uses, and how to refuse each one ## Optional - French and German versions of every page live under /fr and /de, for example https://klar.im/fr and https://klar.im/de/pricing - [Sitemap](https://klar.im/sitemap.xml): All indexable URLs with hreflang alternates - [Full text](https://klar.im/llms-full.txt): This manifest plus the product Q&A and every blog post, as one document # Product questions and answers ### What is Klar **What is Klar?** An AI spam filter for Apple Mail. It runs on your Mac, scores every incoming email locally, and moves spam to Junk. No account or setup beyond enabling the extension. For the first 30 days after install it flags instead of moving: spam gets a red flag and clean mail a green one, so you can see Klar working and correct any mistakes before it starts moving spam to Junk on its own. Under Filtering Settings you can switch to Move to Junk earlier, and after the trial you can switch back to flags at any time. **How is it different from Apple Mail's junk filter?** Apple Mail's built-in filter is basic and does not learn for non-iCloud accounts. Klar adds a modern on-device AI model that scores every message and, with Klar Plus, learns your inbox from your corrections. **How is it different from Gmail or an enterprise spam filter?** Those catch spam by reading every message in their cloud. Klar tackles the same job with a model that classifies each message on your device, without uploading it. **Is it any good?** On a real personal-mailbox benchmark it scores 97/100 at about a 2% false-positive rate. Classification takes a few hundredths of a second per email. ### Privacy **Why does a spam filter need AI at all?** Because spam is written to beat word lists. A rule that blocks "invoice attached" blocks the user's accountant, and a scammer only has to write "inv0ice" to get past it. Klar's model reads meaning rather than spelling: it was trained on the shape of a message, so an urgent payment demand from a stranger looks the same to it whether it is in English, French or German, spelled oddly, or phrased in a way nobody has sent before. That is why the free app has no rules to write and no language to configure. The cost is that it is a judgement rather than a certainty, which is why corrections exist. Klar Plus adds sender rules on top, for the few addresses a user wants decided by name; they override the model, and they are the exception to how the filtering works rather than the way it works. **Does Klar send my emails to a server?** No. The model runs on your Mac, and the App Store app and extension have no network access. No cloud, no API calls, no automatic telemetry. If the user chooses Email report, Klar opens an editable draft in their own mail app. The draft includes the selected originals and a removable summary of the previous calendar month's local totals; nothing is sent until the user sends it. See the Privacy Policy at klar.im/privacy. The classifier demo on klar.im is separate from the app: it runs the same model on our server in France, so anything pasted or dropped into it is sent to us to be scored. Scoring is not storing; the message is classified and discarded unless the user reports it. **I read your post comparing Klar with a hosted model (Jev). Does Klar use it?** Not the free app. That page is a benchmark: we paid for a hosted model that answers one narrow question, ran it over our own spam and legitimate-mail panels, and published what it scored beside our own model. The free Mac app and the Messages extension classify on the device and upload nothing, which does not change. Klar Plus (in development) has an optional second opinion from Jev, off until you switch it on: only for mail Klar is unsure about or about to move to Junk, the message goes to Klar's server, which keeps none of it, and TypeSafe gets the sender, the subject and the start of the text with your name, email addresses and phone numbers removed. It can be turned off at any time in Settings. The numbers on that page are Klar's model alone; the verdict in the app also uses sender authentication, brand impersonation checks and what it learns from your corrections. The post is at klar.im/blog/jev-on-our-spam-panels. **I dropped a real spam into the demo. Did it load the images in it?** No. The demo shows the message the way a mail client does, and blocks every remote image in it, saying how many it blocked. That matters more here than it looks: a tracking pixel in spam is how a sender learns that a live person opened their message, so loading one would tell the spammer you exist, from your address, on the page of a product that argues against exactly that. Messages that are HTML render in a locked-down frame with scripts, forms and network access all switched off. You can drop several .eml files at once; they are scored one at a time. There is also a "view source" toggle if you want the raw headers. **What happens if I press thumbs up or thumbs down on the demo?** That is the only thing on the site that stores a message. Pressing it saves the message you scored along with the verdict, so we can use real mistakes to improve the filter. It is never pressed for you, and classifying alone stores nothing. The stored report holds no IP address, no cookie and no account, so we cannot tell whose it is. Your browser keeps a token so you can delete it again from the same browser, and every report is deleted after 180 days regardless. Do not paste anything into the demo that you would not want us to read. **Can I verify that for myself?** Yes, and it takes a minute. The free App Store app ships without the macOS network entitlement, which means macOS refuses any outbound connection it tries to open. It is not a promise, it is a permission the app does not hold, and it is sealed into the code signature so it cannot be hidden. In Terminal, `codesign -d --entitlements - /Applications/Klar.app 2>/dev/null | grep -i network` prints nothing, and so does the same command on `/Applications/Klar.app/Contents/PlugIns/KlarMailExtension.appex`. The full walkthrough, including what App Store review, TestFlight and notarization each actually check, is at klar.im/blog/what-a-mac-app-is-allowed-to-do. **Has anyone independently audited Klar?** No. No third party has audited us, and we say so in writing rather than implying otherwise. What does exist: Apple reviews the App Store build, which is where the sandbox and the entitlements are checked; notarization means Apple scanned the build for known malware and knows who signed it, which is not a review of behaviour; and the one check that matters most you can run yourself in a few seconds, because the free app does not hold the network entitlement (see the question above). If you need a formal audit before installing software, that is a reasonable rule and we would rather you keep it than take our word for anything. klar.im/blog/what-a-mac-app-is-allowed-to-do sets out exactly what each of the three guarantees does and does not cover. **Does Klar Plus have network access?** Yes, and it is the one exception. Klar Plus is sold from klar.im as a notarized DMG, and it declares the network entitlement. Three uses always happen: checking your licence, downloading model updates, and checking whether a new version of the app is out. None of them carries your mail. The update check is how an app sold outside the App Store gets security fixes to you at all. It fetches a small signed file from klar.im, and it sends us nothing about you or your machine. A fourth use is opt-in and off by default: contributing privacy-scrubbed feature bags derived on the Mac from confirmed spam. It never uploads the raw original. Turning the switch off clears the local queue and asks the EU intake to delete that consent period's still-pending rows; an offline request stays queued and retries later, and the intake rejects late in-flight batches for that id for 30 days. Already aggregated examples contain no install identifier to match back to the request. The full list is at klar.im/local-first. **Why does macOS ask if Klar Plus can control Mail?** Klar Plus is a separate app from Mail, so it has to ask macOS's permission to read and organise your messages there, the same way any Mac app has to ask before it can act on another one. You will see this once, the first time Klar Plus needs it: a system dialog reading "'KlarPlus' wants access to control 'Mail'." This is a standard macOS Automation permission, the same kind any Mac app shows when it needs to work with another app; it is not something Klar Plus invented, and it is not a network request. Click Allow. If you click Don't Allow, Klar Plus cannot sort spam or learn from your corrections, since that is the only way it reaches Mail at all. What it does with that access stays the same as everywhere else on this page: reading and organising messages happens on your Mac, and training and classification never leave it. You can review or revoke the permission any time in System Settings → Privacy & Security → Automation. **Do you read or store my mail?** Not automatically. Classification happens locally and stays on your device. If you choose Email report, the editable draft can include selected original messages and diagnostic context. Those leave only when you send the draft yourself, and reported examples may be retained to improve the filter. Do not send confidential correspondence you are not authorised to share. **What happens when I report spam?** Klar opens an editable draft in your mail app with the selected original messages and a removable summary of the previous month's local usage totals. You can remove either before sending. The report is ordinary email, so it can contain personal data and your sending address; it is not anonymised on-device. Reported examples may be retained to improve the filter, while the monthly totals are stored separately without sender, recipient, subject, Message-ID, IP address or arrival time. **What is the spam model trained on?** Public email corpora and examples users deliberately report. Unreported legitimate mail stays on the device. A false-positive report may contain legitimate mail, so send one only when you are authorised to share the selected message. **Do you send my email to ChatGPT, Claude or another AI provider?** No. There is no API key in the app and no request to put one in. Klar's classifier is an XLM-RoBERTa transformer that ships inside the app bundle and runs on your Mac's own silicon, so no message text is sent to ChatGPT, Claude or any other outside AI provider. The free App Store app holds no network entitlement, so macOS would refuse the connection anyway. Klar is AI, it just is not somebody else's API. **Where are you based and where is data hosted?** Klar is made in France. The website and Klar-hosted services run in the EU (Scaleway, Paris); the privacy policy explains the data handled by each optional service. **We need to justify this to our DPO. What is the GDPR position?** The free app opens no connection, so there is no disclosure to a processor, no sub-processor list, and no transfer outside the EU to document. For the free app there is nothing to put in an art. 28 contract with us or an art. 30 record, because we receive nothing. Klar Plus is the part to look at: it uses the network for a licence check, model updates and a version check, none of which carries your mail, and contributing spam samples back to us is a switch that is off until someone turns it on. Turn it on and you are sending us data, which is a decision to review rather than a default. Filters that call a hosted language model are a different case again: the message text goes to that provider, which is a disclosure you have to contract for and document. The full argument, with citations, is at klar.im/for/gdpr-compliant. It is not legal advice, and a spam filter does not make anyone compliant. **Do you use cookies?** The app sets none: it is not a browser. The website sets three, all functional and none for advertising: a language preference, a support chat cookie (this chat, set once the widget loads, which happens on your first scroll or when you open it), and a password cookie on one unlisted page. Page views and three kinds of anonymous homepage experiment events are counted by a cookieless self-hosted analytics tool. The full list, including exactly what those events record and the session-replay tool that uses browser storage rather than a cookie, is at klar.im/cookies. There is no ad on the website. The full wording is at klar.im/cookies. ### Install and compatibility **How do I install it?** Get Klar from the Mac App Store, then enable it in Mail under Settings → Extensions. It installs in two clicks. **Which mail accounts does it work with?** Anything Apple Mail reads: iCloud, Gmail, Fastmail, Outlook, custom IMAP. Klar classifies the messages Mail shows you, whatever the provider. **What macOS version do I need?** macOS 14 Sonoma or later, on Apple Silicon (M1 or newer). **Does it work on iPhone or iPad?** The mail filter is a Mac app. For iPhone there is a separate free app, Klar for Messages, which filters text messages rather than email; it is in beta. See the Klar for Messages section below, or try it on klar.im/messages. **Does Klar on my Mac clean my iPhone's inbox too?** Yes, as long as the Mac is on with Mail open. Klar moves spam in the account's Junk folder (or flags it red during the first 30 days), and an iPhone on the same account shows that folder. Messages that arrive while the Mac is off stay where the provider put them until it wakes. Nothing filters mail on the iPhone itself: iOS gives mail apps no way to act on incoming messages. Details at klar.im/blog/iphone-mail-spam-filter. **How do I check Klar is registered in Apple Mail?** In Mail, open Settings → Extensions and confirm Klar is listed and ticked. Or from Terminal run `pluginkit -m -i im.klar.Klar.KlarMailExtension`; a leading `+` means it is registered and enabled. **Which languages are supported?** 100+ out of the box for the mail itself. The model detects the language automatically, no configuration. The Mac apps' own interface is in English, German and French, and follows the Mac's language setting; Klar for Messages on iPhone is English only for now. ### Apple Mail's own junk filter **How do I turn on the spam filter on my iPhone?** There is nothing to turn on in Settings. Detection already runs, server-side for iCloud and at the provider for other accounts, before the message reaches Mail. Swipe a message left, tap More, then Move to Junk, to confirm or correct it. **How do I stop getting spam on my iPhone?** Swipe the message left, tap More, then Move to Junk. For a sender who keeps coming back, tap their name at the top of the message, tap View Contact Card, then Block this Contact; their mail then goes to Trash by default (Settings > Mail > Blocked Sender Options can leave it in the Inbox, marked), not Junk. **How do I turn on the spam filter on my Mac?** Mail → Settings → Junk Mail, check Enable junk mail filtering, then pick one of three actions: mark it but leave it in the Inbox, move it to Junk, or write custom rules under Advanced. If Klar is also installed, turn this off instead, so the two do not disagree: Klar decides what stays in the Inbox. **How do I stop getting spam in my inbox at all?** Turn on the platform's own filtering on iCloud.com and iPhone, where Klar does not run. On the Mac, once Klar is installed, turn Apple Mail's own junk filtering off instead (Mail → Settings → Junk Mail, uncheck Enable junk mail filtering), so the two filters do not disagree. Block senders who keep coming back. For what still gets through, especially spam in a second language, that is what Klar is for. ### How it works **What does “one interruption a day” on the homepage mean?** The animation counts from one spam email to 365: one per day for a year. It calls each unwanted email that reaches you an interruption, and the total a year of stolen attention. It does not claim that every interruption takes a fixed number of minutes or that Klar saves a fixed amount of time or money. **Does it slow Mail down?** No. Klar checks mail in the background, so Mail stays fast. Checking a message takes a few hundredths of a second. **Does the filter learn my inbox?** With Klar Plus, yes. When you correct a mistake, the model retrains on your feedback and learns your specific inbox. Klar alone uses the base model without personalization. **Does the free app get the newer model, or only Klar Plus?** Both. An app update from the App Store carries the current model, and Mail's extension uses it from the first message it checks after the update; there is nothing to open or switch on. This starts with 1.2.0: versions up to 1.1.0 kept the model they first installed, so 1.2.0 is the first update that changes it. Klar Plus keeps its personalization on top: when an update brings a newer model, Plus replays the user's corrections against it on the next training run, so nothing they taught it is lost. **Can I adjust how aggressive it is?** Yes, in the app's Settings: Cautious (fewer false positives), Standard (balanced), or Aggressive (catches more spam). Version matters here. Up to and including 1.0.1 the picker had no effect on the free app: the extension held the Cautious threshold whatever the picker showed, because it relaxes only once Klar has learned from 100 corrections and only Klar Plus records those. From 1.1.0 an explicit choice applies immediately, and Cautious stays the default until Plus has learned. So if a user on 1.0.1 says changing it did nothing, they are right; tell them to update. ### Mistakes and accuracy **Can Klar tell me whether a particular scam message is real?** No filter can authenticate a person, recover money, or replace an independent check. Klar moves identified spam and phishing to Junk. The visual guides at klar.im/scams explain seven common patterns, show the warning signs in fictional messages, link to official sources, and give immediate next steps without claiming that one example proves every message is fraudulent. **How much does spam actually cost? Can a filter stop phishing?** Three costs, in rising order, written up with sources at klar.im/blog/what-spam-actually-costs. Spam you see costs attention: one a day is 365 interruptions a year. Wanted mail filed in Junk costs whatever the message was for (a verification code, a client's reply). A phishing mail that reaches the inbox can cost the account it names; the page cites two public French cases from 2026 and the FBI IC3 figure ($3.05bn in reported business email compromise losses in 2025, an aggregate, not anyone's expected loss). A filter reaches only the first link of that chain, the email. Everything after it (a fake page, a phone call from someone who already knows your card or IBAN) is out of any filter's reach: open the bank from your own bookmark, hang up and call the number on the card. Klar does not claim it would have caught those specific messages, and the page says so. **What if Klar misclassifies a message?** Drag it back, Junk to Inbox or Inbox to Junk, and it moves to the right folder. With Klar Plus, that correction retrains the filter and a nightly pass re-checks older mail so the next similar message lands correctly. **Why did Klar mark a legitimate email as spam?** No filter is perfect. Move it back to your Inbox or remove the flag to tidy up. On the free filter this does not retrain anything; Klar Plus is what learns from your corrections. To protect verified mail from a specific sender, turn on Trust my contacts and add them to your macOS Contacts (see below). From 1.1.0, switching to the Cautious profile also reduces false positives (on 1.0.1 the free filter was already pinned to Cautious, so there was nothing to switch). Version 1.0.1 specifically improves this for order confirmations, delivery updates and payment receipts, so update if you are on 1.0. **Can I stop Klar flagging a sender I trust?** Yes. Open the free Klar app, turn on Trust my contacts, allow Contacts access there when macOS asks, and add the sender to your macOS Contacts. Klar is the only app that requests Contacts access; Klar Plus reads the resulting on-device whitelist from their shared app data, so macOS does not ask again. While the setting is on and access is allowed, Klar leaves verified mail from that address in your Inbox. It still checks an unverified message so a spammer cannot hide behind a contact's address. Contacts are read on your Mac only and never leave the device. **How do I report a legitimate email that Klar flagged?** In the Klar app, scroll to Recent catches near the bottom, mark the message as a mistake (✗), and click "Email report". That opens a prefilled email you can read, edit and send; it includes why Klar flagged the message, attaches the stored original automatically, and shows a removable summary of the previous month's local usage totals. Delete that summary before sending if you do not want to share it. If the message is older than the five shown, click "Show more" first. If your mail app cannot take the attachment, Klar asks you to forward the original from Mail instead. If you would rather write yourself, attach the original message and send it to incorrect@klar.im. (This is the counterpart to spam@klar.im, which is for spam Klar missed.) The app's own button sends to report@klar.im whichever way the catches were marked, so a user quoting that address is not confused: it is where every in-app report goes. **Can I report several catches at once?** Yes. Click "Show more" under Recent catches, then mark each catch as caught correctly (✓) or as a mistake (✗) and click "Email report". Klar drafts one email with the original messages attached in your own mail app. Each attachment carries the mark and message class, so mixed reports remain correctly labelled. The draft also shows a removable summary of the previous month's local usage totals. As always you read, edit and send the draft yourself; nothing leaves your Mac automatically. Confirmed examples help just as much as mistakes; real examples are what improve the filter. **Does Klar upload my email to report it?** No. Klar has no network access at all, so it cannot send anything anywhere. The report is an ordinary email drafted in your own mail app: you see exactly what it contains, you can edit or delete any part of it, and nothing is sent until you press send. **What is the "Enjoying Klar?" card on the dashboard?** A card with two buttons and an ✕. "Rate on the App Store" opens Klar's App Store page on the review sheet; "Tell us what's not working" opens klar.im/feedback with the chat already open. Both are offered to everyone, whatever you think of Klar: the card never asks how you feel and then decides which one to show you. Nothing is sent either way, because Klar has no network access. All the app records is that it showed the card, so it does not show it again. The ✕ counts the same way. The card only appears once Klar has actually done something for you: the extension has to be running, it has to have caught at least 25 messages, and the app has to have been installed at least a week. It stays away for 30 days after you send any report, so it never asks for a rating right after you told us the filter got something wrong, and it does not come back for at least 120 days or until the next version, whichever is later. If you would rather rate it at a moment of your choosing, the Help menu has a permanent "Write a Review…" item. **What is klar.im/feedback, and how is it different from klar.im/support?** Support is for when you are stuck: the install steps, the FAQ, and a chat if those do not cover it. Feedback is for when Klar is working but something about it is wrong, and it opens the chat straight away rather than asking you to find a button. It also points at the two addresses that matter most for a spam filter, incorrect@klar.im for a message Klar flagged that it should not have, and spam@klar.im for spam that reached the inbox, because a real message is something we can reproduce and an opinion is not. Reports do not train the model on their own: every user report is held for a person to adjudicate before it can become a training example. Below those is the public board at klarvote.userjot.com for anything you want changed rather than fixed. The free Mac app links to it from the "Tell us what's not working" button on the "Enjoying Klar?" card. **Why was the message attached for one report but not another?