What's changed.

Unknown Reduction. Every scan now ends with a retroactive re-classification pass — senders that were stuck in Unknown resolve automatically without a full re-scan.

• Retroactive re-classification. After every full scan completes, Ciela re-scores all messages in the local database against the current classifier rules. Senders that were previously Unknown because the classifier didn't recognise them will move to the correct category automatically on the next scan — no manual reclassification needed, no fresh re-scan required. Existing users: run one scan after upgrading to trigger the first pass.
• 2-column inbox layout restored. Selecting a sender replaces the sender list with the detail view. A Back button returns to the list. The three-column layout introduced in v0.9.0 has been reverted — the persistent side pane created too much visual noise on typical screen sizes.
• Classifier: "validation code" added to Security & Auth keywords.

Classifier sharpened across nine categories. Outlook sign-in recovery buttons now work. UndoBar no longer blocks scrolling.

• 13 new domain and keyword recognitions. United and Delta land in Travel. Etsy in Receipts. Aetna in Healthcare. USPS in Notifications — package tracking isn't government mail. Sony Entertainment Network in Gaming. Indeed in Jobs. Beehiiv and Substack in Subscription. "One-time passcode" and "new sign-in" added to Security keywords. Job-alert keywords ("job alert", "jobs matching", "new jobs for you", "career alert") moved from Subscription to Jobs — they belong with the job board, not the newsletter pile.
• Outlook sign-in recovery buttons now work. "Re-open browser" and "Copy sign-in link" on the Outlook OAuth waiting screen were disabled for all users with no fix planned. Both activate as soon as the browser opens. Useful if your default browser isn't the one you sign into Microsoft with — copy the link, paste it into the right browser.
• UndoBar no longer dims the inbox. The backdrop overlay behind the undo bar was intercepting scroll events — the sender list was unusable while any undo notification was visible. The bar stays pinned to the viewport; the dimming is gone.

Gmail now connects via IMAP. Google's OAuth verification requirements blocked most users — Ciela removes the OAuth path and routes Gmail through IMAP instead.

• Gmail via IMAP. Google requires an annual third-party security audit (CASA) for apps using restricted OAuth scopes — a cost not justified for a free app. Rather than leave the Gmail OAuth button leading to an "Access blocked" wall for most users, Ciela removes it and routes Gmail through IMAP instead. Connect Gmail the same way as iCloud or Yahoo: provider list, app password, done. No user cap, no Google verification dependency.
• Connect screen simplified. Desktop shows two clear options: Outlook (OAuth, unchanged) and Gmail & other email (IMAP). Gmail appears first in the IMAP provider list with pre-filled host settings and a direct link to Google's app-password instructions.
• Gmail early-access link preserved. The 100-user Gmail OAuth test window is still accessible — a small unobtrusive link below the IMAP button for invited users who want the OAuth path.

Settings correctness. Two controls that shipped wired but ineffective in v0.9.0 are now fixed.

• Text Size now scales everything. The previous implementation wired a CSS variable that most components ignored — nav tabs, buttons, headings, and action buttons all used hardcoded pixel sizes. Replaced with CSS zoom on the root element, which scales every pixel value in the app uniformly. The four steps (Small / Default / Large / Larger) are now meaningfully perceptible.
• Show me toggle now works. The Just the essentials / All the detail switch was wired to local state that never reached the Insights panel. Switching it did nothing. Fixed: view mode is now lifted to InboxView and shared as a prop. Charts and expanded stats appear only in detail mode; ghost subscriptions and never-opened senders stay visible in both.
• Removed a misleading button from Start Here. The "Not now — you can come back any time" escape called the same skip function as "I'll explore on my own" while falsely implying the user could return. Removed.
• Backend: failed trash IDs now tracked individually. Previously only a count was kept when a batch trash operation partially failed, losing the specific message IDs from logs. Now each failed ID is tracked and logged at error level.
• Reclassification overrides now follow sender subdomain changes. If you reclassified a sender from one category to another, and they later started sending from a different subdomain, the override didn't apply. Now applies via root-domain fallback.

Complete desktop UI redesign. New navigation shell, three-column inbox with persistent sender detail pane, rebuilt panels across the entire app.

• New navigation shell. Five-tab bar (Inbox, Insights, History, Cleaned, Settings) replaces the old tab strip. A persistent StatusBar sits at the bottom with account info and scan controls. UndoBar spans the full width above it.
• Three-column inbox. Category rail on the left, sender list in the center, sender detail pane on the right — all visible simultaneously. No more navigating away from the list to see sender stats.
• Rebuilt Insights panel. Signal vs. Noise, read rate by category, ghost subscriptions, peak mail hours, storage breakdown, and Inbox Health trend — all in one panel with a simple/detail mode toggle.
• Rebuilt History and Cleaned panels. History shows every scan with category deltas. Cleaned shows emails recovered, trashed, and gone with per-item Undo buttons.
• Rebuilt Settings and Connect panels. Settings now shows account info, default filter, auto-clean rules, and Outlook filters in one place. Connect panel redesigned for clarity.
• Date filter restored. The per-sender date scope picker (trash emails older than N days) was dropped mid-redesign. Restored in the sender-level clean confirmation modal.

