It stays home
Moneypenny is a program you run, not a service you subscribe to. There is no company account, no cloud inbox, no server somewhere holding your messages. The reading happens on your own machines, and what's read stays there — with one deliberate exception, spelled out right below, for the moment you sign a job.
What it does
- Reads only the channels you connect — hand it your email and it reads your email, nothing else.
- Keeps everything it learns in records on your own hardware — records you can look at yourself, the way you'd open any document, and see exactly what it knows.
- Asks an AI service to help with specific jobs you signed off — it sends the job, not your archive.
What it never does
- Never uploads, sells, or shares your messages — there is no third party to send them to.
- Never spends money, sends words in your name, or commits your time without your gesture.
- Never marks its own work "done" without a receipt you can check.
What leaves the machine, exactly
One exception to "nothing leaves," stated plainly. When a job you've signed needs an outside AI service — booking the flight, drafting the reply — Moneypenny sends that service the job itself: the request and the few details needed to do it, at the moment you sign, to whichever AI vendor is currently plugged in (you can see and change which). Concretely, for the flight job that means the travel dates, the airports, the fare preference, and a passenger name — not the meeting notes it was said in, not your other threads, not your contacts, not your archive. Nothing you didn't sign. Every send is listed, line by line, on the job's receipt.
One promise per stage
Every stage of the pipeline carries its own promise. Click through them — the same five stages, each annotated with what it owes you.
- Listen — it reads only the channels you hand it; nothing leaves your hardware.
- Sort — you're interrupted only when something genuinely needs a human.
- Desk — nothing that matters happens without your say-so; pre-decision work is reversible.
- Do — works with any AI vendor; your work and history never belong to one.
- Prove — "done" always comes with evidence you can read. No receipt, no done.
What a receipt looks like
Policies are words; a receipt is a thing you can check. Here is a sample from the in-browser demo — not a real booking, and labeled so — showing the exact shape every real job ends in: one request on a Tuesday morning, and everything that happened to it, timestamped.
Notice what the receipt makes impossible: work that quietly didn't happen, money spent without a signature, a "done" you have to take on faith. A job that can't produce this goes back on the Desk — it does not count. (The card is yours, saved with the airline — Moneypenny never stores card numbers. The checking is yours too: every line names the confirmation or message that backs it.)
The real receipts stay private on the builder's own machines, deliberately — what you're owed is the shape, and the demo makes them the same way. See receipts being made in the sample demo →
It will misjudge things. Here's what that costs.
If it files something that mattered — filed never means deleted. Everything it sets aside stays on record, and one tap brings it back to the Desk. A wrong guess costs you a tap, not a lost thread.
If it prepares the wrong thing — preparation is deliberately reversible: fares compared, drafts written, options held without charging. The wrong flight can't get booked, the wrong message can't get sent, money can't leave — because none of that happens until you sign. Send the paper back with a note and it tries again.
If a signed job still goes wrong — the receipt is the audit trail: what was asked, what was done, when, and the confirmation to unwind it with. That's why holds are refundable-first and why "done" requires proof — so a mistake is a line you can point at and reverse, not a mystery you discover next month.
What it cannot promise: that it never misreads a message or makes a poor recommendation. The design assumes it will — and keeps every one of those mistakes cheap, visible, and undoable.
What this is, and isn't
This is a personal build: one engineer's assistant, self-hosted, in daily use on his own machines. It is not a polished product with a support line — not yet. The demo on this site runs entirely on sample data: no real messages, no real names, nothing live.
That boundary cuts both ways, deliberately. You can't see the builder's real desk, and nothing you do here touches it. What you can see is exactly how it works — and that openness, not a policy document, is the trust argument.