** Klar keeps a copy of only the most recently caught messages, so it can attach one when you report it. Older copies are deleted automatically, and mail Klar did not flag is never stored at all. That is deliberate: Klar keeps as little of your mail as it can while still being able to show us the message you are complaining about. So if you report a catch from a while ago, the email will say the original could not be attached. Please attach it yourself, it is the single most useful thing you can include: select the message in Mail and press Shift-Command-F (Forward as Attachment). That gives us the complete email, headers included, which is what lets us reproduce the mistake and fix the cause rather than the one message. A screenshot or pasted text cannot do that, because the headers are where the answer usually is. **Klar missed a spam. What do I do?** Move it to Junk. You can also send it to spam@klar.im to help improve the filter for everyone, and how you send it matters: select the message in Mail and press Shift-Command-F (Forward as Attachment) rather than forwarding it normally. A normal forward replaces the sender's headers with yours, and the headers are usually where the answer is. If it is easier, an export from your mail client works too: we read .eml and Outlook .msg files, on their own or inside a .zip. **I got a "renewal invoice" with a phone number to call. Will Klar catch it?** Usually, and it is worth knowing why this one is different. These messages claim a subscription just renewed for a few hundred euros, attach a PDF, and give a number to call to cancel. There is often no link and no malware in the attachment at all, which is why an antivirus scan of the mail folder finds nothing: the harm happens on the call, when you are talked into installing remote-access software. Do not call the number. If you think a real subscription renewed, open the vendor's own site or app and check there. Klar catches the versions that impersonate a brand it knows, and the brand list grew on 2026-08-19 with the consumer support and billing names this family actually uses (Geek Squad, Best Buy, Norton, McAfee, DocuSign, Intuit) plus European parcel carriers (bpost, GLS, Mondial Relay, PostNL, DPD). Those land in the next release, not in a copy installed before that date. The harder version invents a name nobody lists, "Billing Department" and nothing more: Klar now recognises that one by its shape rather than its name, and that check runs in the server-side filter first. If one reaches your Inbox, move it to Junk and send it to spam@klar.im as an attachment (Shift-Command-F in Mail), which is what makes the next one catchable. ### Pricing and Klar Plus **How much does it cost?** Klar is free on the Mac App Store today, and stays free. The pricing page compares three choices directly: Klar at €0, Klar Plus at €3.99 a month, and the recommended Klar Plus yearly plan at €39 a year. Klar filters new spam; both Plus choices clean up the whole mailbox. The two paid cards show their daily equivalent. Paying yearly gives you two months free every year compared with monthly billing, and €39 is shown as a 60+% launch discount against the later €99 yearly price. Every card lists what it includes. A €150 lifetime licence remains available during checkout rather than appearing as a fourth comparison card. All prices are charged in EUR. Klar Plus is not on sale yet: these are launch prices, and they rise to €99 a year, €9.99 a month, or €399 lifetime once it ships. Join the launch list on klar.im/pricing and we will email you a discount code when Plus ships. Klar for Messages, the iPhone app, is free while it is in beta. Klar Pro, the same engine as a filter on a company's own mail server, is priced per server on request. **What is Klar Plus?** The paid companion to the free filter. It lets you see every classification, correct mistakes to retrain the model locally, clears spam already sitting in your mailbox, and sorts promotions into their own folder. Plus keeps a bounded local message corpus so previews, corrections, later model versions, disagreements and spam that a provider empties remain useful. The corpus is capped at 2 GiB and nothing in it is transmitted automatically. **How do I read the Classifications tab in Klar Plus?** Every message Klar scored is a row: the sender, the subject, and the verdict in one of four words. Spam and Gibberish are what Klar removes, Newsletter is what it sorts, Regular is what it keeps. Select a row to see how sure Klar was ("97% sure", "82% likely", "64% unsure"), which folder the message sits in, and what happened since: "Needs a look" when the verdict and the folder disagree or Klar was unsure, "Corrected by you" after you moved or confirmed it (it leaves Needs a look at that moment), "Learned" once the model has trained on your correction, which happens within about a minute. "Klar's model decided" opens the reasons. The four segments at the top are the four questions people ask: Needs a look (the default), Caught, Corrected, Everything; the Filter menu narrows any of them to one verdict or one folder. The two buttons at the bottom are the two answers for the selected row: agree with Klar ("Confirm spam", "Confirm newsletter", "Confirm regular", "Confirm gibberish", which records the verdict and moves nothing) or disagree ("Move to Junk", "Move to Inbox", or "Keep in Inbox" / "Keep in Junk" when the message is already where it belongs); the one that fixes something leads. S is always the spam-side action and H the regular-side one; More holds the flag, the whole-sender moves, the correction report and Undo. If a verdict or folder filter hides every row of a scope, the tab says "Nothing matches the filter" with a Clear filters button; the counts on the segments are per scope, before the filter. **Do I need Klar Plus for the filter to work?** No. The spam filter is free and stays free, and it runs whether or not Klar Plus is installed. The reverse is not true for new mail: Klar Plus by itself cannot catch spam as it arrives. That real-time catch happens inside Mail's own extension, which ships with the free Klar app. Klar Plus alone can still scan your mailbox and clean up spam already sitting there, but until Klar is installed too, every new message arrives unfiltered. A visual explanation is at klar.im/advanced/plus-needs-klar. **Can I allow or block a specific sender, or run a scan myself?** Both, in Klar Plus only. Its Advanced tab has sender rules: allow or block by address, and they override the model's verdict. The free Mac app has none, deliberately, because a word list is exactly what spam is written to beat (see the question above about why a filter needs AI). Sender rules are for the handful of addresses a user wants decided by name, not a way to filter a mailbox. The same tab runs the scans by hand, the last 24 hours or the whole mailbox, and starts training on demand instead of waiting for the nightly 2 AM run. Manual scans use AppleScript and can briefly slow Mail down, which is why they are not the default. **I just installed Klar Plus (or reset its database). Why isn't it showing anything yet?** As soon as Mail is confirmed ready, Klar Plus runs a one-time initial scan on its own: the newest 1,000 Inbox and Junk messages from the last 30 days, combined across both folders. It does not wait for the nightly 2 AM run or for a manual scan. If Mail was still loading, it retries a few times over the next couple of minutes rather than waiting for the next launch. This first pass is bounded on purpose: it will never import an entire large mailbox in one go, even for someone with years of mail. Older mail, or mail beyond that bound, is picked up by the regular nightly re-check. If the Classifications list still looks empty after a few minutes with Mail open, check System Settings → Privacy & Security → Automation and confirm Klar Plus can control Mail. **When is Klar Plus available and what will it cost?** It is coming soon, at a planned €39 a year, or €150 once for a licence that never renews, or €3.99 a month. These are launch prices: they rise to €99 a year, €399 lifetime, or €9.99 a month once it ships. Email launch@klar.im to get an exclusive discount code when it ships, or watch klar.im/plus. **How do I pay and cancel?** When Klar Plus launches, payments go through Paddle (cards, PayPal, Apple Pay; EU VAT handled), and you can cancel anytime and keep premium features until the end of the billing period. The free filter keeps working regardless. **Is Klar Plus priced per inbox or per Mac?** No. One Klar Plus licence covers unlimited inboxes and Macs for one person using one personal Apple Account. Enter the same licence key separately on each Mac; it does not sync through iCloud Keychain. A different person or Apple Account needs a separate licence. **I paid for Klar Plus and my licence key has not arrived.** Check the spam folder first, then write to support@klar.im from the address you paid with, or send the order reference from Paddle's receipt. We can look the purchase up and re-send the key; nothing is lost and you do not need to pay again. Keys are also re-sendable for a lifetime purchase, which is a one-off payment rather than a subscription. **Do you offer refunds?** Klar is free today, so there is nothing to refund. Once paid plans launch, refund terms will be on klar.im/refund. ### Troubleshooting **Klar Plus cannot load an email preview. What should I do?** Select the classification again or press Retry. Klar Plus reads the message from its bounded local corpus first. If the source was evicted or has not been stored yet, keep Mail open: Plus asks the recorded account and mailbox first, then Inbox, Junk and the account's other mailboxes, and stores a successful fallback back in the corpus. If macOS reports an Automation permission error, open System Settings → Privacy & Security → Automation and allow Klar Plus to control Mail. `KLAR-PLUS-PREVIEW-001` means the bounded source is unavailable and Mail no longer has a matching message. `KLAR-PLUS-PREVIEW-002` means the local source or Mail lookup failed unexpectedly. Retry once. If the same code remains, use the support chat and include the full message, the code, and the macOS and Klar Plus versions. Klar Plus shows its own version, build and loaded model identifier at the bottom of Settings, under About. You can still double-click the classification to ask Mail to open it. **Klar Plus shows a KLAR-PLUS-DB error code. What should I do?** The code identifies which part of the shared local database failed: - `KLAR-PLUS-DB-001` means Klar Plus could not find its App Group container. Reinstall Klar Plus from the official DMG into `/Applications`, then reopen it. - `KLAR-PLUS-DB-002` means macOS would not give Klar Plus access to the shared container. Reinstall Klar Plus from the official DMG into `/Applications`, then reopen it. - `KLAR-PLUS-DB-003` means Klar Plus found the container but could not initialize its SQLite database. Quit Klar, Klar Plus and Mail completely, then reopen Klar Plus. If the error remains, restart the Mac and try once more. The Classifications tab shows the same code when the database would not open for it. - `KLAR-PLUS-REVIEW-001` means the database opened but the Classifications tab could not read its rows. Press Retry once; if it remains, quit Klar, Klar Plus and Mail completely and reopen Klar Plus. Do not delete Klar's App Group folder or individual database files, and do not run a Terminal reset command. The database is shared by Klar, Klar Plus and Mail's extension; deleting part of it while one of them still has SQLite's WAL files open can turn a recoverable problem into a disk I/O error. If the code remains after the recovery step, use Copy in the red error banner and paste the complete message into this Hugo chat together with the macOS, Klar and Klar Plus versions. The code and the original SQLite detail are both needed; a screenshot is not. **How do I tell whether Klar is actually doing anything?** Open the Klar app. A green Active pill in the header means the extension has run inside Mail, the big number is how much spam it has filtered, and Recent catches at the bottom lists the actual messages with the reason for each. Read the pill as last-known activity, not as proof that Klar is registered right now: it stays green for 14 days after the last message Klar saw, so on a busy mailbox the stronger signal is a Recent catch from the last day or two. If the newest catch is weeks old, or the app shows the setup card instead of the Active pill, treat it as not running and work through the next answer. **I turned it on but nothing seems to have changed.** Start with the app, not with settings: open Klar and look at the Active pill, the spam filtered count and the date on the newest Recent catch, as above. If there is a catch from the last day or two, Klar is running and the quiet inbox has another cause; skip to the last two points. Otherwise work down this list, and check the first point even when the pill is green, since it can lag by up to 14 days. - Check the extension is on: Mail → Settings → Extensions, Klar listed and ticked. From Terminal, `pluginkit -m -i im.klar.Klar.KlarMailExtension` prints a leading `+` when it is registered and enabled. - Activating a freshly enabled extension takes two things, both required: quit Mail with Cmd+Q and reopen it, then open any email. Mail's loader only picks up the extension on relaunch, and only a message event actually starts it. Reopening Mail on its own is not enough, and missing the second half is where people get stuck. - Mail has to be running. Klar classifies messages as Mail receives them, so nothing happens while Mail is closed. - Klar only touches mail that arrives after it is switched on. Anything already sitting in your inbox stays where it is. Klar Plus adds a nightly re-check of older mail. - Know what the defaults are for your install: for the first 30 days spam is flagged in red and clean mail in green, and nothing is moved, so look for flags in the inbox rather than mail in Junk. After 30 days the default switches to Move to Junk with no flag on clean mail, so flags stop appearing; that is the trial ending, not Klar breaking. Anything you pick yourself under Filtering Settings overrides both, including Aggressiveness, whose default is Cautious until Klar Plus has learned from 100 corrections. On 1.0.1 and earlier that picker was inert on the free app, so it is never the explanation for what a user on an old version is seeing. - Your provider may already be filtering server-side, so the obvious spam never reaches Mail and there is little left for Klar to catch. That is a good outcome, not a fault. - Make sure you are on the current version from the Mac App Store. If none of that explains it, email contact@crisp.klar.im and say what the Klar app shows. **The extension does not appear in Mail Settings.** Quit Mail completely (Cmd+Q) and reopen it. If it still does not show, restart your Mac. It should then appear under Mail → Settings → Extensions. **It was in Mail Settings before and now it is gone.** Open the Klar app once, then quit Mail with Cmd+Q, reopen it and open any message. That is what restored it for the one user who has reported this, and we are treating it as a bug rather than as normal behaviour. Worth knowing: while the extension was unlisted it was not classifying anything, so mail that arrived in the meantime was never checked. If you are on Klar Plus, its nightly re-check will go back over it. **Klar is not filtering anything.** See "I turned it on but nothing seems to have changed" above. The short version: check the Klar app first, and if the extension is enabled but never activated, quit and reopen Mail and then open a message. **The Klar app says "Klar hasn't checked your recent mail".** That message means Mail asked Klar to look at mail a number of times and Klar returned no result any of those times, and the app tells you how many times and since when. Mail usually asks twice per email (once without the body, once with it), so the number is larger than the number of emails involved. It is a count Klar measured, not a guess. Quit Mail completely (Cmd+Q), open it again, then send yourself a test email; the Klar app has a button for it. That is the fix in nearly every case, and the message clears on its own once Klar checks something. Opening an old message is not enough and neither is the restart on its own: Mail starts Klar when new mail is delivered, never at launch, so it takes an actual arriving message. If it comes back after a restart, email contact@crisp.klar.im with the number and date the app shows. Klar only says this after several messages in a row with no result on the version you are running. One odd email will not trigger it, and the count starts again when you update Klar. Nothing was sent anywhere for Klar to know this. The count is written on your Mac by the part of Klar that runs inside Mail, and read by the Klar app from the same Mac. **The Klar app says "Klar is running on your Mac's processor instead of its graphics chip".** Klar normally checks each email on the Mac's graphics chip, in about a hundredth of a second. When macOS will not let the part of Klar inside Mail use the chip, Klar keeps working on the processor instead, at roughly a tenth of a second per email: nothing is lost and every message is still checked, it is just slower. Every Mac Klar supports (M1 or newer) has the chip, so this is unexpected. Quit Mail completely (Cmd+Q) and reopen it once; the line goes away on its own when the next email is checked on the chip. If it stays, send a report from the Klar app (the report carries the reason Klar recorded) or email contact@crisp.klar.im. Klar knows this the same way it knows the count above: the part of Klar inside Mail writes it on your Mac, and nothing is sent anywhere. ### Klar for Messages (iPhone text messages) **Do you filter text messages too?** Klar for Messages is a separate free iPhone app that sorts SMS and MMS from unknown senders. It is in beta, not on the App Store yet. Leave your email on klar.im/messages and we will tell you when the TestFlight beta opens. **How does it decide where a text goes?** It sends each text to one of four places: Junk for scams and smishing, Transactions for verification codes, deliveries and receipts, Promotions for marketing, and your normal inbox for everything else. Apple only shows it messages from senders who are not in your Contacts, so texts from people you know are never touched. **Where does a filtered text actually go? Is it deleted?** Not deleted, and not by us. iOS keeps filtered conversations in a separate list inside Messages, away from your normal conversations, and you never have to open it. Open one and iOS writes "Filtered by Klar" under it, so you can always see which filter moved it. Two buttons sit at the bottom: Not Spam puts the conversation back, and Delete removes it now. If you touch neither, iOS deletes the conversation itself after 90 days. That 90 days is Apple's rule for filtered messages, not a Klar setting, and there is nothing in the app that changes it. There is a picture of this screen on klar.im/messages. **Can I see it work before installing anything?** Yes. Paste a text into the box on klar.im/messages and it shows you where Klar would file it. That demo downloads the same 512 KB filter the iPhone app uses and runs it in your browser, so the text you paste is not sent anywhere. **Does it send my texts to a server?** Not by default. The filter runs on the iPhone and the message never leaves it. The app has an optional cloud check for the hardest cases, off until you switch it on in the app. When it is on, iOS itself (never the app) sends the sender and text of messages from unknown senders to klar.im. We immediately reduce both to irreversible digests, store neither the number, the text, nor your IP, see no device or account identifier, and every record expires after 30 days. Details are in the privacy policy at klar.im/privacy. **Does it filter iMessage?** No, and it cannot: Apple's message filter only ever sees SMS and MMS from senders who are not in your Contacts. iMessage is never shown to a filter extension by design. That is also why the app is called Klar for Messages rather than Klar for iMessage: Messages is the app the filtered texts appear in, and SMS and MMS are what it reads. **Which iPhones does it work on?** iPhone with iOS 16 or later. It is free. ### Company and other options **Do you write the blog with AI?** Yes, and every post says so in its byline. Most say "written with AI, reviewed by a human": the drafting is done with an AI assistant, and Nicolas Ha edits and publishes each one, so a person is answerable for what it says. The Jev comparison says "written by AI" instead, at his request. The numbers in a post are a separate matter and are not taken on trust: each one is tied to a committed measurement artifact by a test, so a figure that moves in the data fails the build rather than going stale on the page. **Who makes Klar?** Klar is built by a small team in France: one full-time engineer, Nicolas Ha, a technical partner on the machine learning side, and advisors. It is self-funded, with no investors, and the classification engine is open source (AGPLv3) on GitHub. The longer answer, including what Klar will never do and where each of the four products stands, is at klar.im/manifesto. Reach us at contact@crisp.klar.im. **Can I run Klar on my own mail server?** Klar Pro is the self-hosted option for organisations running their own mail server: Postfix or Stalwart. It is aimed at companies and self-hosters who want a modern, on-prem, GDPR-clean filter. The engine and the milter are open source (AGPLv3) at github.com/klar-im/engine; the Stalwart guide is in its stalwart/ folder and the Postfix guide in postfix/. On a Linux server with systemd (Debian 12 or Ubuntu 22.04 and later on x86_64, Debian 13 or Ubuntu 24.04 and later on arm64) the milter installs with one command from prebuilt binaries: `curl -fsSL https://raw.githubusercontent.com/klar-im/engine/main/install.sh | sudo KLAR_ACCEPT_MODEL_LICENSE=1 sh` (add KLAR_MTA=postfix for Postfix). It downloads the model at install time; the model is licensed separately, CC-BY-NC-4.0, free for non-commercial use and paid for commercial use. Non-commercial means a personal or family home server, a hobby project or academic research; filtering mail for a company (its own staff included, a trial on real staff mail too) or a paid service is commercial and needs the paid licence, which is Klar Pro, and a company trial is easy to agree in writing. When someone is unsure which side they are on, the answer is to ask hello@klar.im before deploying: Klar answers in plain words, and a yes in writing is a permission they can keep. A container image for amd64 and arm64 is at ghcr.io/klar-im/klar-milterd, and it is the route on older systems. For Stalwart, klar.im/stalwart has the install, the second command that wires Stalwart to the milter, shadow mode (Stalwart's own filter keeps scoring without filing, so an operator can compare both verdicts before switching), the requirements (about 700 MB of RAM; a median of 6 s per message on a 2-vCPU VPS and about 200 ms on an Apple M1 Pro's CPU, both CPU only as the release ships) and the answers to upgrading, uninstalling and what happens when the milter is down (Stalwart delivers the message unclassified). For details, contact contact@crisp.klar.im. **How does Klar compare to other spam filters?** There is a side-by-side table at klar.im/compare covering 23 products: Apple Mail and desktop filters such as SpamSieve, SmartInbox, MailWasher, Spamihilator, POPFile, SPAMfighter, SpamBayes and Spam Reader; provider and cloud services such as Gmail, Microsoft 365, SaneBox, Leave Me Alone, Clean Email, Inbox Zero, Mailinblack, EuropeanMX, SpamHero and Clean Mailbox; and server tools such as Libraesva, SpamAssassin, Rspamd, Postgrey and Anti-Spam SMTP Proxy Server. It compares where each one runs, who can read your mail, what it works with and what it costs. Each product also has its own page at klar.im/compare/ and klar.im/alternative/, and we say plainly where the other product is the better pick. **What does a mailbox actually cost, once you have more than one?