Bug fix release. Trash History and Undo restored, blank inbox on first scan fixed, OAuth refresh token rotation fixed, Outlook rules cleanup on disconnect.

• Trash History and Undo restored. Both were silently broken since v0.7.0. Emails moved to trash correctly, but the record was never written — so Trash History was always empty and Undo did nothing. Fixed: the undo record is now written immediately after each clean operation completes.
• Blank inbox on first scan fixed. After a fresh install, the first scan completed but showed zero senders. Caused by a race between the scan finishing and the UI reading the results. Scan now returns results directly — one round-trip, race eliminated.
• OAuth refresh token fix. When Gmail or Outlook refreshed an access token mid-session, any rotated refresh token was silently dropped. On app restart, the stale token would fail, forcing you to reconnect. The new refresh token is now saved to the system keychain every time.
• Outlook rules cleanup on disconnect. Ciela-created Outlook inbox rules now delete automatically when you disconnect. Previously they stayed in your Microsoft account indefinitely after uninstalling.
• Outlook rules panel always visible. The "Your Outlook Filters" section in Settings was hidden when no rule suggestions existed, making active rules unmanageable. It now appears whenever rules are present.
• Post-scan Outlook filter suggestions. After scanning, if Outlook senders have been trashed two or more times with no active rule, the top candidate surfaces in a banner. One tap creates the rule; dismiss to skip for the session.

Cleaning jobs now run in the background — queue what you want gone, close the window, and come back to a finished inbox. Ciela also groups emails by company, protects your financial accounts, and gives new users a guided start. New icon.

• Clean and walk away. Cleaning jobs now run in the background. Queue up what you want Ciela to trash — a sender, a category, or an entire brand group — then close the window. Ciela keeps working, shown in your system tray, and sends a notification when it's done. You can queue several operations at once; they run in order. If the network drops or the app closes mid-job, your progress is saved and the job resumes exactly where it left off when you reopen. Large inboxes with tens of thousands of emails no longer require you to sit and watch.
• Brand grouping. Emails from the same company now appear as a single entry in your inbox list, regardless of which address they came from. If a retailer sends from four different addresses, Ciela shows one row with the total count. Clean them all in one action.
• Financial senders are protected. Banks, credit unions, brokerages, and financial services are recognized and excluded from bulk-cleaning suggestions. You will not accidentally trash a bank statement or account alert.
• Start Here. New users now see an orientation screen when they first connect — a plain-language explanation of what Ciela is about to do, with a clear button to begin. Less guesswork on first install.
• Confidence-graded triage. The triage checklist now shows how confident Ciela is in each recommendation — so you can focus your attention on the suggestions that need a second look, and trust the ones that are clearly right.
• Better sender recognition. Ciela uses DMARC authentication data to confirm who is actually sending your email — catching senders who use different display names or domains to obscure their identity.
• New icon. A crescent moon on a night sky — across the app icon, taskbar, installer, and website favicon.

Upgrade now preserves your data — scan history, connected accounts, and credentials all survive a reinstall. Uninstalling cleans up properly when you ask it to. Settings now has a working "Check for Updates" button.

• Upgrade-safe installer. Installing a new version of Ciela over an existing install now leaves your scan history, connected accounts, and stored credentials untouched. Prior versions wiped all app data during upgrade — this is fixed.
• Uninstall respects the checkbox. The "Delete the application data" option during uninstall now correctly removes credentials from Windows Credential Manager alongside app data. Previously, credential cleanup ran unconditionally — regardless of what you selected.
• 44 new classifier rules. Recruiting and staffing firms (21 new domains), healthcare platforms, education tools, faith organizations, gaming publishers, notification senders, real estate services, and marketing partners now classify by domain instead of landing in Unknown.
• "Check for Updates" is live. The button in Settings now works. Ciela checks for a newer version and tells you if one is available. Updates still require a manual download for now — silent auto-install is on the roadmap.

IMAP bug fixes: iCloud trash now works, senders no longer disappear when a trash operation fails, and error messages say what actually happened.

• iCloud trash fixed. iCloud names its Trash folder "Deleted Messages" — two words with a space. The IMAP command was sending the folder name unquoted, which iCloud rejected with a parse error. Ciela now quotes folder names that contain spaces before sending them to the server.
• Senders stay visible on error. Previously, if a trash operation failed, the sender would disappear from Ciela's inbox list even though the emails were not actually moved. Senders now stay visible when a trash fails, so you can see what happened and try again.
• Error message improved. The trash failure message now reads "Some emails couldn't be trashed. Your emails are unchanged — please try again." instead of the previous vague wording.
• Zoho Mail setup note. Zoho disables IMAP by default. Ciela now shows a link to the right Zoho settings page when you select Zoho as your provider.
• Provider-agnostic language. Six places in the app previously said "Gmail Trash" or referenced "30 days" — the Gmail-specific retention period. Those now say "your email app" and "your provider's trash" instead.