** klar.im/blog/what-a-mailbox-actually-costs has a chart for that, in euros: monthly cost per mailbox at 1, 3, 5, 10 and 15 mailboxes, for the products in our comparison table that publish a real number for it. It is a dated post, not a permanent page, because a couple of the numbers behind it (a vendor's tier, an exchange rate) can move. A headline price only tells you what the first mailbox costs. Klar Plus (one licence per person, unlimited inboxes and Macs) and three domain-priced filters, SpamHero, EuropeanMX and Clean Mailbox, all get cheaper per mailbox as you add more, because none of them charge by the mailbox. The chart uses SpamHero's ongoing $8/month rate, not its $5 first-prepaid-year promotion, converted to a whole euro; EuropeanMX's €4.95 excludes VAT and requires billing annually, unlike the other three; and EuropeanMX caps at 100 mailboxes per domain on its entry tier, while SpamHero and Clean Mailbox meter the mail a domain receives instead (25,000 and 6,000 inbound messages a month respectively on the tiers plotted), so a domain that receives more mail than its tier allows can end up paying more, or losing filtering on the overflow, even though its mailbox count doesn't change the price. Klar Plus itself is not on sale yet: €3.99/month is the launch price we intend to charge, and it rises once the launch window ends, same as everywhere else that figure appears on the site. Klar's free app and the open-source filters in the table (SpamAssassin, Rspamd, Postgrey, ASSP, POPFile, SpamBayes, Spamihilator) stay free at any count. Everything else in the table, including SaneBox and Leave Me Alone, is priced a different way (a one-time license, bundled into Gmail or Microsoft 365, per mailbox by quote, or per person in tiers), without a monthly figure this chart could independently verify at more than one mailbox count, so it is named in the price column at klar.im/compare rather than plotted on a guess. **How does Klar compare to SmartInbox?** Both are Apple Mail extensions that can classify a message as junk without requiring a new mail client. SmartInbox sends the message data you select to an OpenAI-compatible endpoint: that can be a local model through LM Studio, which keeps processing on the Mac, or a hosted API, which receives the enabled headers or full content. Klar bundles its 315 MB multilingual XLM-RoBERTa classifier in the app, so there is no endpoint, model server or prompt to configure. SmartInbox is $4.99 once with an unlimited free trial whose prompt cannot be edited; Klar is free. SmartInbox requires macOS 15.2 or later, while Klar requires macOS 14 or later on Apple Silicon. SmartInbox's developer says the app is no longer actively developed because of low interest, and its latest listed release is version 1.0.1 from January 2025. Pick SmartInbox if writing the prompt and running your own local LLM is the point. Pick Klar if you want a maintained filter with the model already inside it. Full detail at klar.im/alternative/smartinbox. **How does Klar compare to Inbox Zero?** They solve different problems. Inbox Zero is an AI email assistant for Gmail and Outlook: it sorts your inbox, drafts replies in your style, blocks cold outreach and unsubscribes in bulk. Its hosted service starts at $18 per user per month billed annually and has no free plan. Connecting a Gmail account grants it the gmail.modify permission, so it can read, change, send and trash any message, and its published subprocessor list names six AI model providers that message content goes to, either directly or through OpenRouter. It is built in Israel and incorporated in Delaware, and its privacy policy says data may be processed in the United States or other countries where its providers operate. It is also open source and can be self-hosted against a local model with Ollama, which keeps mail on your own hardware; that path needs Postgres, Redis, your own Google OAuth app and a machine to run it on. Klar is a spam filter, not an assistant: the free app classifies on your Mac inside Apple Mail and gets spam out of your way (flagged red for the first 30 days, moved to Junk after), and Klar Plus is the paid companion described above. Neither drafts replies, and classification is on-device in both. Full detail at klar.im/alternative/inboxzero. **How does Klar compare to SpamHero?** They filter at different points. SpamHero is a hosted gateway: you point your domain's MX records at it, it filters every message for the domain and delivers what survives to your mail server, with a shared quarantine, message logs and archiving that run from 7 to 30 days depending on the tier, five days of mail bagging if your server is unreachable, and an outbound relay on the higher plans. That means it needs control of the domain's DNS, so it is not an option for an @gmail.com, @icloud.com or employer address. It is priced per domain with unlimited addresses, in four tiers. The entry tier is $5 per month on a first prepaid year ($60), $84 a year after that, or $8 per month billed monthly, with 25,000 inbound messages and 7 days of archiving; more capacity is $5 per month per 100,000 messages, and the top tier is $99 per month. There is a 30-day trial and no free plan. SpamHero is a service of iSparks, inc. in Pleasant Grove, Utah, so mail for your domain is processed in the United States; its privacy policy covers European transfers with standard contractual clauses and names EU and UK representatives. The two also work differently: SpamHero advertises over 22 million filter rules and more than 100 million senders tracked, a central feed that has to be kept current, whereas Klar has no rules and no sender lists and reads the shape of a message instead, so nothing has to arrive daily for it to keep working. Klar also meters nothing: no message quota, no overage, no per-mailbox count, no limit on volume, because there is no server in the path. It classifies on your Mac inside Apple Mail, on any account, and changes nothing in DNS. Pick SpamHero when you run a domain and want one filter in front of every mailbox before delivery; pick Klar when you want personal, on-device filtering with nothing to reroute. If you want that same server-side shape without sending mail to a third party, Klar Pro runs our engine as a milter on your own Postfix or Stalwart server. Full detail at klar.im/alternative/spamhero. **Is Klar an "inbox zero" tool?** No, and it is worth knowing where that phrase comes from. Merlin Mann coined Inbox Zero on his blog 43 Folders in 2006. The zero never meant an empty inbox; it meant how much of your attention the inbox takes, and he has said since that the empty-inbox reading is a misinterpretation. Klar does not snooze, archive or draft anything. The free app handles spam and nothing else (red flags for the first 30 days, then straight to Junk); Klar Plus adds a promotions folder. Either way it removes mail so there is less to pay attention to in the first place, rather than helping you process more of it. The product at getinboxzero.com is unrelated to Merlin Mann. It is a separate company that took the phrase, which is catchy, and applies it to something else. **Can I make a video about Klar, or use your logo and screenshots?** Yes, and there is a page of footage ready for it at klar.im/ugc: three vertical slides at 1080x1920, four films at 1920x1080, the app icon and the homepage screenshots. Three of the films are silent, so you can put your own voice over them. The 29-second product tour is the exception: it carries English narration and burned-in captions, and its captions are offered separately as an SRT. No permission needed and no attribution required. The same page lists the facts you can state and the five claims to avoid, the main one being an accuracy percentage: we do not publish one, so any figure in a video is invented. Journalists writing about Klar want klar.im/press instead, which has the founder photo, the brand colours, the App Store panels and a Coverage list of what others have written about Klar. **Can I request a feature, or report a bug?** Yes, on our public board at klarvote.userjot.com. Post it there, vote on what other people have asked for, and it stays visible instead of disappearing into an inbox. Bugs and feature requests each have their own board. **What are you working on next?** The roadmap is public at klarvote.userjot.com/roadmap, split into Planned, In Progress and Done. Shipped changes are listed under Updates on the same site. **I have a question that is not covered here.** Email contact@crisp.klar.im and a human will help. If you leave your email in the chat, we will follow up. # Blog, in full ## Is Jev the future of spam filtering? Published 2026-10-03 at https://klar.im/blog/jev-on-our-spam-panels Written by AI. Titles ending in a question mark usually mean the answer is no. For this one, it could very well be a yes. - Jev catches 98.6% of the spam I tested it on: 2,500 messages, mostly from a public 2026 corpus. - It costs 11 cents per 1,000 messages and answers in 680 ms a message, measured from France. - Behind Klar’s model, never on your Mac, it removes a third of Klar’s mistakes: 5.65% of messages wrong, down to 3.71%. - Every message goes to a US server, or one in twenty if Klar’s model goes first. This month TypeSafe AI came out of stealth with Jev, a hosted model that cannot chat: it takes a typed question and returns a probability. “Is this email spam?” is the obvious question to ask it, so I pitted it against Klar’s own model. It is billed per token, which came to 11 cents per thousand of my messages. Jev catches more of my spam than the model I ship, for eleven cents per thousand messages. It is not a fair fight: Klar’s filter runs on any Apple silicon Mac and nothing it reads leaves the machine. Jev runs in a data centre. ### Jev catches more, and misses newsletters and cold pitches I took the 5,000 messages I measure Klar on: 2,500 spam (2,456 from a public 2026 corpus, 44 from my own junk folder) and 2,500 legitimate, drawn in proportion from my 2025 receipts, notices and opted-in newsletters. Person-to-person mail stayed on the Mac. Three models read them: Jev, the model Klar ships today, and the one it replaced last year. ### Jev, the model Klar ships, and the one it replaced Spam caught on the spam panels, false positives on the legitimate ones, on the same 2,490 messages; each model at its own threshold, the whisker its 95% interval. | Panel (report split) | n | Jev | Klar gen3-v6 | public-v0 | | --- | --- | --- | --- | --- | | spam_2026 (recall) | 1252 | 1235 (98.6%) | 1095 (87.5%) | 485 (38.7%) | | transactional_ham_2025 (false positives) | 871 | 6 (0.7%) | 18 (2.1%) | 18 (2.1%) | | legitimate_marketing_2025 (false positives) | 345 | 7 (2.0%) | 10 (2.9%) | 11 (3.2%) | | mailbox_spam_2025 (recall) | 22 | 11 (50.0%) | 11 (50.0%) | 11 (50.0%) | Each model at its own threshold; Jev’s is the smallest at which it flags no more tune-split ham than gen3-v6 at 0.99. The reporting half only. Two of Jev's six mistakes on receipts and notices are spam I had filed as legitimate; counted that way, its rate there is 0.46%. On the same messages, Jev catches 151 spam that Klar misses and misses 11 that Klar catches (the same messages both ways, so this is not chance: p below 10-30). On receipts and notices it flags 6 where Klar flags 18. I read all six. Two are spam that had been filed as legitimate (a forwarded “final hours” offer, a “Metamask Team” notice through a newsletter platform); Klar flags the second too. Four are legitimate mail that looks like phishing, such as an exchange changing its bank details and a bank’s recruitment site on a SaaS domain. Jev’s misses are two families. It scores the newsletters I junked (an AI-tools digest, a game’s seasonal mail) 0.1 to 0.5: I subscribed once, and its definition is unsolicited bulk mail. B2B pitches (“business inquiry”, “get back to me”) land on its scale at 0.43 to 0.63; Klar, trained on thousands of them, catches 9 of the 11 at 0.99. Klar catches both families because it was trained on thousands of them. Jev has no open weights to fine-tune, so the only way to have both is to run the two together. Jev’s threshold here is 0.640, the lowest at which it wrongly flags no more legitimate mail than Klar does at its own threshold of 0.99. I set it on half the 5,000 and report on the other half. Below 0.6 its scores run low on my mail, which is why the threshold is not Jev’s own 0.5. ### What a Jev score is worth on my mail Jev scores every message from 0 to 1. Each dot is a band of those scores against how much of that band really was spam; a bigger dot is a band with more messages in it. | Predicted P(spam) bin | Mean predicted | Observed spam rate | Rows | | --- | --- | --- | --- | | 0.0 to 0.1 | 5.9% | 0.5% | 439 | | 0.1 to 0.2 | 14.0% | 0.7% | 425 | | 0.2 to 0.3 | 24.0% | 1.5% | 197 | | 0.3 to 0.4 | 34.0% | 1.1% | 87 | | 0.4 to 0.5 | 43.7% | 8.9% | 45 | | 0.5 to 0.6 | 54.4% | 36.7% | 30 | | 0.6 to 0.7 | 65.4% | 72.7% | 22 | | 0.7 to 0.8 | 75.5% | 93.7% | 63 | | 0.8 to 0.9 | 85.7% | 96.6% | 204 | | 0.9 to 1.0 | 95.2% | 100.0% | 978 | It sorts spam above legitimate mail almost perfectly: pick one of each and it ranks them right 99.65 times in 100 (AUROC). Its scores sit low on my mail below 0.6, which is why I flag at 0.64 rather than at its own 0.5. Jev repeats itself: asked the same 500 messages five times, it moved a score by 0.006 on average and changed side on 2 rows in 500. Under 0.02 is noise. > **What this means for Klar: Jev runs in a data centre, so it can only ever be a second opinion you switch on. Klar Plus, still in development, will offer it for the mail Klar is unsure about. The free app on your Mac sends nothing.** ### Send only Klar’s uncertain scores to Jev Klar scores every message from 0 to 1 and flags spam at 0.99. The band you pick is the doubtful middle: those messages get a second opinion from Jev, everything else keeps Klar’s verdict. Widen the band and the error rate falls while the bill rises. Over all 8,200 release messages. | From a score of | Up to | Share of mail sent to Jev | Klar’s error rate today | Error rate with Jev on the band | If Jev were perfect on the band | Jev’s cost per 1,000 messages | | --- | --- | --- | --- | --- | --- | --- | | 0.5 | 0.99 | 6.6% | 5.65% | 3.40% | 2.70% | $0.007 | | 0.5 | 0.999 | 25.7% | 5.65% | 3.61% | 2.56% | $0.029 | | 0.5 | everything above | 40.4% | 5.65% | 3.21% | 1.70% | $0.046 | | 0.7 | 0.99 | 5.9% | 5.65% | 3.52% | 2.90% | $0.007 | | 0.7 | 0.999 | 25.0% | 5.65% | 3.73% | 2.77% | $0.029 | | 0.7 | everything above | 39.8% | 5.65% | 3.33% | 1.90% | $0.045 | | 0.8 | 0.99 | 5.3% | 5.65% | 3.71% | 3.09% | $0.006 | | 0.8 | 0.999 | 24.5% | 5.65% | 3.91% | 2.95% | $0.028 | | 0.8 | everything above | 39.2% | 5.65% | 3.51% | 2.09% | $0.045 | | 0.9 | 0.99 | 3.2% | 5.65% | 4.01% | 3.56% | $0.004 | | 0.9 | 0.999 | 22.3% | 5.65% | 4.22% | 3.43% | $0.025 | | 0.9 | everything above | 37.1% | 5.65% | 3.82% | 2.56% | $0.042 | | 0.95 | 0.99 | 2.5% | 5.65% | 4.26% | 3.90% | $0.003 | | 0.95 | 0.999 | 21.6% | 5.65% | 4.46% | 3.77% | $0.025 | | 0.95 | everything above | 36.4% | 5.65% | 4.06% | 2.90% | $0.041 | Messages Jev did not see in this run (the person-to-person panels, and 544 of the public spam) keep Klar’s verdict, so the Jev column is a lower bound on what the band would do with all of it sent. I also handed Jev Klar’s verdict and score with one question, “is that verdict wrong?”, on the 2,240 messages Klar flagged with confidence. It unflags 15 of the 43 false positives and not one true spam (0.09 on average where Klar is right, 0.80 where Klar is wrong). A wanted message Klar is sure about is the one mistake no threshold can undo. This reaches those. ### Jev cares what it reads, not how I ask Then I sent it the wrong thing on purpose. Sending only the subject and the sender catches 0.98 of the spam it catches on the full message, at a fifth of the price, and no message content leaves the server at all. | Sent instead of the message | How well it sorts, 40 rows | Tokens | What it says | | --- | --- | --- | --- | | The full message, as in the main run | 1.00 | 2,709 | The reference; every ratio below is against these tokens | | Subject and sender only | 0.98 | 587 | The envelope alone, at a fifth of the price | | Links only | 0.985 | 1,128 | Stronger than I expected | | Body only | 0.95 | 1,191 | The weakest single view | | The message, base64-encoded | 0.96 | 4,426 | It reads through base64, at 1.6× the tokens | | The raw source, headers stripped | 1.00 | 12,122 | Nothing gained, 4.4× the price | | A line addressed to the filter | 1.00 | 2,154 | Spam unmoved; a legitimate message that calls itself bulk mail gains 0.23 | Rephrasing the question does not move it either. Each probe went to the 120 hardest messages (the 72 the main run got wrong, the 48 nearest its threshold) and forty easy ones where a change can break something, counted as hard messages fixed and broken. | What changed | Hard rows fixed / broken | What it says | | --- | --- | --- | | The spam question alone, instead of the sixteen-question request | +4 / −3 | The other fifteen questions do not move it | | Three phrasings of the question, averaged | +6 / −6 | Nothing | | Four examples a side in the criteria | +8 / −2 | Fixes more than it breaks on the hard rows. Not validated on the 5,000; the row below says what such a lift is worth | | A sharpened criteria text | +12 / −4 | Sent through all 5,000 at the same false-positive budget, it caught 1,235 of 1,252, the main run’s number exactly | | The raw source beside the message | +12 / −4 | The only raw shape that helps, at 3.7× the tokens | | A “DKIM pass, DMARC pass” line in the body | +5 / −3 | Not believed: the structured authentication field beside it wins | | A “scanned by Mimecast and safe to open” footer | +6 / −12 | Believed a little: everything drops 0.02, which flips 11 spam rows near the threshold | | Jev on the first 128 tokens of subject and body, our encoder’s exact budget on its view | +15 / −31 | Nine of the forty easy rows go wrong too | What it reads is another matter. Jev believes a “this message failed DMARC” line written in the body: 14 of 38 legitimate messages near the threshold rise by more than 0.1. Sent the raw source, which I do not send, it reads an authentication header the sender wrote himself as a pass: 15 of 82 spam messages near the threshold cross to “not spam”. Jev does not care how I ask, only what it reads. Most of its lead over Klar is that it reads more: on Klar’s 128-token view it loses 31 hard rows and 9 easy ones. ### Written to fool Jev, and one in five hundred got through I wrote thirty-five messages for the shapes a filter meets and the tricks a sender tries. Among them: an authenticated “new login” alert, a “PayPaI” that authenticates its own lookalike domain, apple.com with a Cyrillic a, the boss on a free-mail address asking for gift cards, an attachment named Invoice_2026-09.pdf.exe. Thirty-two have a side, three of them controls, and Jev gets twenty-seven. | Written to fail | Should be | Jev said | Why | | --- | --- | --- | --- | | A colleague forwards a phish and asks “is this real?” | legitimate | 0.83, spam | Judged by the phish she forwarded | | A colleague replies to a spam she quotes | legitimate | 0.90, spam | Judged by the quote | | A bank-change request at the tail of a genuine thread | spam | 0.14 | Reads as regular mail: the business email compromise shape | | The same bank change as a bare invoice | spam | 0.58 | Just under the threshold of 0.640 | | A pharma pitch after 4,500 characters of a council newsletter | spam | 0.28 | I sent the first 4,000 characters; head and tail lifts it to 0.84 at no cost on the 120 hard rows | | apple.com with a Cyrillic a, on raw source only | spam | 0.41 | A plain lookalike scores 0.90; the structured path decodes it and flags it | The same receipt and phish in thirteen languages, English to Russian, Japanese, Arabic and Turkish: Jev scores every receipt 0.02 to 0.03 and every phish 0.94 to 0.98. One of five hundred rewrites got under the threshold. Those are the hundred spam messages Jev is surest about, each rewritten five ways with every link and the ask kept: formal, condensed to a third, in French, with a claimed prior relationship, in a receipt’s layout. Klar catches 96 of the 100 originals and misses 69 of the rewrites. ### Five ways to rewrite a spam, and who they get past The hundred spam messages Jev scores highest, each rewritten once in each of five styles with every link and the ask kept. A bar is how many of a style’s hundred rewrites scored under the filter’s threshold. | Rewrites under the threshold, of 100 | Jev | Klar’s encoder | | --- | --- | --- | | Formal register | 0 / 100 | 14 / 100 | | Condensed to a third | 0 / 100 | 9 / 100 | | Translated into French | 0 / 100 | 17 / 100 | | A claimed prior relationship | 1 / 100 | 13 / 100 | | A receipt’s layout | 0 / 100 | 16 / 100 | Translating into French is the cheapest of the five against Klar and costs Jev nothing, which is what a filter reading the language rather than the words looks like. Everything else a sender can do for free (unicode tricks, HTML tags, capitals, an unsubscribe header, a Reply-To at a big brand) moves nothing, or moves the wrong way for him. The one lever is on the other side: a corporate signature block pushes borderline legitimate mail toward spam by about 0.1. ### The colleague who gets past Jev ### Thirty spam messages, the newest part written by two hands The same thirty real spam messages quoted under a note that grows from nothing to a hundred words, written by a colleague who authenticates or by the spammer himself. | The same thirty real spam messages inside | Still spam, of 30 | | --- | --- | | The message as sent | 30 | | A colleague’s reply, one line of her own, the message quoted | 11 | | Her forward with “FYI, is this real?” | 26 | | Her forward without a word | 30 | | The message newest, a genuine thread quoted below | 30 | | Words of the newest part’s own text | 0 | 20 | 50 | 100 | | --- | --- | --- | --- | --- | | A colleague replying (still spam, of 30) | 30 | 8 | 6 | 2 | | The spammer himself, his pitch quoted (still spam, of 30) | 30 | 30 | 30 | 24 | At two hundred words her count rises back to 4 of 30: the synthetic prose starts repeating itself, which the judge reads as filler, so that point is left off the curve. Two misses at the top of the table point the same way, so I put thirty real spam messages inside a colleague’s mail. Quoted under one line of her own, 11 of 30 are still spam to Jev; forwarded with “is this real?”, 26 of 30; forwarded bare, 30 of 30. Twenty words of hers bring it to 8 of 30, a hundred to 2 of 30. The spammer cannot do the same from his own address: his pitch over six hundred quoted words of a genuine thread stays spam 30 of 30, and a hundred words of office prose over the quoted pitch is still spam 24 of 30. What counts is who wrote the newest part and how much they wrote. A quote under a pitch buys the spammer nothing. My first count of that reply was 23 of 30, not 11: a reviewer found the build had put her address and her authentication into the message and left the spam’s envelope sender and date in place. With every field hers, 11 of 30. The other twelve were Jev reading an envelope that disagreed with its authentication, which a spammer cannot fake from his own address. ### The same reply, built two ways The state the judge is handed for a colleague's one-line reply over a quoted spam, as first built and as corrected. | The same reply, built two ways | Still spam, of 30 | | --- | --- | | First build: the spam’s envelope sender and date left beside the colleague’s aligned DMARC | 23 | | Coherent: every field hers | 11 | A judge that reads authentication as a field reads the fields around it: an envelope sender that disagrees with an aligned DMARC is itself evidence. ### Not the teacher I also tried Jev as a labelling teacher against Claude Haiku, which labels my training corpus with a human pass behind it. On the 170 messages I judged by hand, in four classes, Haiku agrees with me 123 times and Jev 115, and they fail in opposite directions: Haiku calls legitimate marketing spam, Jev calls 15 of 19 spam “marketing”. So no: Jev stays out of the teacher’s chair. Where the two disagree is the queue a human should read. ### Where this leaves us Did I fool it? Barely: one rewrite in five hundred, a hundred words of the spammer’s own prose over a quote, and a planted authentication header in raw source I do not send. What gets past it is a real person quoting the spam, a hole in what I send rather than in the judge. Jev is hosted with no open weights. But a model that answers one narrow question with a probability need not be large: the open ones that copy its shape run from 0.3 to 4 billion parameters, and an ordinary Mac already runs Klar’s 278-million-parameter encoder. Will a Jev-like model run on a consumer machine, for one narrow problem like spam, within a few years? That question decides Klar’s next shape. Yes on a server, today, behind Klar’s own model. On your Mac, not yet. If a Jev-like model gets there, everything stays private on the machine, the case I made for [smaller models that own one task](/blog/your-inbox-should-own-its-intelligence). If it cannot, the second opinion stays what it will be in Klar Plus: an optional cloud second line of defence, off by default, for the mail Klar is unsure about, and never in the free app on your Mac. ### The Klar score here is the model’s, not the product’s Every Klar number on this page is one model alone: the encoder, at its threshold of 0.99. Klar does more with your mail. The verdict folds that score with a small model that learns from your own corrections (FTRL), then with checks on who sent the message rather than what it says: - Who signed it: SPF, DKIM and DMARC, read from the headers. - Who it claims to be: a sender named after a bank or a brand, from a domain that brand does not own. - Where its links really point. - Whether it answers a message you sent, which keeps a reply out of junk. So Jev was measured against Klar’s model, not against Klar. The full verdict on these panels is a different number, and the layer that makes it is public, with the engine, at [github.com/klar-im/engine](https://github.com/klar-im/engine). ### He gets the last word > holy smokes - should this have been our launch video? 