IMAP support ships. Connect iCloud, Yahoo, Zoho Mail, AOL, Fastmail, and dozens of ISP email accounts using an app-specific password.

• 30+ IMAP providers. A grouped provider picker on the Connect screen lists iCloud, Yahoo, AOL, Fastmail, GMX, Zoho Mail, mail.com, US ISPs (Comcast, AT&T, Cox, Spectrum, EarthLink, Eatel, and more), international providers (T-Online, BT, Bell Canada, Orange, Telstra, and more), and a Custom option for any IMAP server not in the list.
• Context notes per provider. iCloud requires an app-specific password — Ciela shows a direct link to Apple's instructions. Zoho disables IMAP by default — Ciela links to the right settings page. Verizon email now runs on AOL — Ciela explains this so you know which password to use.
• Passwords stored securely. IMAP passwords are stored in the OS credential store (Windows Credential Manager / macOS Keychain) — the same place Gmail and Outlook tokens live. They are never written to disk and are deleted when you disconnect.
• Trash history category filter. The Trash History panel now filters to the current category when you reach it from a category view. The Undo count in the post-clean banner also scopes to the category you just cleaned.

Auto-clean rules, server-side Outlook Filters, Smart Purge Tray, Scan History, Inbox Health trend, and error message polish throughout.

• Auto-clean rules. After cleaning the same category 3 times, Ciela offers to save it as a rule. Rules run automatically at the end of every full scan. A pre-scan screen shows what will run with a link to change it. Settings lists all rules with on/off and delete controls.
• Your Outlook Filters. For Outlook accounts: once a sender has been trashed in two separate scans, Ciela can create an Outlook inbox rule that sends their emails straight to Trash — even when Ciela isn't open. Settings → Your Outlook Filters lists every active rule with a Remove button.
• Smart Purge Tray. After a scan, if senders you trashed in a prior session have returned, a compact tray shows: "These senders are back. You trashed them last time." Trash all, look first, or skip.
• Scan History & Scan Reports. A new tab logs every scan. Click any row to see what changed — category deltas since the last scan, and the full cleanup history (recoverable → rescued → gone) with Undo available for recoverable ops.
• Inbox Health trend. The Insights panel now tracks noise % across your last 8 scans and shows a sender delta indicator vs. the previous scan.
• Error message clarity. Every error in the app now uses plain language. Six specific strings were rewritten: sign-in cancellation, keyring failure, undo failure, empty Trash vs. Spam, local database errors, and session expiry.
• 50+ new classifier rules: staffing firms, notification platforms, healthcare, education, finance additions.
• 3 new Security keywords: "new login", "has been reset", "password change".
• Schema v17–v20: FK cascades, scan history tables, auto-clean rule tables, Outlook filter table.
• Bug fixes: olderThanDays null override in TrashModal, silent trash_category errors, multi-account trash ops.

Old data cleaned up, Trash does what you told it to, and the Mac installer now runs on every Mac made in the last decade.

• Stale Unknown senders pruned. When the classifier improves and a sender moves from Unknown to the correct category, the old Unknown row used to persist indefinitely. A one-time migration on upgrade removes accumulated stale rows; a prune also runs after every full scan going forward. Unknown% dropped from ~14% to ~7% in testing.
• Trash respects your reclassifications. If you manually reclassified a sender, clicking Trash now acts on your override instead of re-running the classifier — which would have silently ignored your decision and matched nothing.
• Active account persists across restarts. Multi-account users now land on the last-selected inbox on startup instead of always defaulting to the first connected account.
• Fixed a race condition where a simultaneous "Clean All" and per-sender Trash could interleave and produce incomplete results.
• Universal macOS binary. The DMG now runs natively on both Intel and Apple Silicon — no Rosetta required on Intel.

Large inboxes no longer show a blank sender detail — plus three targeted fixes from field testing.

• Sender detail blank for large inboxes — fixed. Accounts with more than ~500 senders showed an empty email list when drilling into a sender. The message query now pages correctly regardless of inbox size.
• Fixed several classifier domain rules that were mis-categorising senders from major providers.
• Fixed oldest-email surfacing showing "1970" for messages where the Gmail API returned no date field.
• Fixed the Dashboard "Browse" button not navigating back to the inbox when clicked from inside Sender Detail.

Account switching fixed, full email in the pill, and a + button to add accounts without leaving the inbox.

• Account pill shows your full email. The initial-only circle is replaced with a pill showing your complete email address so you always know which account you're looking at.
• + button for adding accounts. A dashed circle next to the pill opens the add-account flow directly — no longer buried inside a dropdown menu.
• Account switching now works. Clicking an account in the switcher dropdown was displaying as interactive but not actually switching — fixed. The sender list now reloads immediately with the selected account's data.
• When two or more accounts are connected, the scan timestamp shows the active account: LAST SCAN 31 min ago · dnclyon@gmail.com.
• Fixed a false "Different account detected" warning that appeared when scanning a second registered account for the first time.
• Error messages no longer say "Gmail" when you're signed in to an Outlook account. Several failure paths that were silently swallowed now surface a plain-language message to the user.