🥹 Source: [Diogo Almeida (@CompleteSkeptic)](https://x.com/CompleteSkeptic/status/2102840267007205630), 23 September 2026 ### How it was run, and what it does not prove - Every message went out scrubbed (credentials, one-time codes, card numbers, addresses, crypto addresses, keys, my name) in Jev’s own message format: subject, body and sender headers. The raw log of every request and reply stays with me. - Every number is from the half of the messages I kept for reporting, split by a hash of each one. One request per message asked sixteen questions: the broad one, a four-class choice, Jev’s six, seven of mine, and a four-level score of how wanted the mail is. - These are my numbers on my corpus, which is not your inbox. [I say the same of every vendor](/for/lawyers), myself included. - The public spam panel is a public corpus and reads as an upper bound; a model may have trained on it. - One run of one model version, jev-1.13.0, on one day; Jev’s API moved between my reading of its docs and the run. - Nothing here runs on a Mac. Klar’s free Mac app and Klar for Messages on iPhone send nothing off the device; the hosted second opinion is an option of Klar Plus, still in development, off until you switch it on. I measured throughput from Lyon, where an empty call to Jev’s US West host is 584 ms of the 680. The model’s own share is under 100 ms and does not move with concurrency. The wait is the ocean, not the model. | In flight | Messages per second | Median latency | 95th percentile | | --- | --- | --- | --- | | 1 | 1.4 | 679 ms | 883 ms | | 4 | 5.1 | 679 ms | 912 ms | | 16 | 22.2 | 688 ms | 895 ms | ### Sources What was read and what was run. - [TypeSafe AI, the API and the guide](https://docs.typesafe.ai/) (docs.typesafe.ai, read 2026-09-17) - [The public spam corpus](https://untroubled.org/spam/) (untroubled.org spam archive, 2026) - [How Klar’s own model works](/blog/how-bert-models-work) (the encoder Jev is measured against) - [Your inbox should own its intelligence](/blog/your-inbox-should-own-its-intelligence) (my case for one specialist model per task) ## iPhone Mail spam filter: what exists, what does not, and what works Published 2026-09-15 at https://klar.im/blog/iphone-mail-spam-filter Written with AI, reviewed by a human. There is no spam filter to turn on in iPhone Mail. What filters your iPhone’s inbox, what you can do in the app, and how a Mac cleans the same mailbox. - iPhone Mail has no spam filter setting. Filtering happens before the message reaches the phone: at iCloud, or at your mail provider. - In the app you can correct, not configure: swipe a message to Junk, or block a sender who keeps coming back. - No app filters mail on the iPhone itself: iOS gives mail apps no hook. Anything sold as one is another client, or a cloud. - A Mac running Klar cleans the same mailbox: spam moves into the account’s Junk folder, which the iPhone shows. Mac on, Mail open. People search for an iPhone Mail spam filter because their iPhone inbox has spam in it and Settings has nothing that looks like a filter. Both are true, and the second explains the first. This page says what actually filters an iPhone’s mail, what the app lets you do about a message, what an app store cannot sell you, and the one setup that changes the result. ### Where an iPhone’s mail is filtered The Mail app on iPhone receives messages that a server has already sorted. For an iCloud address, Apple filters junk on its servers before the message syncs to any device. For Gmail, Outlook, or any other IMAP account, the provider’s filter runs at the provider. That is why there is no “turn on spam filter” switch in Settings: on the phone there is nothing to turn on. The [Apple Mail settings guide](/blog/apple-mail-junk-filter-settings) has the per-platform detail. > **What lands in your iPhone inbox is what your provider let through. Better filtering means a better filter somewhere upstream, not a setting on the phone.** ### What does your iPhone mail look like? The answer depends on the account and on whether a Mac reads it too. Pick the one that matches: - **An iCloud address, iPhone only: Apple’s server filter is all there is.** Move what it misses to Junk; that teaches it. Block the senders who come back. - **Gmail or Outlook, iPhone only: Your provider’s filter is all there is.** Its settings live on the provider’s website, not on the phone. Junk and Block in the app still work. - **The same account on a Mac too: The Mac can clean the mailbox for both.** Klar on the Mac moves spam in the account’s Junk folder; the iPhone shows the result. Mac on, Mail open. - **It is texts, not email: A different app: Klar for Messages.** Texts never touch a mail server. The iPhone app sorts them on the phone itself. ### What you can do in the app Two things, both corrections rather than configuration. Swipe a message left, tap More, then “Move to Junk”: for an iCloud account that also tells Apple’s filter it was wrong. For a sender who keeps coming back, tap the name at the top of the message, tap “View Contact Card”, then “Block this Contact”. By default their mail then goes to Trash, on every Apple device signed in to the same account; Settings > Mail > Blocked Sender Options can leave it in the Inbox, marked, instead. ### Why there is no iPhone app that filters your mail On the Mac, Apple Mail lets an extension read each incoming message and act on it; that is how Klar runs, on the Mac, inside Mail. On iPhone, iOS offers mail apps no such hook. A third-party app on the phone can only be a different mail client, or a service that logs in to your account from its own servers and moves messages there. The first replaces Mail; the second means a company reading your mail in its cloud. Neither is a filter running on your iPhone. ### The setup that works: a Mac cleaning the same mailbox Your iPhone and your Mac show the same account, and a mailbox lives on the server, not on either device. When Klar on the Mac moves a message into Junk, it moves it in the account’s Junk folder, so the iPhone shows it there the next time it syncs. For the first 30 days after install Klar flags spam red instead of moving it, unless you pick Move to Junk in its Filtering Settings; the flag syncs the same way. The condition is the obvious one: the Mac has to be on, with Mail open, when the message arrives. A Mac that sleeps overnight cleans the mailbox when it wakes. - Works with iCloud, Gmail, Outlook, Fastmail, and any IMAP account Mail on the Mac reads. - Nothing to install on the iPhone; the phone only shows the mailbox the Mac cleaned. - Messages the Mac never saw (arrived while it was off) stay where the provider put them until it wakes. ### Texts are a separate problem Spam texts do not go through a mail server, so none of the above touches them. For those there is [Klar for Messages](/messages), a separate free iPhone app in beta that sorts texts from unknown senders on the phone itself, which iOS does allow for messages. ### Common questions **How do I turn on the spam filter on my iPhone?** There is nothing to turn on. Filtering already runs at iCloud or at your provider before the message reaches the phone. In the app you can move a message to Junk or block a sender. **Is there a spam filter app for iPhone Mail?** Not one that runs on the phone: iOS gives mail apps no way to act on incoming messages. What is sold as one is either another mail client or a cloud service that reads your mail on its servers. **Does Klar work on iPhone?** Klar filters mail on the Mac. Because it moves spam in the account’s Junk folder, an iPhone on the same account shows the cleaned mailbox, as long as the Mac is on with Mail open. For texts there is Klar for Messages, an iPhone app. **Why does spam still reach my iPhone?** Because your provider’s filter let it through, and the iPhone shows what the provider delivered. The fix is upstream: a better filter at the provider, or a Mac running one on the mailbox. Labels and steps checked against Apple’s own support pages, September 2026: [reporting and blocking junk mail](https://support.apple.com/en-us/102376), [flagging or blocking email on iPhone](https://support.apple.com/guide/iphone/flag-or-block-emails-iph3caefa61/ios). How Klar files a message: the Mail extension asks Mail to move it to Junk, the same action as the menu item, so the move is the account’s. ## Spam costs a second, a message, or your savings Published 2026-09-11 at https://klar.im/blog/what-spam-actually-costs Written with AI, reviewed by a human. One a day is 365 interruptions. A wanted mail in Junk costs what it was for. A phishing mail in the inbox cost two French households their savings. - One spam a day is 365 interruptions a year: 17 workdays, at 23 minutes to refocus after each. - A wanted mail filed in Junk costs whatever it was for. Users report lost codes, a rescheduled show, a client’s reply. - A phishing mail in the inbox can cost the account. Two French households lost 6,000 and 8,640 euros this summer; both began with an email. - A filter reaches the first link only. After the email comes a phone call that no software can stop. Our evidence page on Apple Mail ends on one line: spam in the inbox costs a second, wanted mail in Junk costs whatever the message was for. It stops one rung short. The third cost is the account, and two public French cases from this summer put a figure on it. ### The second, 365 times a year A spam mail you see and delete costs a few seconds and a change of focus. One a day is 365 interruptions a year. Gloria Mark’s team at UC Irvine measured about 23 minutes to get back to a task after an interruption (CHI 2008). On an 8-hour day that is 17 workdays a year, and the chart scales it. ### Workdays a year spent refocusing Spam mails a day, turned into interruptions a year, at 23 minutes to refocus after each one and an 8-hour workday. | Spam a day | Interruptions a year | Workdays a year | | --- | --- | --- | | 1 | 365 | 17 | | 3 | 1095 | 52 | | 5 | 1825 | 87 | | 10 | 3650 | 175 | Arithmetic only: count × 365 × 23 minutes ÷ 480. The 23 minutes are Mark, Gudith and Klocke (CHI 2008). Arithmetic only: count × 365 × 23 minutes ÷ 480. The 23 minutes are Mark, Gudith and Klocke (CHI 2008); the count is yours. The arithmetic stops at days. Turning them into money needs a wage, and we do not know yours. ### The message, whatever it was for A wanted mail filed in Junk does not cost the minute to move it back, because nobody checks Junk daily. It costs whatever the message was for. On [our evidence page](/blog/what-people-say-about-apple-mail-spam-filtering), Apple Mail users report losing recovery mail, verification codes, Apple’s own billing notices, and a theatre’s email about a rescheduled show. One freelancer’s client now texts to confirm every email arrived. > **Spam in the inbox costs a second. Wanted mail in Junk costs whatever the message was for. A phishing mail in the inbox costs whatever is in the account.** ### The account: two households, one summer The third cost ends with money leaving. Two French cases from 2026, both public, both told by the people it happened to, and both beginning with an email. | | Murielle and Jean-Marc | Anna-Belle | | --- | --- | --- | | First contact | An email, they say on camera | An “Amazon” mail in her main inbox, 22 June | | Then | A caller who knew their IBAN, their adviser’s name and their children’s birthdays | A card page copying Amazon. Four days later, a caller citing that mail: over three hours, WhatsApp, screen sharing | | Loss | Over 6,000 euros, all their savings | 8,640 euros established, about 10,000 by her count | | Source | Cash Investigation, France 2, 10 September 2026 | Her 21-page written account | ![The caption of a france.tv Instagram reel: “On a tout perdu.” Victims of manipulation fraud, Murielle and Jean-Marc lost all their savings, over 6,000 euros. The scammers had their IBAN, their bank adviser’s name and their children’s dates of birth.](https://klar.im/blog/cost-of-spam/francetv-cash-investigation.png) *France 2, 10 September 2026. The caller already knew their IBAN, their adviser’s name and their children’s birthdays, and talked them into moving the money themselves. On camera the couple say it began with an email; the caption keeps only the call. [france.tv on Instagram, 10 September 2026](https://www.instagram.com/reels/DdD9PdRqHwR/)* “22 juin 2026 : je reçois un mail “amazon”, dans ma boite principale, qui m’indique la fin d’essai de mon abonnement Amazon Prime.” That is the first page of Anna-Belle’s account, written for her bank’s fraud service and the investigators. The page it links to asks for card details, “je trouve cela bizarre mais réalise l’action, le site est semblable à celui d’amazon”. Four days later a caller introduces himself as her bank’s anti-fraud service and cites “le mail reçu le 22 juin”. Everything after the first message is a voice on the phone, and no filter reaches it. $3.05 billion is what businesses and individuals reported losing to business email compromise in 2025, to the FBI’s Internet Crime Complaint Center. A total across complaints, in one country, for one fraud category: not your expected loss, not a claim about any filter, and not a rate. It says how large the third cost is once added up. ### Which one are you paying? Three costs, three different responses, and only one of them is a filter. The last message that was not where it should have been: what was it? - **Spam I saw and deleted: The interruption, the cheapest of the three and the only one you can see.** Count them for a week. One a day is 365 a year, and a filter that files them before you see them gives that attention back. This is the cost a spam filter is for. - **A wanted message I found in Junk: The missed message. What it cost depends on what it was for.** Add the sender to Contacts and read a week of your Junk folder once, sorted by date. Prefer a filter you can set to be cautious over one you cannot see into. - **A message asking me to act on an account: The account. A filter is the first line of defence, and only the first.** Do not use the link or the number in the message. Open the bank or the shop from your own bookmark. A caller who already knows your card or IBAN proves a leak, not that they are the bank. Hang up and call the number on your card. - **I don’t know, I never look: Then you are paying at least the second cost, and cannot see it.** Sort your Junk folder by date and read a week of it. If wanted mail is in there, it has been in there for months. ### What this page does not prove Two stories and one national figure do not measure your inbox. Four limits: - Television and Instagram select the dramatic cases. No denominator comes with them. - Both cases are manipulation fraud. The email is the first link; every later step is a phone call, a fake page, a person on the line. A filter reaches the first link only. For the couple, the email is in what they say on camera, not in the caption we reproduce; for Anna-Belle, it is the first page of her account. - The IC3 figure is reported losses, mostly from businesses, in the United States, for one fraud category. A total predicts nothing about any one inbox. - We build a spam filter, and our own engine delivered a reconstruction of the Amazon lure until a fix the same day. Nothing on this page claims we would have caught it. ### Where Klar fits Klar reads each message as it arrives on your Mac and files spam and phishing before you see it, with a language model rather than a word list, on your machine. It works on the first link of the chain and no other. For the later links, the [scam dictionary](/scams) shows the pressure patterns and where to report; for companies, the [handling-cost calculator](/for/companies) keeps the time cost and the fraud risk as two separate arguments. The evidence for the second cost is on [the Apple Mail page](/blog/what-people-say-about-apple-mail-spam-filtering). ### Every source on this page In the order they appear. Counts are as read on 11 September 2026. - [The cost of interrupted work: more speed and stress](https://ics.uci.edu/~gmark/chi08-mark.pdf) (Gloria Mark, Daniela Gudith and Ulrich Klocke, CHI 2008, the source of the 23-minute figure on our homepage) - [What people say about Apple Mail spam filtering](https://klar.im/blog/what-people-say-about-apple-mail-spam-filtering) (klar.im, 10 September 2026, the sourced complaints behind the second cost) - [« On a tout perdu. »](https://www.instagram.com/reels/DdD9PdRqHwR/) (france.tv on Instagram, reel for Cash Investigation, 10 September 2026, 2,916 likes and 196 comments) - [Cyber-arnaques : État et entreprises nous protègent-ils vraiment ?](https://www.franceinfo.fr/replay-magazine/france-2/cash-investigation/cash-investigation-cyber-arnaques-etat-et-entreprises-nous-protegent-ils-vraiment_8160290.html) (Cash Investigation, France 2, 10 September 2026, replay on franceinfo) - [Le témoignage de ma mésaventure est dans la bio](https://www.instagram.com/reels/DaJLRkgu1Oh/) (Instagram, @annabelle_explore, 11K likes and 472 comments) - [Fraude au faux conseiller bancaire, reconstitution chronologique des faits](https://drive.google.com/file/d/1c3oJ4IsazTjsceV57CxlH-oXWlQcp2ut/view) (Anna-Belle Alegre Gonthier, 21-page PDF linked from her Instagram profile; the quotes above are its first page) - [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) (FBI Internet Crime Complaint Center, business email compromise: $3,046,598,558 in reported losses) ## What people say about Apple Mail spam filtering Published 2026-09-10 at https://klar.im/blog/what-people-say-about-apple-mail-spam-filtering Written with AI, reviewed by a human. Screenshots and links from Apple’s own support forum, Hacker News and Reddit: junk in the inbox, wanted mail in the Junk folder, recovery email nobody saw. - Apple’s own support forum, Hacker News and Reddit carry years of threads about junk filtering. One of them has 192 people marking “Me too”. - The complaints run in both directions at once: spam landing in the inbox, and wanted mail landing in Junk. - The expensive version is silent. People describe losing account recovery mail and Apple’s own billing notices to the Junk folder. - This is a set of sourced anecdotes, not a measurement, and the section at the end says exactly what it does not prove. We say across this site that Apple Mail leaves a gap worth filling. Coming from a company that sells a spam filter, that is a self-serving thing to claim, so this page hands over the sources instead. Everything below is a screenshot of a public thread, with a link back to the original beside it. Read them and judge for yourself. ### Junk that lands in the inbox ![An Apple Support Communities thread titled “Automatic junk mail filtering not working”, posted 17 May 2022, showing a “Me too (192)” button.](https://klar.im/blog/apple-mail-complaints/apple-junk-not-filtering.png) *“I’ve changed my preferences in apple mail on my Mac Pro to identify and filter junk mail automatically send it to Junk mail folder. That preference is not working.” Posted in 2022, and 192 people have since pressed Me too, which is how the forum says it happened to them as well. [Apple Support Communities, 17 May 2022](https://discussions.apple.com/thread/253902032)* ![A Reddit post on r/MacOS titled “Mail App & iCloud junk filtering is totally backwards”, posted by pap3rw8, saying bank emails go straight to junk while obvious spam and phishing reach the inbox.](https://klar.im/blog/apple-mail-complaints/reddit-pap3rw8.png) *“No matter what, I cannot get my bank emails to go to my inbox. They all go straight into junk. I have added the addresses to my contacts, marked them as VIP, and yet it all still goes to junk. Meanwhile obvious spam/phishing goes straight to my inbox.” Both failures in one paragraph, from July 2026, after training the filter on macOS and iOS both. [Reddit, r/MacOS, 17 July 2026](https://www.reddit.com/r/MacOS/comments/1uyrz9a/)* That is the failure everyone pictures when they think about spam. It is also the cheaper of the two, because you see it happen and you can deal with it. The other direction costs more and shows less. ### Wanted mail that lands in Junk ![An Apple Support Communities thread titled “Mail.app Junk Mail Filtering”, posted 1 January 2023 on macOS Ventura 13.1, showing a “Me too (21)” button.](https://klar.im/blog/apple-mail-complaints/apple-mailapp-overfiltering.png) *“No amount of checking or unchecking stops Mail.app from filtering what it considers junk to the junk mail folder. I’ve done the reset, it doesn’t stop it.” The poster adds that the complaints go back many versions, and that they will have to look at other solutions. [Apple Support Communities, 1 January 2023](https://discussions.apple.com/thread/254515864)* ![A Hacker News comment by nik736 from 21 August 2025 reading “The iCloud Mail Spam filter is weird, it filters out a lot of legit mail for me.”](https://klar.im/blog/apple-mail-complaints/hn-nik736.png) *The same complaint, one sentence long, on a thread comparing iCloud Mail with Gmail. [Hacker News, 21 August 2025](https://news.ycombinator.com/item?id=44970544)* ![A Reddit comment by Maisteri on the r/iCloud megathread “Let’s Discuss: iCloud eMail”, saying legitimate email ends up in the spam folder all the time while clear spam reaches the inbox, with zero control over it.](https://klar.im/blog/apple-mail-complaints/reddit-maisteri.png) *“100% legit emails end up to spam folder all the time and on the other hand 100% clear spam end up to inbox. And what’s worst, there’s zero control over this.” The commenter moved from Gmail to iCloud Mail and is thinking about moving back. [Reddit, r/iCloud, 10 February 2025](https://www.reddit.com/r/iCloud/comments/1ghpk4b/comment/mbzw4d8/)* A Mac user on r/macapps said the same about the Mail app itself, in 2022, on a thread about which email client to use: “I have both real messages frequently going to junk and bad spam messages going to the Inbox. I’ve even added SpamSieve and it’s just a mess. I have to skim my junk mail daily to make sure I’m not missing some important message.” ![A Hacker News comment by blitzar from 2 April 2026 saying their Apple hosted mail spam filter works in reverse, with spam in the inbox and legitimate messages including Apple billing notifications in the spam folder.](https://klar.im/blog/apple-mail-complaints/hn-blitzar.png) *Worth reading twice for the parenthesis: the mail being filed as spam includes Apple’s own billing notifications. [Hacker News, 2 April 2026](https://news.ycombinator.com/item?id=47616330)* > **Spam in the inbox costs you a second and an eye-roll. Wanted mail in the Junk folder costs you whatever the message was for.** ### The silent kind ![A Hacker News thread where wafflebot says they cannot rely on iCloud Mail because of overly aggressive silent spam filtering, and cannot receive account recovery emails, with replies describing the same problem on Gmail.](https://klar.im/blog/apple-mail-complaints/hn-wafflebot.png) *“Not great if you’re trying to log into an account, and you can’t receive the recovery emails for that account.” The replies underneath describe the same failure on Gmail, including a reply to one’s own message being filed as spam. [Hacker News, 25 December 2025](https://news.ycombinator.com/item?id=46387735)* Silent is the word that matters. Nobody checks the Junk folder daily, so a filter that files the wrong message does not cost you the minute it takes to move it back. It costs you the login you could not complete, or the invoice you answered late. A commenter on another thread put the sharpest version of it: “Their spam filter is rubbish. Even emails sent between members of the same family sharing group go to spam in spite of never leaving Apple’s own infrastructure.” Reddit has the version where the message never arrives at all. On r/iCloud, in a thread asking whether to stay on iCloud Mail: “It is emails that Apple silently filters where they never reach your mailbox at all, not even the junk folder. My experience was that I had tickets to a show at a Chicago Theatre. They rescheduled the show, sent an email out to ticket holders, and I never received the email and didn’t know it was rescheduled.” Then there is the version where the cost lands on someone else. From a thread about a spouse’s reply being filed as junk: “I have one client who now texts me every time she sends an email to make sure I got it. Annoying for her and embarrassing for me.” ### Which one is happening to you? Both failures are in the threads above, and the fix is not the same. Pick the one you recognise. When you last opened your Junk folder, what was in it? - **Spam I had already seen in my inbox: The filter is missing things.** Marking each one as junk teaches Apple’s filter slowly, and on Gmail, Outlook and other IMAP accounts Mail does not learn from it at all. This is the gap a second filter reading the message itself is for. - **Mail I actually wanted: The filter is too aggressive, which is the costlier direction.** Add the sender to your Contacts, and check the Junk folder before deleting anything in bulk. A filter you can set to be cautious, rather than one you cannot see into, is the real answer. - **Nothing. I never open it: You cannot tell which of the two you have.** That is the honest and most common answer, and it is why the silent failure is the expensive one. Sort it by date and read a week of it once. - **Both, on the same day: Nothing is broken. This is what a word-matching filter does.** Filters built on words and patterns miss fluent scams and trip on unusual but genuine mail. Reading what a message means is a different mechanism, not a tuning knob. ### What this page does not prove A page of complaints is evidence that a question keeps being asked. It is not a measurement, and it would be dishonest to present it as one. Five limits, stated plainly: - A support forum is where unhappy people go. Nobody posts a thread to report that their junk folder is working, so the sample is selected by definition. Reddit is the same sample with a vote count attached, and some of the threads here have a comment defending Apple’s filter a few lines below the one we quote. - “Me too” counts how many people found a thread and recognised it. It is a popularity signal, not an incidence rate, and no denominator exists anywhere on that page. - We chose these threads, and we sell a competing product. The links are there so you can search the same forum yourself and see what an unfiltered pass turns up. One of them, the r/MacOS thread, has a reply from our own account further down recommending Klar. The screenshot stops at the original post, and the link shows the whole thread. - Apple filters mail in two different places: iCloud does it server-side, before delivery, and the Mail app has its own junk filter on the Mac. Several of the quotes above describe the iCloud side, and everything from r/iCloud does by definition. They are different systems that fail in ways users experience identically, and only the second is where Klar sits. - Three of the Reddit comments come from threads whose original post has since been deleted, by its author or with their account. The comments stand on their own and are still public, but the question they answered is gone. ### Where Klar fits Klar is a Mail extension, so it reads each message as it arrives on your Mac and files it before you ever see it. It runs a modern language model rather than a word list, which is the part that matters for scams written to read like real mail, and the classification happens on your machine rather than on a server. If you want the settings side first, we wrote up [what Apple Mail’s own junk filter can and cannot be told to do](/blog/apple-mail-junk-filter-settings), and there is a comparison with [SpamSieve](/compare/spamsieve), the long-standing local option on the Mac. What is left once the spam is in Junk is on [the quiet page](/quiet): an inbox with nothing to delete. ### Every source on this page Public threads, in the order they appear, plus the ones quoted without a screenshot. Dates are the original post or comment. - [Automatic junk mail filtering not working](https://discussions.apple.com/thread/253902032) (Apple Support Communities, 17 May 2022, 192 Me too) - [Mail App & iCloud junk filtering is totally backwards](https://www.reddit.com/r/MacOS/comments/1uyrz9a/) (Reddit, r/MacOS, pap3rw8, 17 July 2026) - [Mail.app Junk Mail Filtering](https://discussions.apple.com/thread/254515864) (Apple Support Communities, 1 January 2023, macOS Ventura 13.1) - [Junk mail filter not working](https://discussions.apple.com/thread/254655061) (Apple Support Communities, 20 February 2023, 83 Me too) - [junk mail filter](https://discussions.apple.com/thread/255425873) (Apple Support Communities, 20 January 2024, on losing the SpamSieve plug-in) - [The iCloud Mail Spam filter is weird](https://news.ycombinator.com/item?id=44970544) (Hacker News, nik736, 21 August 2025) - [Let’s Discuss: iCloud eMail](https://www.reddit.com/r/iCloud/comments/1ghpk4b/comment/mbzw4d8/) (Reddit, r/iCloud, comment by Maisteri, 10 February 2025) - [What email app is everyone using?](https://www.reddit.com/r/macapps/comments/xh98py/comment/ioxd0md/) (Reddit, r/macapps, comment by dokte, 18 September 2022) - [My apple hosted mail spam filter works in reverse](https://news.ycombinator.com/item?id=47616330) (Hacker News, blitzar, 2 April 2026) - [I can’t rely on iCloud Mail anymore](https://news.ycombinator.com/item?id=46387735) (Hacker News, wafflebot, 25 December 2025) - [Their spam filter is rubbish](https://news.ycombinator.com/item?id=30230848) (Hacker News, fauigerzigerk, 6 February 2022) - [Do I stick with iCloud Mail or go back to Gmail/Outlook?](https://www.reddit.com/r/iCloud/comments/1j0ssnt/comment/mfgkf8t/) (Reddit, r/iCloud, comment by mindfrost82, 1 March 2025, original post since deleted) - [Comment by NeemaMlozi on a thread about a reply filed as junk](https://www.reddit.com/r/iCloud/comments/1j4v8bo/comment/n150hfr/) (Reddit, r/iCloud, 3 July 2025, original post since deleted) - [Comment by Puzzled_Monk_1394 on the same thread](https://www.reddit.com/r/iCloud/comments/1j4v8bo/comment/mgxmc2z/) (Reddit, r/iCloud, 9 March 2025: “sometimes iCloud mail filtering is so aggressive a message won’t even make it to the junk folder”) - [iCloud Mail silent filtering](https://www.reddit.com/r/iCloud/comments/1kc7212/) (Reddit, r/iCloud, MarsupialDue4752, 1 May 2025, asking whether iCloud Mail “deserves to be the main email for using it with banks, tax office etc.”) ## How to turn on and tune Apple Mail’s spam filter Published 2026-09-04 at https://klar.im/blog/apple-mail-junk-filter-settings Written with AI, reviewed by a human. Apple Mail already filters spam, on the Mac, on iCloud.com, and on iPhone. How to turn it on, tune it, and block a sender. - We make Klar, a free spam filter for Apple Mail. This guide covers Apple Mail’s own built-in filter honestly, on its own terms, before saying where Klar adds to it. - Apple Mail already filters junk mail on the Mac, on iCloud.com, and on iPhone, but each platform sets it up differently, and on iPhone there is nothing to turn on at all. - On the Mac: Mail > Settings > Junk Mail, with three levels of action to pick from. - Blocking a repeat sender beats reporting it every time, and works across every Apple device you own. Apple Mail has filtered junk mail for years, but the setting is easy to miss and its actual coverage is easy to overstate. This guide collects what exists today on the Mac, on iCloud.com, and on iPhone, with the exact label in each interface, plus what still lands in your inbox once everything is turned on. > **On iPhone, there is no “turn on spam filter” button. Detection already runs elsewhere: server-side for iCloud, or at your mail provider, before the message reaches the app.** ### Where do you read your mail? The setting you need depends on the device and the account, not one central menu. Where do you want to change the filter? - **On my Mac: Mail > Settings > Junk Mail.** Three actions to choose from, plus a checkbox that reuses your provider’s own spam signal. - **On iCloud.com: The Junk folder, from “More.”** Sorting happens with a click or a drag. Nothing to turn on beforehand. - **On my iPhone or iPad: There is nothing to turn on.** Detection already runs before the message arrives. You swipe it to Junk or block the sender. - **I mainly want to block someone: Skip to the blocking section below.** The steps differ between the Mac and the iPhone. ### On the Mac: turn on and tune the filter The setting lives in Mail > Settings > Junk Mail. Check “Enable junk mail filtering,” then pick one of three actions: - “Mark it as junk mail, but leave it in my Inbox”: nothing moves, the message just gets labeled. - “Move it to the Junk mailbox”: the usual default, straight to its own folder. - “Perform custom actions”: opens an Advanced button for rules you write yourself. A separate checkbox, “Trust junk mail headers in messages,” has Mail treat any spam header your provider already attached as another signal, on top of its own filtering. A provider’s false positive carries through rather than getting corrected. To fix a mis-sorted message, select it and click the junk button in the toolbar, or drag it between the Inbox and the Junk mailbox. ### On iCloud.com: sort mail without turning anything on At icloud.com/mail there is no separate switch: select a message, click “More,” then “Move Message to Junk” (or drag it into the folder in the sidebar). A mis-sorted message is fixed the same way from the Junk folder, with “Move Message” to Inbox. Messages in the Junk folder are deleted automatically after 30 days, so it’s worth checking in every so often before that happens. ### On iPhone and iPad: nothing to turn on, only to correct This is the one that trips up the most people, because Settings has no “spam filter” option for Mail at all. Detection already runs: server-side for an iCloud account, at your provider for Gmail, Outlook, or any other IMAP account, before the message ever reaches your iPhone. What you do in the app is confirm or correct it: swipe a message left, tap More, then “Move to Junk.” Why there is no filter to install on the phone, and how a Mac cleans the same mailbox, is in [the iPhone Mail spam filter page](/blog/iphone-mail-spam-filter). ### Blocking a sender who keeps coming back Reporting every message from a repeat sender takes time. Blocking is faster and works across every Apple device you own. On the Mac, hover over the sender’s name in the message header, click the arrow, then choose “Block Contact” (macOS 14 and 15) or “Block Sender” (macOS 26 and later). The full list lives in Mail > Settings > Junk Mail > Blocked on macOS 14 and 15, or in System Settings > Privacy & Security > Blocked Contacts from macOS 26 on. On iPhone or iPad, tap the sender’s name at the top of the message, tap “View Contact Card,” then “Block this Contact”. Future messages from them go to Trash by default, not Junk (Settings > Mail > Blocked Sender Options can leave them in the Inbox, marked), and unblocking in one app unblocks it everywhere. ### What none of this catches The built-in filter handles classic spam, the kind that looks like spam. What stays in the inbox once all of this is turned on is the gray zone: cold outreach written to sound legitimate, promotions nobody asked for, and spam written in a language the filter reads poorly. That is where a dedicated filter, running on the Mac rather than in the cloud, makes a real difference. [Klar](/) classifies every message that arrives in Apple Mail on the Mac, free, with a multilingual model that needs no setup of its own. We compare Klar against five other Apple Mail filters in [our full comparison](/blog/best-spam-filters-apple-mail). ### Common questions **How do I turn on the spam filter on my iPhone?** There is nothing to turn on in Settings: detection already runs, server-side for iCloud and at your provider for other accounts. You confirm or correct it by swiping a message to Junk. **How do I stop getting spam on my iPhone?** Swipe the message left, tap More, then Move to Junk. For a sender who keeps coming back, tap their name at the top of the message, tap View Contact Card, then Block this Contact. **How do I turn on the spam filter on my Mac?** Mail > Settings > Junk Mail, check Enable junk mail filtering, then pick one of the three actions the pane offers. **How do I stop getting spam in my inbox at all?** Turn on the platform’s own filtering on iCloud.com and iPhone, where Klar doesn’t run. On the Mac, once Klar is installed, turn Apple Mail’s own junk filtering off instead (Mail > Settings > Junk Mail, uncheck Enable junk mail filtering), so the two filters don’t disagree. Block senders who keep coming back, and for what still gets through, especially in a second language, that’s what Klar is for. Settings and labels checked against Apple’s own support pages, September 2026: [reporting and blocking junk mail](https://support.apple.com/en-us/102376), [flagging or blocking email on iPhone](https://support.apple.com/guide/iphone/flag-or-block-emails-iph3caefa61/ios). ## What a mailbox actually costs Published 2026-08-31 at https://klar.im/blog/what-a-mailbox-actually-costs Written with AI, reviewed by a human. A monthly price only tells you what one mailbox costs. We divided four real prices by 1, 3, 5, 10 and 15 mailboxes to see what changes. - A monthly price only tells you what the first mailbox costs. We divided four real prices by 1, 3, 5, 10 and 15 mailboxes to see what changes. - Klar Plus and three domain-priced filters get cheaper per mailbox the more you add, because none of them charge by the mailbox. - A couple of headline numbers were not quite what they looked like once we checked: one promotional rate, one VAT-exclusive price, two hidden message quotas. - Klar's free app, and the open-source filters next to it, stay at zero no matter how many mailboxes you run. Every pricing page opens with one number. €4.95 a month. $8 a month. €3.99 a month. It is the easiest thing to compare, and it is also the least useful, because almost nobody buying a spam filter for a domain is buying it for one mailbox. So we took the four products in our own comparison that publish a real, checkable price, and divided each one by 1, 3, 5, 10 and 15 mailboxes. What came out the other side was mostly what you would expect. A couple of things were not. > **A headline price tells you what one mailbox costs. It says nothing about the fifth.** ### Four prices that get cheaper the more you use them Klar Plus is licensed per person, with unlimited inboxes and Macs. SpamHero, EuropeanMX and Clean Mailbox are all sold per domain, filtering mail at the MX record before it reaches any mailbox behind it. None of the four has a technical way to charge per mailbox even if it wanted to, so the arithmetic is simple: the same price, divided by a growing number, falls every time you add a mailbox. A per-seat tool does the opposite. Add a mailbox and the bill moves with it. That is the whole idea, and it is not ours. A recent comparison of multi-account email clients ran the same division across a different set of products and reached the same conclusion: a flat price gets more generous with scale, a per-seat price never does. Worth borrowing, applied honestly to our own market instead of copied wholesale. ### What the fine print actually says We are not going to pretend every one of these numbers was exactly what its own pricing page led with. Checking each vendor's terms directly turned up three things worth knowing before you compare anyone on price alone. - SpamHero's cheapest advertised rate needs a full year prepaid upfront and quietly renews higher after that. We used its ordinary month-to-month rate instead, the same way every other product here is priced. - EuropeanMX's number excludes VAT and requires paying for a year at once. It is the only one of the four that assumes a yearly commitment; the other three are cancel-anytime. - SpamHero and Clean Mailbox both meter the mail a domain receives, not its mailbox count. Send more mail than the tier allows and the price in this chart stops being the whole story. None of that changes which direction the four lines point. It changes what a specific number means, which is exactly the kind of thing a headline price never tells you either. ### Cost per mailbox Monthly cost per mailbox, in euros, at 1, 3, 5, 10 and 15 mailboxes on one plan. | Product | 1 mailbox | 3 mailboxes | 5 mailboxes | 10 mailboxes | 15 mailboxes | | --- | --- | --- | --- | --- | --- | | Klar Plus | €3.99 | €1.33 | €0.80 | €0.40 | €0.27 | | SpamHero | €7.00 | €2.33 | €1.40 | €0.70 | €0.47 | | EuropeanMX | €4.95 | €1.65 | €0.99 | €0.49 | €0.33 | | Clean Mailbox | €3.29 | €1.10 | €0.66 | €0.33 | €0.22 | | Free | €0.00 | €0.00 | €0.00 | €0.00 | €0.00 | ### Where you probably sit ### How many mailboxes are you actually running? The gap between these prices barely exists at one mailbox and gets hard to ignore by fifteen. Choose roughly where you land. - **Just you: Every option looks close.** At one mailbox, all four priced products here sit within a few euros of each other. The difference barely matters yet. - **You and a couple of teammates: Domain-priced tools start pulling ahead.** By three mailboxes, every flat-fee plan here has already dropped by more than half per mailbox, while anything priced per seat has not moved at all. - **A small team, five to ten inboxes: The flat fee is doing its job.** Divide a price that never changes by a growing number and the per-mailbox cost keeps falling. A per-seat tool's bill keeps climbing right alongside you. - **A whole domain, fifteen or more: This is where the shape stops being subtle.** The cheapest per-mailbox numbers on this page all belong to products that never counted mailboxes in the first place. ### What we would not put a number on Two other products in our comparison are also genuinely tiered by account count, and we looked into both before deciding not to plot them. One publishes its tier structure but renders a placeholder price through client-side scripting that never resolved to a real figure. The other has real pricing tiers, almost certainly, but the only page that could confirm the exact numbers would not load, and two secondhand sources that claimed to know disagreed with each other. A chart is only as honest as its worst number, so both stayed off it. They are still in the full [comparison table](/compare), named plainly for what they are. The rest of what we found, cell by cell, source by source, is in the chart above rather than repeated here. Divide your own mailbox count into it and see where you land. ## Reddit is retiring the karma gate Published 2026-08-06 at https://klar.im/blog/reddit-karma-gate Written with AI, reviewed by a human. Reddit says communities should depend less on karma and account age, and more on abuse prevention that reads the post. Email made that move years ago. - Reddit wants communities to rely less on karma and account age, and more on systems that judge what was written. - A karma gate is a spam filter that never reads the post. Email’s version is sender reputation, and it fails in the same direction. - Automod matches keywords. Rules Hub asks a language model whether a post matches the intent of a rule. Spam filtering ran that same transition years ago. - A language model on every post is a bill only Reddit’s scale can carry. Everyone smaller needs a cheap model in front of it. On 5 August 2026 Reddit published a note on modernizing its infrastructure and moderation tools. Most of the coverage picked up the part where Old Reddit now requires a login. The sentence that matters to anyone who builds filters is a different one: Reddit’s goal is that communities “can rely less on things like karma and account age … and more on stronger abuse prevention built into the systems they use.” ### A karma gate is a spam filter that never reads the post Karma thresholds and account-age minimums ask a question about the author, never about what the author wrote. They work because spam is a volume business: a fresh account is cheap, and a filter that charges every account a few weeks and a few upvotes before it can post makes the cheap thing expensive. The bill for that lands on the honest newcomer, who is indistinguishable from a spammer under a test that only looks at tenure. Reddit names the cost directly: new users “can encounter invisible barriers like account age and karma thresholds, unclear removals, and poor community discovery.” Email has run the same system for twenty years under other names. IP blocklists, domain age, greylisting, sender reputation scores, allowlists of people you have written to before. Every one of them is a karma gate. A newly stood-up mail server sending its first legitimate message looks exactly like a spam node, which is the single most common reason self-hosted mail lands in junk. > **A reputation gate never decides whether a message is spam. It decides whether the sender has been around long enough to be worth reading.** ### A first-time account posts. What do you check? All four run in production somewhere today. They cost different amounts and they fail in different directions. What does your filter actually look at? - **Account age and karma: Cheapest, and it never reads the post.** Stops throwaway accounts, and stops every genuine newcomer along with them. This is the gate Reddit says it wants communities to lean on less. - **A keyword and pattern list: Catches exactly what somebody already wrote down.** Automod, SpamAssassin rules, comment blocklists. Precise on spam you have seen, blind to the same message rephrased. - **A language model on every post: Reads intent, at a price per item.** This is Rules Hub. It handles nuance and edge cases, and it costs real money multiplied by millions of items a day. - **A small model that reads everything: Tens of milliseconds, no server fleet.