Frontend structural cleanup — no user-facing changes.

• Lifted the trash_progress event listener from two components into the parent shell; InsightsPanel now receives progress as a prop instead of registering its own listener.
• Extracted the shared Modal shell that was duplicated in InboxView and InsightsPanel into src/components/ui/atoms.tsx.
• Removed ScanProgress.senders — populated by Rust but never read by the frontend.
• Moved all shared TypeScript types out of App.tsx into a dedicated src/types/ directory. All raw invoke() calls replaced with typed wrappers in src/api/commands.ts.

Rust backend correctness and performance fixes — no user-facing changes.

• Scan memory use capped: the message buffer now flushes to the database every 5,000 rows instead of accumulating unbounded (~20 MB for a 100k inbox).
• Category count tracking during scan rewritten from an O(n) full-map scan per batch to an incremental counter updated at merge time.
• db/mod.rs split from ~2,300 lines into five focused modules: senders, messages, stats, operations, accounts.
• Fixed a transaction safety issue in record_trash_op.

Dashboard — surface what your inbox data already knows.

• Your Inbox at a Glance. Three stat pills at the top: total emails, unique senders, years of history.
• Signal vs. Noise. A hero number showing what percentage of your inbox is marketing, subscriptions, and notifications.
• Read Rate by Category. Horizontal bars showing the percentage of senders per category you've ever opened.
• Senders You've Never Opened. Count with a Browse link to filter the inbox to that set.
• Peak mail hours chart. Hourly histogram of when your email actually arrives (local time).
• Oldest email surfacing. "Your oldest email arrived in [year], from a [category] sender."
• Dashboard set as the default landing panel; previously labelled "Insights".

Connect a second account without signing out.

• Add Account flow. A new "Connect another email" option in the account switcher opens ConnectView in add-mode — the primary account stays signed in. After connecting, the app switches to the new account's inbox automatically.
• Settings now lists every connected account with a Remove button. Removing an account signs it out and clears its local scan data; the primary account is unaffected.
• All triage, trash, and stats commands are now scoped to the active account — unprotect, bulk clean, and reclassify cannot touch another account's data.
• Clearing all data (Settings → Reset) now also removes all connected account records from the local database.
• Minor UX fixes: ConnectView headline updated to "Another email" in add-mode; error messages use consistent plain-language formatting across both OAuth flows.

Account switcher pill — see and switch accounts at a glance.

• An account pill appears in the top-right chrome showing the active account's initial in a sage circle. Clicking it opens a dropdown listing all connected accounts with their provider label and a checkmark on the active one.
• Accounts are persisted to the local database at the end of every scan so the pill populates immediately on next launch.
• Switching accounts is instant — the inbox reloads with the selected account's cached data.

Per-account data isolation — the foundation for multi-account support.

• Schema upgraded to v15: every account-scoped table now carries an account_id column. Existing data is preserved as account_id = "default" on migration.
• All 23 database functions accept an account_id parameter — senders, protected messages, scan checkpoints, and stats are all isolated per account.
• Keyring keys are now namespaced per account (ciela-gmail-default, ciela-outlook-default) so tokens from different accounts never collide.

Outlook support, UI polish, and reliability fixes.

• Outlook / Hotmail / Microsoft 365 is now supported. Connect your Microsoft account from the Connect screen — scan, clean, triage, and undo all work the same as Gmail. OAuth2 PKCE, no password stored.
• Stat cards now show context hints — "55% of inbox", "12% of senders", "8% of category" — so counts have meaning at a glance.
• Settings gear icon fixed — displayed as a black square on some Windows installs due to a Unicode rendering gap.
• The "Last scan" timestamp no longer uppercases the time string ("4 MIN AGO" → "4 min ago").
• The bulk clean count now reflects your active search filter instead of the full category count.
• Modal titles use Instrument Serif — consistent with the rest of the design system.
• Four database transaction bugs fixed — partial writes on crash or force-quit are no longer possible.
• Email domain matching is faster, with no heap allocations in the per-message hot path.

Small UI fixes surfaced during internal review.

• Active sender behavior labels ("quiet", "active") now refresh every 60 seconds so they don't go stale in long-running sessions.
• The outlier count shown in the bulk clean modal now matches the sender list exactly.

Rust reliability sprint — data integrity and performance.

• Four database operations that previously wrote one row at a time are now wrapped in transactions — an interrupted scan or force-quit can no longer leave the database in a partial state.
• Scan progress tracking is now lock-free, reducing contention during large inbox scans.
• Per-message domain matching no longer allocates on the heap — measurable improvement on large inboxes.

Another 30 senders named, one longstanding misclassification fixed.