** An encoder scores every item, and only the ambiguous middle is worth paying a language model to settle. ### Automod is a regex. Rules Hub is a model. Reddit is unusually explicit about the mechanism. Automod’s enforcement tools “depend on exact keyword and pattern matching,” while Rules Hub “uses LLMs to evaluate whether a post or comment matches the intent of a rule.” The tool is in test with over 700 communities and opens to every newly created community now. Spam filtering made that move first, and the sequence was the same: hand-written rules, then statistical word counting, then models that read the message as language rather than as a bag of tokens. Each step traded a rule a human could read for accuracy a human could measure. [Part one of our model series](/blog/how-bert-models-work) walks through what the reading step actually does. ### The part Reddit can afford and you cannot Reddit reports more than 130 million daily visitors across over 100,000 communities, submitting millions of posts and comments. A language model call per item at that volume is not a line item, it is a budget. Reddit can carry it. A Discourse forum, a wiki, a comment section, or a mail server cannot. The classifier we run is the other tier. It is an encoder: 12 layers, around 270 million parameters, 219 MB once quantized, scoring a message in tens of milliseconds on a laptop GPU with no server involved. It cannot tell you whether a post is off-topic for a particular community, and it never will, because that question needs the rule text and a model that can reason about it. It can tell you, for a fraction of a cent’s worth of electricity, whether something is spam. That is the shape of the answer for everyone who is not Reddit: the cheap model reads everything, and the expensive model only reads the slice the cheap one could not separate. ### We did not delete reputation. We demoted it. Dropping reputation entirely would be the wrong lesson. Klar still reads sender signals: the DKIM and DMARC verdicts a message carries, whether it is a reply inside a thread you started, and a brand reputation table. None of them is a gate. Each is folded onto the score the content model has already produced, and the fast statistical pre-filter is wired so it can only push a verdict toward spam, never talk one out of it. The whole engine is open source if you want to read the ordering yourself. None of that is specific to email. The model reads short text, so the same engine scores multi-turn conversations, which is what runs in [Klar for Messages](/messages) on iPhone, and what runs as a milter [on your own mail server](/self-hosted). Reddit will build its own cheap layer, on labels from a decade of moderator actions that nobody else has. That is fine. The interesting part of the announcement is not that anyone needs our engine. It is that the largest community platform on the internet just said in public that reputation gates are the wrong default and reading the content is the right one. That is the bet this product was built on, and it is nice to see it made at 130 million people a day. ### Read the original sources Every quote above comes from one of these. The first is the primary source. - [Modernizing Reddit’s Infrastructure and Moderation Tools](https://redditinc.com/news/modernizing-reddits-infrastructure-and-moderation-tools) (Reddit Inc. · 5 August 2026) - [Reddit aims to make karma less important for first-time posters](https://techcrunch.com/2026/08/05/reddit-aims-to-make-karma-less-important-for-first-time-posters-with-shift-to-ai-moderation-tools/) (TechCrunch · 5 August 2026) - [Reddit expands test of moderation tools](https://www.socialmediatoday.com/news/reddit-expands-test-of-moderation-tools/827171/) (Social Media Today · August 2026) - [klar-im/engine](https://github.com/klar-im/engine) (The classifier and decision layer described above, AGPL-3.0) ## How BERT learned to read your inbox Published 2026-08-03 at https://klar.im/blog/how-bert-models-work Written with AI, reviewed by a human. Part one of our BERT series: how Klar’s public XLM-RoBERTa model turns an email into four scores, with figures from the papers and code from the engine. - ChatGPT and Klar descend from the same research paper: Attention Is All You Need introduced the Transformer in 2017. - They took different paths through it. GPT uses a decoder to write from left to right; BERT uses an encoder to read the whole input at once. - Klar’s public model is XLM-RoBERTa-large, a multilingual BERT relative trained to sort mail into four classes. - The tokenizer, input format, pooling rule and classifier head are part of the model that ships, not packaging around it. This is part one of a two-part series. It shows the public model and code that Klar runs today. Part two will show how a BERT stack can change once it meets real mail and real hardware. ChatGPT made one branch of the Transformer family familiar: give it a prompt and it writes. BERT took the reader branch. It sees a complete text, finds how each part relates to the rest, and turns that view into a vector. A small head uses the vector to pick a label such as spam. ### BERT is the encoder half of a Transformer The first [Transformer](https://arxiv.org/abs/1706.03762) had two parts. Its encoder read the input; its decoder wrote the output. [BERT](https://arxiv.org/abs/1810.04805), short for Bidirectional Encoder Representations from Transformers, kept the reader stack. It was built to make sense of text, not to write the next token. In each layer, every token can weigh every other token. “Transfer” means one thing in a bank note and another in a match report. Its vector shifts with the words around it. BERT reads the words on both the left and the right at once. A text generator sees only the text it has written so far. ![Top: every word of a sentence linked to every other word in both directions, producing a single class. Bottom: each word linked only to the word before it, predicting the next one.](https://klar.im/blog/bert/reading-vs-writing.svg) *The central difference. An encoder weighs context on both sides of a word and ends with one vector for the whole message; a decoder sees only what came before, and predicts what comes next. [Klar diagram, after Devlin et al., 2018](https://arxiv.org/abs/1810.04805)* | Model shape | Reads | Produces | Best fit | | --- | --- | --- | --- | | BERT-family encoder | The complete input | Contextual vectors or class scores | Classification, retrieval, extraction | | Causal decoder | Tokens to the left | A probability for the next token | Writing and open-ended generation | > **ChatGPT and Klar are Transformer cousins. One branch is built to write; the other is built to read and classify.** ### Pre-training learns language. Task training gives it a job. BERT first learned from text with no labels. Its task was to hide some tokens, then guess them from the words on both sides. It also tried to tell if one sentence came after another. This long first pass built a model that could read. A smaller set of tagged text could then teach it a job such as search, mood, or question answering. Fine-tuning BERT can change more than the last layer. The first BERT recipe updates both the old weights and the new head. You can instead lock the base model and train just the head. That is cheap and safe for small updates, but it cannot change how the base model reads the text. ### One encoder idea, four useful steps BERT now names a model family, not just one set of weights. Pick a stage to see what it added and what was still missing. | BERT-family evolution | What it added | What remained | | --- | --- | --- | | BERT (2018) | A deep reader learned by filling in hidden tokens. It could then be taught many jobs. | The first weights and word set focused on English. The way it was trained was only a first pass. | | RoBERTa (2019) | It used more text, trained for longer and dropped the next-sentence task. | It trained the reader better, but did not add more languages or teach it a real-world job. | | XLM-R (2020) | One shared reader learned by filling in hidden words across one hundred languages. | It knew how text works in many tongues, but not which mail was spam or wanted. | | Four-class email model (Klar today) | XLM-RoBERTa-large, taught to sort junk text, ads, good mail and spam. | It still needs the exact tokenizer, input format, pooling rule and head it was trained with. | ### The public model Klar runs today The model in use today is [icosha/spam-xlmr-v1](https://huggingface.co/icosha/spam-xlmr-v1). It is built on XLM-RoBERTa-large and sorts a full piece of text. It has 24 layers and 16 attention heads. Each token ends up as a list of 1,024 values. Klar turns the reader into a quantized GGUF file, pulls out the four-way head, and runs both on the same device with llama.cpp and ggml. The code is under AGPLv3. The model has its own CC-BY-NC-4.0 licence. ![An email line becoming XLM-RoBERTa tokens, starting with the special token, then passing through 24 encoder layers to a 1,024-value vector.](https://klar.im/blog/bert/xlmr-input.svg) *The exact input Klar builds. The wrapper text, the tokenizer that splits “verifying” into two pieces, and the leading whose output vector stands for the whole message are all fixed by the model that was trained on them. [Klar diagram, after Devlin et al., 2018](https://arxiv.org/abs/1810.04805)* **Klar classification path** ```text RFC 822 email -> MIME parse and HTML-to-text -> normalized subject, sender and body -> canonical "User (email)" input -> XLM-RoBERTa-large encoder -> 1024-value CLS vector -> four-class head -> gibberish, marketing, regular or spam ``` Each arrow matters. If train time and run time shape the text in two ways, the head sees vectors it has never learned. The public engine avoids that split with one path for all input. It wraps the clean mail as User (email): ..., then adds the sender fields when they exist. Both scoring and local learning use this same form. > **The weights are only half of a classifier. The tokenizer, the exact wording of the input, the pooling rule and the head all travel with them.** **engine/spam_engine.cpp, shortened** ```cpp for (const auto& exchange : transcript) { std::string from_type = exchange.from_type; if (!from_type.empty()) { from_type[0] = static_cast(std::toupper(from_type[0])); } input_text += from_type + " (" + exchange.origin + "): " + exchange.text + "\n"; } if (has_any_customer_signal) { input_text += "Customer Info:\n"; if (!customer.name.empty()) input_text += "Name: " + customer.name + "\n"; if (!customer.email.empty()) input_text += "Email: " + customer.email + "\n"; } ``` ### Step 1: tokens become one sequence vector The public [GgmlEncoder](https://github.com/klar-im/engine/blob/main/engine/ggml_encoder.h) uses the token rules stored in the GGUF file. It caps the text, keeps the end token, and makes sure XLM-RoBERTa’s token is first. This is the token often called [CLS]. Once the reader has run, CLS pooling gives us one vector for the whole mail. **engine/ggml_encoder.h, shortened** ```cpp int n = llama_tokenize(vocab_, text.c_str(), text.size(), token_buf_.data(), token_buf_.size(), /* add_special = */ true, /* parse_special = */ false); if (n > max_tokens_) { n = max_tokens_; token_buf_[n - 1] = llama_vocab_eos(vocab_); } const llama_token bos = llama_vocab_bos(vocab_); if (token_buf_.empty() || token_buf_.front() != bos) { token_buf_.insert(token_buf_.begin(), bos); } auto batch = llama_batch_get_one(token_buf_.data(), token_buf_.size()); llama_encode(ctx_, batch); const float* emb = llama_get_embeddings_seq(ctx_, 0); return std::vector(emb, emb + n_embd_); ``` That first-token check guards against a real bug. One model tool wrote GGUF data that hid the token even when the code asked for it. Position zero then held the first plain word, not the whole-mail vector. The code still ran, but each vector meant the wrong thing. The model and the code that runs it must agree. > **Feed a BERT model the wrong first token and nothing breaks. It just quietly gets worse at its job.** ### Step 2: the vector becomes class probabilities The pooled vector goes through a small head: one dense layer, tanh, one output layer, then softmax. The head returns four scores: gibberish, marketing, regular mail and spam. This is where a broad text model learns the labels used for mail. **engine/spam_engine.cpp, shortened** ```cpp const auto logits = impl_->trainable_head->forward( embedding, cache_for_training); const auto probabilities = impl_->trainable_head->softmax(logits); return ClassScores{ probabilities[0], // gibberish probabilities[1], // marketing probabilities[2], // regular probabilities[3], // spam }; ``` The token limit, the encoder and the classifier head each shape a different part of the model, so a change to one buys something the others cannot. | Change | What it buys | What it costs | | --- | --- | --- | | Token cap | The model reads more of the mail. | More text costs time and memory, and training has to use the same cap. | | Encoder | Every mail gets a new kind of vector. | The head has to learn that new space. Conversion, pooling, size and speed all need checking again. | | Classifier head | The line between the four labels moves. | Almost none. The base model stays fixed, and this small part can learn on the device. | ### Local learning does not retrain all of BERT A full tune of the base model needs a large, well-tested mail set and an offline run. A mark from one user is small and local. Klar first gets the vector from the locked base model. It saves the head’s first pass, sends the error back through that head, and takes one guarded step. Clipped updates, a pull toward the first weights and a hard range stop a run of one-sided marks from moving the head too far. **engine/spam_engine.cpp** ```cpp float SpamEngine::train_embedding( const std::vector& embedding, int correct_label) { (void)classify_embedding(embedding, true); const float loss = impl_->trainable_head->backward(correct_label); impl_->trainable_head->step(1); return loss; } ``` This split gives each part a clear job. The large frozen encoder provides general meaning across many languages. The small head learns where this owner draws the line. Both run on the device, but only the head changes after a local correction. ### What BERT is good at, and what it is not - Good: sorting, search and fact-finding when the whole input is there from the start. - Good: small, fixed outputs with no need for a text bot or a trip to the cloud. - Not good: free-form writing. A BERT reader has no part that can write a reply. - Not enough on its own: proof of who sent the mail, trust and each user’s taste. Those facts live outside the words. Not every AI task is a chat. Some of the best tools read once, give one small answer, and fade into the app around them. That is what BERT does in [Klar](/). The full AGPLv3 code, including each sample above, is open at [github.com/klar-im/engine](https://github.com/klar-im/engine). Part two will ask what changes when we swap the base model, reshape the input and face new limits on the device. ### A bank ran the same playbook on 26 million customers Four months before this post went up, Revolut Research and NVIDIA published PRAGMA, a foundation model for banking event histories. It is not an email model, and it does not read text the way Klar does. It is worth reading anyway: a team with 26 million customer records and 32 H100s made the same structural choices described above, and hit the same wall at the end. Source: [PRAGMA: Revolut Foundation Model](https://arxiv.org/abs/2604.08649) (Ostroukhov et al. · arXiv · 9 April 2026) | Design decisions compared | PRAGMA (Revolut Research and NVIDIA, April 2026) | Klar (The engine described above, on your Mac) | | --- | --- | --- | | Encoder, not decoder: Same choice | Encoder-only and bidirectional, chosen because the goal is transferable representations for discriminative financial tasks rather than open-ended generation. | An XLM-RoBERTa encoder that ends at four scores. Nothing in the model is able to write a sentence, and nothing needs to. | | Learns by filling in blanks: Same choice | Masked modelling, following BERT, over 207 billion tokens from 26 million anonymised records across 111 countries. It hides single tokens, whole events and whole field types. | XLM-R learned the same way across one hundred languages, long before anyone showed it an email. | | The input format is part of the model: Opposite answer, same rule | It refuses to serialise records as text. That inflates sequence length, and splitting numbers into digit fragments discards magnitude and ordering. Every field becomes a key, a value and a time coordinate instead. | Mail is already text, so the text path is the right one. The wording is still fixed: the same “User (email):” wrapper at training time and at run time. | | A frozen trunk with a small head: Same choice | Freeze the backbone, fit a linear probe on the embeddings, which takes a couple of minutes. Deeper adaptation moves 2 to 4 percent of the weights with LoRA. | Freeze the encoder, train the four-class head, one guarded step per correction, all of it on the device. | | Bigger is not automatically better: Same finding | The 10-million-parameter variant already beats the task-specific production models. Scaling to 1 billion pays off on credit scoring, at 35.2 percent more PR-AUC, and moves recurrent transactions by 0.4 percent. | Klar’s next encoder is smaller than the one in the App Store, 270 million parameters against 550 million, and more accurate. | | What the encoder cannot see: Same limit | On anti-money laundering it loses to the incumbent model by 47.1 percent. That signal is relational, and PRAGMA reads each event history in isolation. | The limit listed above, in other words: who actually sent the mail, and whether they can be trusted, is evidence from outside the text. | The differences are as instructive as the parallels. PRAGMA is a billion-parameter model on 32 H100s, reading years of transactions to price credit risk; Klar is a 550-million-parameter model reading one message on your laptop, with nothing leaving the machine. What survives that gap in scale is the shape: read the whole input at once, learn the language by filling in blanks, freeze that and hang a small head off it, and accept that whatever lives outside the words stays outside the model. > **A bank with 26 million customers and a GPU cluster did not reach for a chatbot to price credit risk. It trained a reader.** ### Read the original sources These papers and source trees are the useful path from the original Transformer to the engine above. - [Attention Is All You Need](https://arxiv.org/abs/1706.03762) (Vaswani et al. · 2017) - [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://arxiv.org/abs/1810.04805) (Devlin et al. · 2018) - [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://arxiv.org/abs/1907.11692) (Liu et al. · 2019) - [Unsupervised Cross-lingual Representation Learning at Scale](https://arxiv.org/abs/1911.02116) (Conneau et al. · 2020) - [PRAGMA: Revolut Foundation Model](https://arxiv.org/abs/2604.08649) (Ostroukhov et al. · 2026) - [Klar public XLM-RoBERTa spam model](https://huggingface.co/icosha/spam-xlmr-v1) (icosha · CC-BY-NC-4.0) - [Klar spam-detection engine and Postfix milter](https://github.com/klar-im/engine) (Klar · AGPLv3) ## Spam filters protect your attention Published 2026-08-02 at https://klar.im/blog/why-we-need-spam-filters Written with AI, reviewed by a human. Spam filters went from rules to statistics, machine learning and language models. What they protect is your attention, not your storage quota. - Spam is asymmetric: it is cheap to send and costly to judge. - Filtering evolved from rules to statistics to AI. Each layer still has a job. - Generative AI makes polished, multilingual volume cheap for attackers too. - The real thing a filter protects is not storage. It is human attention. Spam is cheap for the sender and costly for the reader. One message takes seconds to delete, but first it makes you stop, read enough to judge it, decide, and recover what you were doing. > **A spam filter does more than tidy your inbox. It protects the one resource AI cannot make more of: your attention.** We do not see the true scale because good filters are invisible. In 2023, Google said Gmail was [blocking nearly 15 billion unwanted emails every day](https://blog.google/products-and-platforms/products/gmail/gmail-security-authentication-spam-protection/). We notice the few that get through, not the flood that never gets a chance to interrupt us. ### One message, five mental moves A deletion looks like one action. The interruption around it is the real cost. Run the tiny demo to see the work hidden inside “just delete it”. 1. Focus 2. Notice 3. Scan 4. Decide 5. Refocus ### The problem is older than email as we know it In 1975, [RFC 706 described the “junk mail problem”](https://www.rfc-editor.org/rfc/rfc706.html) on the ARPA network. A computer that wanted some messages had to accept and examine all of them. The cost was processor time, network capacity and delay. Replace the processor with a person and the diagnosis still fits. Four years earlier, Herbert Simon made the wider point in [“Designing Organizations for an Information-Rich World”](https://gwern.net/doc/design/1971-simon.pdf). When information grows rich, attention grows scarce. He argued that a good information system should filter input into something that demands fewer hours of attention. Spam is that imbalance in its purest form: the sender can make another copy almost for free, while every reader spends a piece of a finite day deciding it is worthless. ### From rules to probabilities The first filters used rules and trust scores. Refuse a known bad machine. Shut a mail server that anyone could abuse. Match a suspect address or phrase. A [1999 guide from the Internet Engineering Task Force](https://www.rfc-editor.org/rfc/rfc2505.txt) described accept and refuse lists, sender checks and filters for each user. These tools were fast and clear, but an attacker could change an address, misspell a word or move to a new server. The rise of statistics changed the question. Instead of asking whether a message broke a fixed rule, a filter could ask how likely its words and other traits were to appear in spam. A [1998 paper on Bayesian junk-mail filtering](https://www.microsoft.com/en-us/research/publication/a-bayesian-approach-to-filtering-junk-e-mail/) showed how a filter could learn from examples. It also gave a different cost to blocking wanted mail and letting spam through. A spam filter could now learn, not just keep lists. ### Four generations, four useful questions New techniques did not erase the old ones. Select a stage to see what it added and why another layer was still needed. | Spam-filter generations | What it asks | Where it struggles | | --- | --- | --- | | Rules & reputation (Rules) | Do we know this sender, server or pattern? | New senders and small changes evade fixed lists. | | Bayesian statistics (1990s) | How likely are these words and features to appear in spam? | Words alone lose context, and the filter needs examples. | | Machine learning (Scale) | What does this mix of content, identity and behavior resemble? | A global system still has to serve the average user. | | Language models (Now) | What does the message mean across context and languages? | Meaning still needs trust signals and personal preference. | ### Machine learning moved the fight to patterns As email grew, providers could learn from far more than words. Today’s systems read the text and also check who sent it, where it came from, its links, the rest of the mail run and user reports. No new wave made the old one useless. A sender check asks who sent a message. Past behaviour shows what that source did before. A content model asks what the message looks like. The final question comes from the owner: did I want this? That last question matters because spam has a gray zone. A receipt is wanted. A forged receipt is not. A newsletter can be useful to one person and noise to another. The 1999 IETF guide already called for filters for each user because one set of rules could not suit everyone. ### AI changes both sides Generative AI can write decent text at low cost, in many languages and in endless forms. In 2024, the UK National Cyber Security Centre [said AI was already making phishing more effective](https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat). It could write strong lures without the poor wording, bad spelling and weak grammar that once gave them away. Word lists help less when each message can be rewritten. Defenders use AI for the same reason. A language model can read meaning in context rather than treat each word as a clue on its own. Models such as [XLM-RoBERTa](https://arxiv.org/abs/1911.02116) can do this across many languages. They are not an oracle, and they do not replace trust, sender checks or feedback. They add one thing to the stack: a better reading of the message itself. ### The bottleneck is now attention AI can help one person draft a report, write code or plan a campaign faster. It cannot add another hour to the reader’s day. Once tools make more of everything, the scarce job is deciding which of it deserves a person. > **As tools make more, choosing what deserves a human matters more.** Spam taxes attention at the worst time: before you know the message is worthless. Work you choose can wait. Spam demands a small choice now. It makes the reader review the sender’s work for free. Then the reader must find the thread of what mattered before. This is also why the score alone is not enough. Spam that gets through spends attention. Good mail sent to junk hides something that earned it and harms trust in the filter. A useful system has to be firm with clear noise, careful with wanted mail and able to learn the gray zone for each user. ### A filter decides what earns a human The best defense still has layers. Stop known sources of abuse before they send mail. Check that real senders are who they claim to be. Use modern models to read the text. Learn from the person who owns the inbox. Most of all, decide before an alert, preview or unread count makes that person decide instead. > **The best spam filter is the decision you never had to make.** [Klar](/) is built around that principle. A multilingual XLM-RoBERTa model classifies each message on your Mac, inside Apple Mail. The message is not sent to a cloud AI service. The goal is not to make the inbox intelligent for its own sake. It is to make less of the inbox demand you. ### Read the original sources Every historical and technical claim above links to the source it came from. These are the seven useful starting points. - [New Gmail protections for a safer, less spammy inbox](https://blog.google/products-and-platforms/products/gmail/gmail-security-authentication-spam-protection/) (Google · 2023) - [RFC 706: On the Junk Mail Problem](https://www.rfc-editor.org/rfc/rfc706.html) (RFC Editor · 1975) - [Designing Organizations for an Information-Rich World](https://gwern.net/doc/design/1971-simon.pdf) (Herbert A. Simon · 1971) - [RFC 2505: Anti-Spam Recommendations for SMTP MTAs](https://www.rfc-editor.org/rfc/rfc2505.txt) (RFC Editor · 1999) - [A Bayesian Approach to Filtering Junk E-Mail](https://www.microsoft.com/en-us/research/publication/a-bayesian-approach-to-filtering-junk-e-mail/) (Microsoft Research · 1998) - [The near-term impact of AI on the cyber threat](https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat) (UK NCSC · 2024) - [Unsupervised Cross-lingual Representation Learning at Scale](https://arxiv.org/abs/1911.02116) (Conneau et al. · 2020) ## How to check what a Mac app is actually allowed to do Published 2026-07-30 at https://klar.im/blog/what-a-mac-app-is-allowed-to-do Written with AI, reviewed by a human. The App Store, TestFlight and a notarized DMG are three different guarantees. What each checks, and the command that tells you if a Mac app can phone home. - You cannot inspect a closed app’s source before installation, but you can inspect its signed permissions before opening it. - The App Store and TestFlight require the sandbox. A notarized DMG does not. - The network entitlement tells you whether a sandboxed app can open its own outbound connections. - Klar and its Mail extension declare no network access. Klar Plus declares it for licensing and model updates. You cannot read the source of an app before you install it. Nobody can: everything on the App Store is a closed binary, ours included. What you can do is check what an app is allowed to do, on your own machine, after it downloads and before you ever open it. On macOS that check is real, and it takes about a minute. That check is the whole basis of Klar’s privacy claim, so this post is also the instructions for auditing us. The commands at the end work on any Mac app. ### How did the app reach your Mac? The distribution channel determines what Apple checked and whether the sandbox is mandatory. Choose the channel named by the developer. - **Mac App Store: Every build is reviewed and sandboxed.** Apple reviews each version. That does not say how an app uses data it is already allowed to read. - **TestFlight: The sandbox remains, but the build can change.** Beta review is lighter. An update can add permissions, so inspect each new build again. - **Notarized DMG: Apple checked the signature and known malware.** Notarization is not a behavior review and does not require the app to use the sandbox. ### Three ways an app reaches your Mac Klar uses all three, and they do not promise the same thing. The free app is on the Mac App Store. Betas go out through TestFlight, which is where [Klar for Messages](/messages), the iPhone filter, will open first. Klar Plus, the optional paid companion, will ship as a notarized DMG from this site. | Channel | What Apple does | What it does not do | | --- | --- | --- | | Mac App Store | Reviews every build, and requires the app to run in the sandbox | Say anything about what an app does with the data it is already allowed to see | | TestFlight | A lighter beta review, with the same sandbox requirement | Stay settled: beta builds update in place, and a new build can declare new permissions | | Notarized DMG | An automated malware scan, and a signature tied to a named developer Apple can identify | Require the sandbox. Outside the store, sandboxing is the developer’s choice | Notarization is the one most often over-read. It means Apple scanned the build for known malware and knows who signed it. It is not a review of what the app does, and it does not force the app into a sandbox. ### The sandbox is the part that actually protects you macOS grants an app access to a resource only if the app carries the matching entitlement, and entitlements are embedded in and sealed by the code signature. Apple’s Platform Security guide puts it plainly: because entitlements are part of and sealed by the code signature, “the App Sandbox trusts that these are the resources the developer intended to request.” Modify the bundle and the seal breaks, and the app will not launch. So the declared capabilities are the real capabilities. A developer cannot declare no network and quietly open a connection anyway, because opening one requires the network entitlement, and the entitlement cannot be hidden. That makes the entitlement list, rather than the privacy policy, the thing worth reading. > **A privacy policy promises. Permissions sealed by macOS limit what a sandboxed app can actually do.** ### The one line that matters It is com.apple.security.network.client. If an app declares it, it can connect anywhere, and the permission says nothing about where. If it does not declare it, macOS refuses every outbound connection it attempts, and no code inside the app changes that. For a tool that reads your mail, that is the difference between “trust us” and “it cannot”. Where a filter reads your mail is the companion question to what it is allowed to do. We mapped the four tiers of that in [an earlier post](/blog/where-spam-filters-read-your-mail). ### What Klar declares | Build | How it is signed | Network entitlement | | --- | --- | --- | | Klar, free, Mac App Store | Apple Distribution, sandboxed, hardened runtime | None, on neither the app nor the Mail extension | | Klar on TestFlight | The same build settings as the store build | None, but re-check after each beta update | | Klar Plus, notarized DMG | Developer ID, notarized and stapled, sandboxed, hardened runtime | Yes: licence check and model updates | The free app ships exactly one loadable component, KlarMailExtension.appex, and it is a Mail extension: inert until you switch it on in Mail’s settings. No background services, no login items, no launch agents, nothing that starts on its own. Beyond the sandbox it holds one privacy-relevant permission, Contacts, which is what keeps mail from people in your address book from ever being filtered. macOS prompts for it, and it is read on your Mac. Klar Plus is the exception, and we would rather write it down than let you find it. It is sold from this site rather than the App Store, it declares the network entitlement for a licence check and model downloads, and it uses AppleScript to move messages in Mail. Neither network call carries your mail, and sending spam samples back to us is a separate switch that is off until you turn it on. But once an app holds the network entitlement, the entitlement stops being the proof. What is left is our word, plus an outbound firewall such as Little Snitch or LuLu if you want to watch the wire yourself. The full list of what touches the network is on the [local-first page](/local-first). ### Check it yourself, in a minute Run this after installing Klar from the App Store and before you open it. Do it with networking off if you want to close the gap between the download landing and you looking at it. ```text APP="/Applications/Klar.app" EXT="$APP/Contents/PlugIns/KlarMailExtension.appex" # 1. Who signed it. Apple re-signs what a developer uploads, so the Team ID is # the constant, not the authority name. codesign -dv --verbose=4 "$APP" 2>&1 | grep -Ei 'TeamIdentifier|Authority=' # expect: TeamIdentifier=437587CCNF # Authority=Apple Mac OS Application Signing (an App Store download) # Authority=TestFlight Beta Distribution (a TestFlight build) # 2. What can run: one Mail extension, nothing that starts by itself find "$APP/Contents" \( -name "*.appex" -o -path "*XPCServices*" \ -o -path "*LoginItems*" -o -path "*LaunchAgents*" \) # expect: exactly one line, KlarMailExtension.appex # 3. Can either one reach the network, or drive another app? codesign -d --entitlements - "$APP" > /tmp/klar-app.ent 2>/dev/null || echo "FAILED to read the app" codesign -d --entitlements - "$EXT" > /tmp/klar-ext.ent 2>/dev/null || echo "FAILED to read the extension" grep -icE 'network|apple-events' /tmp/klar-app.ent /tmp/klar-ext.ent # expect: no FAILED line, and a count of 0 for both files ``` The first check will not name us, and that is expected: Apple re-signs what a developer uploads, so an App Store download reads Apple Mac OS Application Signing and a TestFlight build reads TestFlight Beta Distribution. The developer’s own certificate is on the upload, not on your copy. What identifies us is the Team ID, and it stays 437587CCNF. The third check is the one that counts, and it passes by printing a count of 0 for both files. It counts rather than trusting silence on purpose: if codesign cannot read the bundle, no output would look exactly like a clean result, so the check prints a number and says so loudly when it fails. Any non-zero count means the app declares network or automation capability, and you are back to deciding whether you believe what it says it does with that. If a check does not match, delete the app: nothing has run yet. One caveat for beta builds: TestFlight updates in place, and a new build is a new bundle that can declare new permissions. Re-run the checks after an update, or turn automatic TestFlight updates off. ### The engine is open source The scoring engine, the part that reads a message and returns a spam score, is AGPLv3 at [github.com/klar-im/engine](https://github.com/klar-im/engine), along with the Postfix milter that embeds it for mail servers. You can read how a message becomes a score, and build it. To be exact about the boundary: the Mac app’s interface and the trained model weights are not in that repository. What is open is the part that does the classifying. ### What we do not claim - That you can verify anything before you install. You cannot, for any closed binary, on any platform. The check happens after the download and before you open it. - That macOS asks before an app connects to the internet. It does not, there is no prompt. The guarantee comes from the permission being absent and inspectable, not from a dialog. - That a missing network entitlement means zero data can ever leave. It means no silent connection of the app’s own. A running app can still hand a URL to your browser, which is why checking offline, or behind an outbound firewall, is worth the trouble. - That an independent third party has audited us. None has. Everything above is checkable by you, which is the point of writing it down. Klar is free on the [Mac App Store](https://apps.apple.com/app/id6779155674). macOS 14 or later, Apple Silicon. ## Your inbox should own its intelligence Published 2026-07-29 at https://klar.im/blog/your-inbox-should-own-its-intelligence Written with AI, reviewed by a human. Everyday AI belongs in software that keeps repeated, private judgment close to the user, with a specialist model for each part of the work. - General cloud models fit new, open-ended questions. Repeated private decisions have a different shape. - Inbox classification is frequent, sensitive, personal, and easy for the user to correct. - A shared model provides the baseline. Local learning handles the boundary only the owner can define. - Privacy becomes structural when the message, correction, and learned judgment stay on the device. For the last few years, AI has largely meant sending data to an increasingly powerful model in the cloud. That makes sense when the problem is open-ended and intelligence must be rented on demand. But your inbox is different. Email classification is repetitive, personal and highly sensitive. Every correction also provides a clear signal about what the system should learn. It is exactly the kind of intelligence that should live with the user, not behind someone else’s API. This is the future of fuzzy software: give the open-ended questions to general models, and give repeated private decisions to specialist models that the product can own. ### Where should the intelligence live? Model size is not the first choice. The shape of the work tells you whether to use a rule, rent breadth, or keep a specialist close. What kind of decision is the product making? - **An exact fact: Write an explicit rule.** A known contact, sender rule, or authentication result should settle what does not need to be guessed. - **A new, open-ended question: Use a general model.** Its breadth earns the cost when the task changes each time and no stable score captures the answer. - **A repeated private judgment: Use a local specialist.** The work is narrow, frequent, sensitive, and measurable enough for a model the product can own. - **A personal gray zone: Learn from the owner’s corrections.** When only the user knows the right boundary, their correction should improve the local judgment. ### Fuzzy software starts where exact rules stop Traditional software is built from decisions we can specify in advance. A password either matches or it does not. A file either exists or it does not. Fuzzy software works in the space between those certainties. It decides whether a message is suspicious, a photograph is sharp enough, or a notification deserves your attention. Those decisions still need rules, but rules cannot finish the job. “Invoice attached” may be a phishing lure, a bill from a supplier, or the subject line your accountant uses every month. The words are the same. The meaning depends on language, sender, history and the person receiving it. A frontier model can reason about that ambiguity. It can also write a poem, debug a program and explain quantum mechanics. That breadth is valuable when the question changes every time. It is wasted when the same product asks the same narrow question thousands of times. ### The cloud became the default home of AI Powerful general models made intelligence easy to rent. An application sends a prompt, receives an answer and gains a capability it could not have built alone. That changed software quickly, and for good reason. Then the implementation pattern became a design assumption. New AI feature meant new API call. More usage meant more tokens, more latency and more user data crossing a network. The model began every request with no durable understanding of the person asking. Applications kept paying it to reconstruct the same context. That is a good trade for occasional, open-ended work. It is a poor default for a decision that is frequent, narrow, private and easy to verify. ### Email is the wrong problem for rented intelligence An inbox produces a stream of small decisions all day. Keep or junk. Wanted or unwanted. Ordinary mail, marketing, nonsense or fraud. The decision must arrive quickly, and a false positive can hide something important. The raw material may contain contracts, medical appointments, family conversations and password resets. It is also unusually measurable. When someone moves a message to Junk or restores it to the Inbox, the product receives a clean correction. No committee has to invent a quality score. The user has said where that message belongs. A cloud model can classify an email. The architectural question is why it should have to read the email, rediscover the product’s definition of spam and bill the application for the privilege every single time. ### Spam is personal A global model can learn the broad shape of spam: fake urgency, impersonation, poisoned links, improbable offers and the same tricks expressed across many languages. That shared knowledge matters. It gives a new installation a strong starting point. But no global dataset can settle the final boundary. One person wants every airline promotion. Another considers all of them noise. A sales message may be welcome this week and unwanted next month. A sender that looks obscure to the world may be essential to one small business. The last mile of classification is not more general knowledge. It is personal judgment. The user is the only reliable source for it. > **Rent general intelligence for new questions. Own the repeated private judgment that makes the product yours.** ### Klar uses a stack, not an oracle [Klar](/) does not ask one giant model to solve every part of the problem. It combines different kinds of intelligence, each with a smaller and more precise job. - Hard evidence handles what should not be guessed. Contacts and explicit sender rules can settle a decision immediately. Authentication, sender history and link structure add evidence to the final score. - A 550-million-parameter XLM-RoBERTa transformer reads the message’s meaning across more than 100 languages. It provides the broad semantic judgment that keyword rules cannot. - With Klar Plus, a fast statistical scorer and a lightweight classifier head learn from corrections. They capture patterns specific to this inbox without retraining the multilingual model from scratch. The tempting diagram is a funnel where a tiny pre-filter decides the obvious mail and sends only ambiguous messages to the transformer. We tested that shape and rejected it for the current product. Skipping the neural pass threw away the four-way scores used for explanations, learning and later safety checks. Today, every normal message keeps the transformer’s signal, while the cheaper layers can strengthen or adjust the final judgment. That distinction matters. “Use a small model” is not an architecture. Use the smallest combination that preserves the evidence the product needs. Measure where each layer earns the right to decide. ### Privacy is an architectural property The part of Klar that reads mail has no network access. Classification happens on the Mac. There is no API call, no cloud inference and no automatic telemetry carrying message content away. A report leaves only when you choose to send its editable email draft. This is stronger than a retention policy because it removes automatic transfer rather than placing conditions around it. Local inference also changes who owns improvement. A correction can update the user’s model on the spot and remain on the same machine as the mail that produced it. Better filtering no longer requires a vendor to observe everyone’s inbox. ### Software can get better without taking your data For years, personalization usually meant surveillance. Products learned by collecting behavior in a central system, building a profile and using that profile to decide what each person should see. On-device learning offers a cleaner loop: the product makes a decision, the user corrects it, the local model changes, and the next similar decision comes out better. The useful knowledge stays in the product the person owns. That loop creates a different relationship with software. The product is no longer a thin client for intelligence held somewhere else. It becomes a tool whose judgment develops alongside its user. ### The wider lesson for AI products Frontier models remain the right tool for open-ended reasoning, unfamiliar problems and tasks whose answer cannot be reduced to a stable score. Specialist local models fit a different shape of work. - The decision happens often enough that cost and latency compound. - The task is narrow enough to measure consistently. - The input is private or regulated. - Users can correct the result clearly. - Personal context matters more than another increment of general knowledge. Fermisense calls the broader idea [intelligence ownership](https://fermisense.com/when-machines-take-the-wheel/). Its example uses reinforcement learning to train an open model for a business workflow. Klar does not use that mechanism, and we are not claiming its 550-million-parameter model beats frontier models. The shared principle is simpler: specialization, measurable feedback, controlled inference cost and ownership of the resulting judgment. The future needs a deliberate division of labor among models, local and remote. Rent general intelligence when the question is genuinely new. Own the repeated judgment that makes your product yours. Your inbox knows the difference. Its intelligence should live there too. ## Why you shouldn’t unsubscribe from spam Published 2026-07-18 at https://klar.im/blog/dont-unsubscribe-from-spam Written with AI, reviewed by a human. For mail you signed up for, unsubscribe freely. For actual spam, the unsubscribe button does the opposite of what you want: it confirms you’re real. - Unsubscribe from mail you genuinely signed up for. - In actual spam, a click can confirm your address, track you, or lead to phishing. - For an unknown sender, mark the message as spam and delete it without clicking. - Unsubscribing teaches the sender. Reporting spam teaches your filter. The unsubscribe link sits right there at the bottom of the message, and clicking it feels like the clean fix. For a newsletter you once signed up for, it is. For actual spam, it is the worst thing you can do. The two look alike and are opposites, so the first job is telling them apart. ### Unsubscribe or report spam? The buttons can look similar, but they send information in opposite directions. Did you knowingly give this sender your address? - **Yes, I signed up: Unsubscribe.** Prefer the button your mail app shows above the message. It uses the sender’s List-Unsubscribe header. - **No, never: Mark it as spam, then delete it.** Do not open the link, reply, or confirm that your address reaches a person. - **I am not sure: Do not interact with the message.** If you cannot establish that you opted in, the cautious choice is to treat it as spam. ### What the click tells a spammer Spam goes out to millions of harvested and guessed addresses at once. The sender does not know which ones are real, which are abandoned, and which are dead. Most of the blast lands nowhere. When you click unsubscribe, you answer the one question the spammer most wants answered: yes, a person reads this address. That turns a cheap guess into a confirmed, monitored inbox. A confirmed-active address is worth more than an unverified one, so it gets sold to more lists and hit with more spam, not less. > **In actual spam, “unsubscribe” can turn a guessed address into a confirmed inbox.