• 30 more domain rules added: Apple Card, Experian, Esurance, OneGuard (Finance); MelMed Center, Vagaro, Otto Vet (Healthcare); FlexMLS, Authentisign (Real Estate); Mercari, Children's Place, PODS, PSA Card, Goldin Auctions (Receipts); swim leagues, Edmentum, Scholastic (Education); Taco Bell (Food); Niantic (Gaming); and more.
• Disney+ and Peacock now land in Subscriptions — they were previously sorting into Notifications.
• LastPass, Dropbox, Discord, Shutterfly, CompTIA, and MLB.com added to Notifications.
• 13 more staffing firm domains recognized in Jobs: XceedSearch, Insight Global, Talener, TalentBurst, and others.
• Regional ISP email addresses (like socal.rr.com) now correctly match their provider — a bug caused addresses with ISP subdomains to land in Unknown instead of Personal.

26 more senders recognized across 10 categories.

• Healthcare: Anthem, SimonMed, Exact Sciences, VSP, Valley Sleep Center, and Guidance Autism added.
• Finance: Citi, Equifax, Sallie Mae, Barclaycard, Nelnet, and proxy vote platforms added.
• Travel: Frontier, Southwest, Holland America, Alamo, U-Haul, and Carrier added.
• Jobs: Glassdoor and 12 staffing firm domains added.
• Education, Utilities, Receipts, Food, Notifications, and Real Estate each received additional domain rules.

A new look for your inbox, built around how you actually clean.

• The inbox view has a new tab strip at the top — Inbox, Insights, and Trash History are one click away instead of buried in a sidebar.
• Four stat cards now sit at the top of every category view: total senders, never-opened percentage, emails active in the last 90 days, and the single heaviest sender by email count.
• The left category panel is wider and cleaner, with the Protected count visible at a glance.
• The "Clean all" action is now styled in Ciela's sage color instead of red — intentional calm for a consequential action.
• Keyboard navigation through the sender list now works with Arrow, Page Up/Down, Home, and End keys.
• 13 additional domain rules: staffing firms, Zendesk, CVS Pharmacy, Naviance, Chewy, Tango, AYSO, and Shutterfly school notifications.

Wait screen restored; more classifier improvements.

• The scan waiting screen is back. Senders no longer appear while a scan is still in progress — the inbox reveals itself when the scan completes, so you're never cleaning on partial data.
• 11 more domain rules added: Pinterest, Memrise, and Tapjoy → Notifications; Hand & Stone, Cobblestone Vet, and PTN → Healthcare; StartWire, RSR IT, JobSerious, Prosum, and Mondo → Jobs; Costco Photo Center → Receipts.

More of your inbox recognized, less left as Unknown.

• Walmart, Kohl's, eBay, and Audible emails now correctly sort into Receipts — order confirmations and purchase notices from these senders will no longer land in the Unknown pile.
• Trading Card Database (tcdb.com) notifications now sort into Notifications.
• Zion Partners recruiting emails now sort into Jobs.

Your inbox builds in real time, page by page.

• Senders appear in your inbox as Ciela scans — after the first 10% of your mailbox is processed, results start populating immediately. No more waiting for a fully complete scan before you see anything.
• The "Scan complete" splash is gone. When the scan finishes, you're already looking at your inbox with the full results there.
• If Ciela is closed or crashes mid-scan, the partial results already saved to your local database are not lost — they'll be there when you reopen.

An honest first impression.

• The Connect screen now states exactly what Ciela reads: sender addresses, subject lines, and the first ~150 characters Gmail already shows in your inbox list. Full email bodies and attachments are never downloaded.
• The scan time estimate has been corrected — "5–20 minutes depending on inbox size" replaces an earlier estimate that alarmed first-time users.

See where every sender comes from.

• The domain of each sender now appears as a second line in the inbox list — "Amazon" becomes "Amazon · amazon.com." — making it easy to spot when two different display names are actually the same company.
• The same domain label appears in the sender detail header.

Installer fix and category volume bars.

• Uninstalling Ciela now cleans up its saved credentials from Windows. Previously, reinstalling after an uninstall would find the old token and skip the connect screen, landing on an empty inbox.
• Each category in the left nav now shows a thin bar at the bottom of its row proportional to how much of your inbox it holds — the largest category gets a full bar, everything else scales relative to it.

Trash History — a dedicated panel to review and undo every cleanup.

• A new Trash History section appears in the left nav, below Insights. It lists every trash operation from the last 24 hours: sender (or category), email count, and time elapsed.
• Each entry has an Undo button. Tapping it sends those emails back to your inbox and removes the entry from the list.
• A slim banner at the top of the inbox list shows how many operations are available to undo and links directly to the history panel.
• After a successful undo, Ciela notes that emails permanently deleted from Gmail outside the app cannot be recovered.
• A failed undo stays in the list so you can retry. The error reason is shown alongside the entry.

Undo now records every trash path — including Trash Unprotected in sender detail.

• Trashing from the sender detail "Trash Unprotected" button was not recording the operation for undo. Any cleanup done from that view was invisible to the undo log. Now all trash paths write to the same record.

Faith category refined — no longer catches job titles.

• Faith keywords were matching senders with job titles containing words like "ministry" or "mission" that had nothing to do with religious organizations. The keyword list is now narrowed to reduce false positives.

Classifier domain coverage expanded.

• Four additional domain rules added across existing categories — catching known senders that were previously landing in Unknown despite fitting a clear category.

Seven new classifier categories — Utilities, Jobs, Faith, Dating, Real Estate, Gaming, and Gambling.

• Utilities covers electric, gas, water, internet, and phone providers.
• Jobs covers job boards, recruiters, and career platforms like LinkedIn job alerts, Indeed, and ZipRecruiter.
• Faith covers religious organizations, churches, temples, and faith-based communities.
• Dating covers apps and relationship platforms.
• Real Estate covers listing services, mortgage lenders, and rental platforms.
• Gaming covers game studios, platforms, and esports.
• Gambling covers casinos, sports betting apps, and lottery services.

Government category added; Amazon order emails reclassified.

• A new Government category catches federal, state, and local agency email — .gov domains, county offices, and government-adjacent nonprofits.
• Amazon "Your order has shipped" and "Order placed" emails now land in Receipts & Orders instead of Notifications.

The app now waits for you — and asks before it acts.

• When a scan finishes, the results screen stays on screen until you choose to continue. Previously Ciela advanced automatically after a few seconds, which didn't leave much time to look at the summary.
• The Disconnect button now asks you to confirm before logging you out. One extra click prevents an accidental disconnect mid-session.
• When a search or category filter returns no senders, a "Clear filters" link appears alongside the empty state. No more hunting for which filter is active — one click and you're back to the full list.
• Errors that previously vanished silently — a failed trash operation, a reclassify that didn't take — now surface as on-screen messages so you know something needs attention.

Scan checkpoint moved to the encrypted database — mid-scan progress now survives an app restart.

• Previously, closing Ciela mid-scan left a plain JSON checkpoint file on disk. The checkpoint is now written to the same encrypted database as all other data, so your scan position is protected by the same key that guards your inbox data. If the app is closed or crashes during a long scan, the next launch will resume from exactly where it left off.

Silent failures now log warnings.

• Six internal bookkeeping paths that previously swallowed errors silently now emit log warnings. The primary operation still completes — these are housekeeping calls that run after the fact — but failures are now visible rather than invisible.

Food & Dining — a new classifier category.

• Ciela now has thirteen categories. Food & Dining covers food delivery platforms (DoorDash, Uber Eats, Grubhub, Instacart), restaurant reservation services (OpenTable, Resy, Tock), meal kit subscriptions (HelloFresh, Blue Apron, Factor, Sunbasket), and major restaurant loyalty programs (Starbucks, Chipotle, Domino's, Pizza Hut, Chick-fil-A). A DoorDash order confirmation now lands in Food & Dining rather than Receipts.
• Restaurant reservations from smaller restaurants not in the domain list are caught by subject keywords ("your table for", "table is confirmed") that don't overlap with hotel reservation subjects.

Smarter classifier coverage.

• Two new last-resort rules now fire when no domain list, keyword, or header rule matched. The domain keyword fallback catches senders like updates@unitedhealthcare.com or no-reply@chasemortgage.com that previously landed in Unknown. The display name fallback does the same for senders like "Chase Bank" or "Wellness Clinic". Both strip TLD suffixes first to avoid false positives.

Scan progress bar now tells the truth.

• The progress bar previously used your total Gmail message count as its denominator — which includes Sent, Drafts, Trash, and Spam. On large accounts this made it look stuck near the end for minutes. It now uses your inbox count only, so the percentage reflects what's actually being scanned.

Changed your mind? Undo a cleanup.

• A "Recently cleaned" drawer on the Dashboard lists every trash operation from the last 24 hours. Each entry shows the sender (or "All [Category]" for category-wide cleans), email count, and time elapsed.
• Each entry has an Undo button. Tapping it restores those emails to your inbox, then shows a prompt to rescan so Ciela's local counts stay accurate.

Scan ETA and lifetime impact panel.

• The scanning screen now shows a time-remaining estimate alongside the elapsed time — "~3 min left", "~45s left", or "almost done". Appears after 30 seconds, on full scans only.
• The dashboard now includes a "Since you started" section showing total emails moved to trash, confirmed unsubscribes, senders managed, and your first scan date — all drawn from the local database.

Database safety and scan reliability improvements.

• Schema migration is now fully atomic — all steps commit together or roll back entirely. A crash mid-migration can no longer leave the database in a half-migrated state.
• Downgrades are now safe — if a newer version of Ciela created your database, an older version will show a clear message instead of silently dropping your data.
• Token refresh during long scans is now proactive — the app refreshes your session before it expires rather than waiting for a failed request to trigger one.

Reliability and correctness fixes.