** ### The link may not be an unsubscribe link The message already faked or hid who sent it to reach your inbox, so there is no reason to trust that the button does what it says. In spam, an unsubscribe link can just as easily be a phishing page that harvests your login, a page that tries to run something on your machine, or a tracker that logs the click and nothing more. You cannot tell which from the outside, and the safe assumption is that clicking helps the sender, not you. ### Real spammers were never going to honor it A working unsubscribe is a legal obligation for legitimate senders. In the US, CAN-SPAM requires them to honor an opt-out within ten business days; in the EU, marketing mail needs consent in the first place. Someone already operating outside those rules has no obligation to respect your request and no incentive to. Unsubscribing from genuine spam assumes a good faith that, by definition, is not there. ### The line that actually matters None of this means never touch unsubscribe. It means the sender decides everything. If you handed over your address, to a shop, a service, a newsletter, then the list is legitimate, the unsubscribe is real, and the law requires it to work. Use it. The only mail you should never unsubscribe from is mail from a sender you do not recognize and never opted into. | | Mail you signed up for | Actual spam | | --- | --- | --- | | Did you opt in? | Yes, at some point | No, never | | The unsubscribe link | Real, and legally required to work | Unknown; may phish, load malware, or just track | | What clicking signals | A routine opt-out to a compliant sender | That your address is live and worth more | | What to do | Unsubscribe | Mark as spam, then delete | ### What to do instead - Ask one question first: did I ever give this sender my address? If no, treat it as spam. - For senders you recognize, prefer the unsubscribe button your mail app puts at the top of the message. It uses the sender’s List-Unsubscribe header, not a link buried in the body, and since 2024 Gmail and Yahoo have required bulk senders to make it one click. - For everything else, mark it as junk or spam and delete it. Do not open it, do not click anything, do not reply. Marking as spam is the move because it points the other way. Unsubscribing sends a signal outward, to the sender, and confirms you. Reporting spam sends a signal inward, to your filter, and the sender learns nothing. Your filter gets better at catching the next one; the spammer gets no reply at all. That inward signal is exactly what Klar runs on. Klar classifies every message on your Mac, inside Apple Mail, and learns from what you mark, without your mail or your reaction ever leaving the machine. The report goes to your filter, never back to the sender. How the on-device approach compares to cloud filters is on our [compare page](/compare). ## The best anti-spam software in 2026: an honest comparison Published 2026-07-09 at https://klar.im/blog/meilleur-anti-spam Written with AI, reviewed by a human. Which anti-spam software is best in 2026? Klar, SpamSieve, Leave Me Alone, Clean Email, SaneBox and MailWasher compared: where each runs, what it costs. - There is no universal best filter. Start with the mail that weighs on you, your platform, and the access you accept. - Compare where a tool runs, what it reads, and what it costs before comparing feature lists. - For actual spam on a Mac, Klar works immediately and SpamSieve is a mature filter you train yourself. - SaneBox sorts legitimate mail, Clean Email handles backlog, Leave Me Alone manages subscriptions, and MailWasher is Windows-only. People search for the best anti-spam software when the inbox is overflowing: fake parcel notifications, cold outreach, newsletters you never asked for, bank phishing. This comparison reviews six consumer tools for blocking spam, from a free on-device filter to subscription cloud services, and says plainly who each one is for. The ground rules first: Klar is our product, and we rank it first. Every claim about another tool comes from that vendor’s own public pages, and each tool gets a genuine verdict, including where it is a better pick than Klar. > **The best anti-spam tool matches the mail that weighs on you, your platform, and the access you accept.** ### What kind of mail weighs on you? The tools in this comparison solve different inbox problems. Choose the problem before the product. What is filling the inbox? - **Actual spam on a Mac: Choose Klar or SpamSieve.** Klar is free, multilingual, and ready inside Apple Mail. SpamSieve is mature, local, and trained through your corrections. - **Too much legitimate mail: Look at SaneBox.** It sorts messages by importance in its cloud so secondary mail skips the inbox. - **An inbox already overflowing: Look at Clean Email.** It acts on the backlog in bulk and keeps order with rules you define. - **Subscriptions everywhere: Look at Leave Me Alone.** It manages unsubscribing across accounts and bundles newsletters. Processing happens in its cloud. ### How to judge anti-spam software - Where it runs: locally on your machine, or in the vendor’s cloud. That decides who can read your mail. - What it reads: headers only (sender, subject), or the whole message. A filter that does not read the body cannot see what hides there. - What it costs: free, a one-time purchase, or a subscription that keeps running. And before installing anything: Gmail and Outlook.com already filter on the server, included. Apple Mail has its own junk filter, which adapts to the messages you mark. The tools below add to that baseline, for everything that gets through anyway. ### 1. Klar: free, on-device and multilingual [Klar](/) is a spam filter for Apple Mail: a Mail extension, free on the Mac App Store, that classifies every incoming message on your Mac. The model is XLM-RoBERTa, a 550-million-parameter multilingual transformer that reads over 100 languages and detects the language automatically. It sorts mail into four categories: spam, regular mail, marketing, gibberish. Everything happens on the Mac: no cloud, no account, no automatic telemetry. A report leaves only when you send its editable email draft yourself. Klar Plus, an optional paid companion in the works, will add mistake correction and on-device retraining. It does not replace the free app, which stays free. - Verdict: for an individual on a Mac, this is our contender for the best free anti-spam software. A modern model, zero configuration, and no automatic upload. - The limits: it requires macOS 14 and Apple Silicon, and it only filters mail read in Apple Mail. ### 2. SpamSieve: the longtime Mac anti-spam [SpamSieve](https://c-command.com/spamsieve/) has filtered Mac mail for two decades. It is Bayesian filtering you train yourself: you mark messages, and its word statistics adapt to your mail. It runs locally on the Mac, and C-Command states it transmits nothing. $39.99 one-time, no subscription. Verdict: the right pick if you like training your own filter and want a mature indie tool. Word statistics are per-language: a multilingual inbox means more training. Our full comparison: [Klar vs SpamSieve](/compare/spamsieve). ### 3. Leave Me Alone: unsubscribe first [Leave Me Alone](https://leavemealone.com) is built around bulk unsubscribing: it follows unsubscribe links for you and rolls newsletters together. Its spam blocker learns, in its cloud, which senders you do not want, and targets cold outreach. From $9/month, or a $19 7-day pass. Verdict: the right pick for pruning subscriptions across several accounts; for the filtering itself, your mail is processed on their servers. See [Klar vs Leave Me Alone](/compare/leave-me-alone). ### 4. Clean Email: bulk cleanup with rules [Clean Email](https://clean.email) attacks the backlog: its smart folders act on thousands of messages at once, and its rules keep incoming mail sorted. The vendor states it analyzes headers only and never reads message bodies; that is reassuring, but it also bounds what the filter can see. From $7.99/month, in the cloud. Verdict: the right pick for digging out an overflowing mailbox; filtering means rules you define yourself, not a model that learns. See [Klar vs Clean Email](/compare/clean-email). ### 5. SaneBox: triage by importance, not anti-spam [SaneBox](https://www.sanebox.com) is not primarily an anti-spam tool: it sorts mail by importance in its cloud, so unimportant messages skip your inbox. It states it analyzes headers and never stores message bodies. From $4.99/month with two-year billing. Verdict: the right pick if your problem is too much legitimate mail rather than spam, and you are comfortable connecting your mailbox to a service. See [Klar vs SaneBox](/compare/sanebox). ### 6. MailWasher: Windows only [MailWasher](https://mailwasher.net/) takes the old-school route: it previews mail on the server, before download, and you delete spam before it touches your machine. Free for one address, Pro from $49.95. Its own FAQ says it: Windows only. Verdict: on Windows, if that manual control appeals to you, it holds its place; on a Mac, it is out of the running. Details in [Klar vs MailWasher](/compare/mailwasher). ### Side by side | Tool | Where it filters | What it reads | Price | | --- | --- | --- | --- | | Klar | On your Mac, in Apple Mail | Everything stays on the Mac | Free forever; Klar Plus optional | | SpamSieve | On your Mac, in your mail client | Everything stays on the Mac | $39.99 once | | Leave Me Alone | In its cloud | Your mailbox, in its cloud | From $9/mo | | Clean Email | In its cloud | Headers only | From $7.99/mo | | SaneBox | In its cloud | Headers, bodies never stored | From $4.99/mo | | MailWasher | On the server, before download (Windows) | Message previews on the server | Free (1 address); Pro from $49.95 | ### What about European ISP mailboxes? Mailboxes from European ISPs, Orange, Free, SFR or La Poste for example, come with the provider’s own server-side filtering. Most of these accounts work over IMAP in Apple Mail, and that is where the choice of filter matters: an on-device Mac filter like Klar or SpamSieve classifies mail from these accounts exactly like mail from Gmail or iCloud, because it works inside Mail, whatever the provider. ### For organizations Gateways for organizations are a different category: they filter a whole company’s mail in front of the mail server, with an admin console and a contract. In France, Mailinblack is the best-known name; we compared it in [Klar vs Mailinblack](/compare/mailinblack). This guide is for individuals. ### How to choose Start from the mail that weighs on you. Too much legitimate mail: SaneBox. A mailbox to dig out: Clean Email. Subscriptions everywhere: Leave Me Alone. A Windows PC: MailWasher. Actual spam on a Mac: an on-device filter, SpamSieve if you want to train it yourself, Klar if you want a filter that works out of the box in Apple Mail. And if your spam arrives in French, German or any other language, the difference is clear: word-statistics filters relearn each language from your corrections, while Klar’s model already reads them. Product and price details are from the vendors’ public pages, July 2026. Klar is not affiliated with any vendor named here. The full landscape, including server-side filters, is on our [compare page](/compare); the Mac-specific case is covered in [the Apple Mail comparison](/blog/best-spam-filters-apple-mail). ## The best Apple Mail spam filters in 2026 Published 2026-06-18 at https://klar.im/blog/best-spam-filters-apple-mail Written with AI, reviewed by a human. Six spam filters for Apple Mail compared: the built-in junk filter, Klar, SpamSieve, SaneBox, Clean Email, Leave Me Alone. Where each runs and what it costs. - Apple Mail’s built-in filter is the free baseline for classic spam. - Klar and SpamSieve run on the Mac. Klar is multilingual and ready immediately; SpamSieve learns through manual training. - SaneBox sorts legitimate mail, Leave Me Alone handles subscriptions, and Clean Email attacks a backlog. - Choose by the mail that still gets through and where you accept having it read. Apple Mail comes with junk filtering, and for classic spam it does its job. What lands in your inbox anyway is the gray zone: cold outreach, promo blasts, newsletters you never asked for, and spam in a second language. This guide compares the spam filters that handle that layer, for Apple Mail specifically. One thing first: Klar is our product, and we rank it first. Every claim about another tool comes from that vendor’s own public pages, and each one gets a genuine verdict, including where it is a better pick than Klar. > **Spam, legitimate overload, subscriptions, and backlog are different problems. They need different tools.** ### What still gets through Apple Mail? The mail left in your inbox does not always call for another spam filter. Which problem are you trying to solve? - **Multilingual spam, no setup: Choose Klar.** Its multilingual model works immediately inside Apple Mail and classifies every message on the Mac. - **A local filter I train: Choose SpamSieve.** It learns from the messages you mark and supports Apple Mail, Outlook, and other Mac clients. - **Too much legitimate mail: Look at SaneBox.** It sorts mail by importance in its cloud instead of focusing first on spam. - **Subscriptions or a large backlog: Compare Leave Me Alone and Clean Email.** One emphasizes unsubscribing; the other acts in bulk with rules. Both process the mailbox in the cloud. ### 1. Klar: a multilingual model, on your Mac [Klar](/) is a Mail extension: install it from the App Store, switch it on in Mail’s settings, and every incoming message is classified on your Mac. The model is XLM-RoBERTa, a 550-million-parameter multilingual transformer that reads over 100 languages and detects the language automatically, no configuration needed. Nothing is sent automatically: no cloud classification, no API calls, no automatic telemetry. A report leaves only when you send its editable email draft yourself. - Free on the App Store. Requires macOS 14 and Apple Silicon. - Classifies into four categories: spam, regular mail, marketing, gibberish. - An optional paid companion, Klar Plus, is coming: it shows every classification, lets you correct mistakes, and retrains the model on your own mail, entirely on-device. It adds to the free app rather than replacing it, and Klar stays free. - Best for: spam that arrives in more than one language, and anyone who wants a modern model without giving a service access to their mailbox. ### 2. SpamSieve: the proven on-device veteran [SpamSieve](https://c-command.com/spamsieve/) has filtered Mac mail for two decades. It uses Bayesian filtering you train yourself: mark messages, and its word statistics adapt to your mail. Like Klar, it runs entirely on your Mac. C-Command states it does not transmit your mail data anywhere. - $39.99 one-time purchase, 30-day free trial. - Works with Apple Mail, Outlook and other Mac clients over IMAP, Exchange and POP. - Best for: people who like training their own filter and want a mature indie tool. Word statistics are per-language, so a multilingual inbox means more training. Our full comparison: [Klar vs SpamSieve](/compare/spamsieve). ### 3. Apple Mail’s built-in junk filter: the free baseline Before adding anything, configure what ships with your Mac. Mail’s junk filtering is on by default, moves suspected junk out of the inbox, and adapts to the messages you mark. You can also block specific senders. See our [guide to turning it on and tuning it](/blog/apple-mail-junk-filter-settings) on the Mac, on iCloud.com and on iPhone. Third-party filters add to this baseline; they do not replace it. ### 4. SaneBox: cloud triage by importance [SaneBox](https://www.sanebox.com) is not primarily a spam filter: it sorts mail by importance in its cloud, so unimportant messages skip your inbox. It states it analyzes headers to decide what matters and never stores message bodies. From $4.99/month with two-year billing. - Best for: too much legitimate mail rather than spam, if you are comfortable connecting your mailbox to a service. Our comparison: [Klar vs SaneBox](/compare/sanebox). ### 5. Leave Me Alone: unsubscribe first, spam blocking second [Leave Me Alone](https://leavemealone.com) is built around unsubscribing: it follows unsubscribe links for you and rolls newsletters into digests. Its spam blocker learns which senders you do not want, in its cloud, and targets cold outreach. From $9/month, or a $19 one-time 7-day pass. - Best for: pruning subscriptions across several accounts. For the filtering itself, mail is processed on their servers. See [Klar vs Leave Me Alone](/compare/leave-me-alone). ### 6. Clean Email: bulk cleanup with rules [Clean Email](https://clean.email) attacks the backlog: smart folders act on thousands of messages at once, and Auto Clean rules keep new mail sorted. It states it reads headers only and never downloads message bodies. From $7.99/month. - Best for: digging out an overflowing mailbox. Filtering means rules you define yourself, not a model that learns. See [Klar vs Clean Email](/compare/clean-email). ### Side by side | Tool | Where it filters | What it reads | Price | | --- | --- | --- | --- | | Klar | On your Mac, in Apple Mail | Everything stays on the Mac | Free forever; Klar Plus optional | | SpamSieve | On your Mac, in your mail client | Everything stays on the Mac | $39.99 once | | Apple Mail built-in | On your Mac and at iCloud | Handled by Apple | Included | | SaneBox | In its cloud | Headers, bodies never stored | From $4.99/mo | | Leave Me Alone | In its cloud | Your mailbox, in its cloud | From $9/mo | | Clean Email | In its cloud | Headers only | From $7.99/mo | MailWasher, a common name in spam-filter roundups, is Windows-only by its own FAQ, so it is out of scope for Apple Mail. Details in [Klar vs MailWasher](/compare/mailwasher). ### How to choose a spam filter for Apple Mail Match the tool to the mail that annoys you. Too much legitimate mail: SaneBox. A mailbox to dig out: Clean Email. Subscriptions everywhere: Leave Me Alone. Actual spam on a Mac: an on-device filter, SpamSieve if you want to train it yourself, Klar if you want a multilingual model that works out of the box. And if your spam arrives in French, German or any second language, the difference is not subtle: word-statistics filters must relearn each language from your corrections, while Klar’s model already reads them. Spam on the phone is a different question: none of the six installs on iOS, and there is no filter to switch on in the Mail app. What actually filters an iPhone’s inbox, and how a Mac cleans the same mailbox, is in [iPhone Mail spam filter: what exists and what works](/blog/iphone-mail-spam-filter). Product and price details are from the vendors’ public pages, July 2026. Klar is not affiliated with any vendor named here. The full landscape, including server-side filters, is on our [compare page](/compare). ## Where does your spam filter read your mail? Published 2026-05-27 at https://klar.im/blog/where-spam-filters-read-your-mail Written with AI, reviewed by a human. Every spam filter reads your mail somewhere. Four tiers: your provider’s cloud, a vendor’s cloud, a vendor cloud without third-party AI, or your own machine. - Every filter must read the message somewhere. What differs is where, and who does the reading. - Your provider’s cloud adds no new reader, but its filter is tuned for the average user. - A filter vendor’s cloud adds another company. Excluding outside AI narrows that list without making the processing local. - An on-device filter reads mail on your machine and adds no filtering server between you and your inbox. A spam filter cannot classify a message it has not read. There is no way around that. What separates the products on the market is where that reading happens, and who does it. There are exactly four answers, and they form a ladder: from your provider’s servers down to your own machine. > **A spam filter reads your mail. What you get to choose is where that happens, and who is doing it.** ### Who should be able to read your mail? Each tier moves the filtering and changes how many companies can access your inbox. Choose where the classification happens. - **At your email provider: No new reader.** Gmail, Outlook.com, or iCloud already stores the mail. The trade-off is a filter designed for billions of inboxes. - **In a filter vendor’s cloud: Another company gains mailbox access.** The service may read only headers or process more. Check what it reads, stores, and eventually deletes. - **At a vendor, without outside AI: The list of outside readers gets shorter.** The vendor still processes mail on its own servers and still holds access to the mailbox. - **On your own machine: No new reader or filtering server.** The message is classified where it already lives. There is no third-party mailbox access to revoke. ### Tier 1: your provider’s cloud Your email provider filters spam on its own servers, as part of the service. Gmail, Outlook.com and iCloud all work this way. Your provider already stores your mail, so filtering adds no new reader. What you give up is control: the filter is tuned for billions of mailboxes at once, so its calls in the gray zone (cold outreach, promo mail, foreign-language spam) are made for the average user, not for you. ### Tier 2: a vendor’s cloud A third-party service connects to your mailbox over OAuth or IMAP and analyzes your mail on its servers. That adds a second company to the list of readers, and the careful vendors are precise about what they read. SaneBox says it analyzes only headers to decide what is important, and that message bodies fetched by optional features are never stored. Clean Email says it never downloads the bodies of your emails, and deletes indexed data 45 days after your last login without an active subscription. Both claims come from the vendors’ own security and privacy pages. ### Tier 3: a vendor’s cloud, no third-party AI The vendor’s servers still read your mail, but no outside AI company does. Leave Me Alone describes its spam blocker as private by design: “Your email content is never sent to outside AI companies. No OpenAI, no Anthropic, no third-party AI provider.” That is a real distinction, and worth having: it narrows who reads your mail. It does not change where your mail is read. The filtering still runs on the vendor’s servers, with access to your mailbox. ### Tier 4: your own machine The filter runs on your device, so your mail is read where it already lives. This tier removes the network entirely. SpamSieve has worked this way for two decades: C-Command states it does not need your mail account login and does not transmit your mail data anywhere. Klar does the same with a modern model: a multilingual transformer classifies every message on your Mac, inside Apple Mail. No account, no cloud, no automatic telemetry. A report leaves only when you send its editable email draft yourself. ### The ladder at a glance | Tier | Who reads your mail | Examples | | --- | --- | --- | | 1. Your provider’s cloud | Your email provider | Gmail, Outlook.com, iCloud | | 2. A vendor’s cloud | Your provider, plus the filter vendor | SaneBox, Clean Email | | 3. A vendor’s cloud, no third-party AI | Your provider, plus the vendor; no outside AI company | Leave Me Alone | | 4. Your own machine | Nobody new for classification; no automatic upload | SpamSieve, Klar | ### Three questions to ask any spam filter - What does it read: headers only, or full message bodies and attachments? - Where does the processing run, and what is stored there, for how long? - If you revoke its access to your mailbox today, does any of your mail remain on someone else’s servers? For an on-device filter the answers are structural: everything is read on your machine, nothing is stored anywhere else, and there is no access to revoke. That is the tier Klar was built on. How each product on the market answers all three is summarized on our [compare page](/compare), with sources. Vendor claims quoted from their public pages, July 2026. Klar is not affiliated with any vendor named here.