• All commands — scan, trash, triage, sign-in — now share a single HTTP connection pool. Previously a new pool was created per command, paying handshake cost on every invocation.
• Schema migration now fails safely if the database is in an unexpected state, instead of silently marking the migration complete and leaving the schema broken.

Internal code quality pass — no user-facing changes.

• Shared helpers for database access and Gmail client creation extracted into a common module, removing ~60 lines of repeated boilerplate. Insights panel extracted into its own self-contained component. Audit log now covers partial-protect trashes.

Right-click menu removed; age filter values confirmed in sync.

• The browser default right-click context menu is now suppressed throughout the app.
• The "Older than" filter options in the UI are confirmed to exactly match the values the backend validates — the two now carry cross-reference comments to stay in step.

Visual polish — consistent button colors, larger stats text, accessible charts.

• Destructive action buttons are now a consistent red across all screens — previously five components each used a slightly different shade.
• The stats grid in Sender Detail now uses a larger font size — easier to read at a glance.
• Velocity and inbox history charts now carry accessible labels for screen readers.

Housekeeping — no user-facing changes.

• Category override logic refactored to a single call path. The "cached · N ago" age label is now computed from a single shared helper used across all panels.

Scan performance — approximately 4× faster on large mailboxes.

• Rate limiter corrected to 200 requests/second — the Gmail API charges 1 quota unit per message (not 5 as previously assumed), so prior versions were running at roughly 20% of available throughput.
• Concurrent batch fetching increased from 5 to 10 parallel requests. Lock contention during scanning also reduced significantly.

Security hardening — four meaningful improvements to how Ciela protects you.

• Unsubscribe buttons now show the destination domain in a confirmation dialog before opening any external link. You see exactly where you're going before you go there.
• Bulk-delete actions (Empty Trash, Clear Spam) now require typing DELETE in a text field before the button activates — prevents accidental mass deletion.
• Activity log in Settings tracks every trash and clean operation with a timestamp and outcome. See exactly what Ciela has done.
• Your OAuth sign-in token and database encryption key are now stored in Windows Credential Manager — the same secure store used by browsers and system apps. Existing installations migrate automatically on first launch.

Category pill polish and navigation fixes.

• Category pill now renders correctly for all thirteen categories — Personal, Security, Healthcare, Notifications, and Unknown were showing as plain text instead of a colored badge.
• Clicking a category in the left rail while viewing a sender now navigates to that category correctly.
• Category pill shows a permanent dropdown caret so the reclassify affordance is always visible, not just on hover.

Sort & protect triage, smarter clustering, and 33 new classifier rules.

• New Sort & protect mode in sender detail — flag one email to keep, Ciela surfaces the full cluster of similar subjects, you confirm what to protect, then trash everything else at once.
• After protecting a cluster, Ciela checks for similar groups and asks if you want to keep those too.
• Category reclassify dropdown now opens inline at the pill — no separate "Move to…" button.
• Subject normalization: price-drop and shipping emails now cluster correctly — "5% price drop on Bag A" and "5% price drop on Bag B" map to the same group.
• 33 new sender classification rules across Healthcare, Finance, Education, and Notifications.

Persistence fix — no more rescans, no more re-authentication.

• Your scan data and Gmail connection now persist correctly across app restarts. A Windows credential storage issue was causing the app to wipe its database and forget your Google account on every launch.
• The inbox count in the storage breakdown now shows your actual scanned email count instead of Gmail's API estimate, which could underreport by 60–70% on large mailboxes.
• Scans are now correctly scoped to your inbox only — previously, sent mail and archived mail could be included.
• Clicking the category label on a sender's detail page now takes you directly to that category.

Unsubscribe confirmation notice.

• After you click Unsubscribe on any sender, a small notice now confirms the link opened in your browser and reminds you to confirm in the email you receive.

Clearer labels throughout.

• The "Inactive Subscriptions" section is now called Dormant Subscriptions — a more accurate name for newsletters you stopped reading months ago.
• The engagement heat indicator now shows a frequency range alongside each label — "Cold (<1/mo)", "Warm (4–15/mo)", and so on — so you know exactly what each level means.

Cleaner actions, live counts.

• Bulk-action buttons now read "Move all X to Trash" instead of "Clean all X" — no ambiguity about where emails go.
• Hovering a protected sender now shows a short explanation of why it's locked.
• A guard prevents accidentally submitting the same trash action twice when the network is slow.

Storage stats available offline.

• The "What's Taking Up Space" panel now works even when Ciela can't reach Gmail. After the first successful fetch, the numbers are saved locally. If you open Ciela offline or with an expired session, the cached figures appear with a small "cached · N min ago" label. The error state only shows when no cached data exists at all.

Clean related senders in one step.

• After you reclassify a sender, Ciela checks for other senders sharing the same root domain. If any are found, a prompt lists them all pre-checked: "3 similar senders found — move them to Finance too?" Uncheck any you want to keep, then apply to the rest in one click.

Sender detail view.

• Clicking any sender name opens a full-screen detail panel. You'll see total email count, unread count, open rate, first and last message dates, and a year-by-year engagement chart (received vs. opened). Scroll down for up to 500 recent subjects. From here you can unsubscribe, protect the sender, or move them to Trash with the usual date-scope options.

Inbox history chart.

• The Dashboard now shows a bar chart of email volume by year, built from the timestamps of every message in your inbox. Bars cover every calendar year from your oldest email to the present. The chart appears automatically after your first full scan.

Accurate counts, more reliable scanning.

• The "What's Taking Up Space" panel now pulls your inbox size directly from Gmail, so the number reflects reality — not just what Ciela has scanned so far.
• Clicking "Stop scanning" now immediately shows "Stopping…" — no more wondering whether the click registered.
• Stopping a scan and then clicking Rescan now kicks off a proper full scan. Previously it would complete instantly with no new results.

Smarter bulk-clean, with a safety net.

• Before you bulk-clean a category, Ciela now surfaces any senders you've opened in the last 90 days. Protect them one at a time — then clean everything else with a single confirm. No surprises.
• The date-range picker is now a proper modal with four options: All time, 1 year, 6 months, or 90 days. It shows exactly how many emails will move before you confirm.
• Batch trash now sends up to 1,000 message IDs per call — ten times the previous limit — so large categories clear noticeably faster.

Two new categories.

• Mail from schools, universities, and learning platforms now sorts into a dedicated Education bucket — Canvas, Blackboard, school districts, the lot.
• Patient portals, appointment reminders, and pharmacy notes now sort into Healthcare — they used to scatter across Notifications and Unknown.
• A few familiar senders that had been slipping through — PayPal, Venmo, Nextdoor, Reddit, Realtor.com, Fidelity, Mint — now land where you'd expect.

When Ciela gets a sender wrong, you can put it right.

• Click any sender's category badge to reclassify it. The change sticks: future scans honour your correction automatically. No retraining, no waiting.

Faster sender list.

• If your inbox has thousands of senders, the list opens instantly and scrolls smoothly. We only draw what you can see.

A proper Settings screen.

• Find the account you connected, the last time it scanned, the running total — all in one place, all read from your own machine.
• Pick a default for the "older than" filter so the modals open with your preference already chosen.
• Disconnect now lives in Settings, with a quiet two-step confirmation so it never happens by accident.

Protect senders you never want to touch.

• Mark any sender as protected. They get a small badge, the Trash button greys out, and bulk-cleans skip them automatically.
• Every cleanup category card now has a "Clean all" — confirms the exact email count, warns you if a sender in there is still active, and lets you pick a date scope before anything moves.

Clearer warnings before cleaning.

• When you open a bulk-clean category that contains senders you've opened recently, a small banner says so up top.
• The trash modal now shows the effective date scope in plain English — "Emails older than 1 year will be moved — recent emails will stay."

A little more honesty per category.

• Each category card now tells you whether you actually read mail from these senders. "Most never opened." "62% never opened." Or nothing, if you do read them.
• The trash modal shows the sender's display name and the exact email count it's about to move.

Quieter security work.

• When you disconnect, access tokens are now wiped from memory immediately, not just dereferenced. A small thing nobody will notice — which is the point.
• The Connect screen now explains itself while it waits: "A browser window just opened — approve the connection there to continue."

A long list of small comforts.

• A brief "Scan complete" page after every scan, so you know what just happened before you land on the Dashboard.
• Stop scanning mid-run. The next scan picks up where you left off.
• Unsubscribe appears inline on any sender row that supports it.
• A sort dropdown on the sender list — most emails, never opened, oldest unread, most recently seen.
• The "Older than" filter moved out of the modal and into the toolbar, defaulting to one year.
• Your search and sort are now remembered across navigation; no more losing your place mid-cleanup.
• Disconnect moved into a quiet gear menu.

Now you can see where the space goes.

• A new "What's Taking Up Space" panel on the Dashboard explains the gap between what Gmail counts and what Ciela has scanned: active mail, Trash, Spam, and the long tail of chats and drafts that don't look like email.
• Empty Trash and Clear Spam are right there too — with a firm confirmation before anything goes.
• Scans no longer silently lose a batch when Gmail blinks; they retry a few times first.

Unsubscribe, and find out whether it worked.

• When you click Unsubscribe from a Dormant Subscription, Ciela remembers it. On the next scan it checks: did they stop? You'll see "Unsubscribed", then "Confirmed" if they went quiet — or "Still sending" if they didn't, with the button right back where it was.

Every sender row admits how you actually treat it.

• "Never opened." "Actively read." "Last read 8 months ago." It's on the row now. No clicks required.
• If a sender is one you've opened recently and you go to trash them anyway, the modal pauses to say so. You can still do it. We just want you to mean it.

The Dashboard arrives.

• Three panels: an overview of every category with its size, a list of Dormant Subscriptions you haven't opened in months, and a small chart of how your inbox has grown over time. Clicking any category card jumps straight into that part of the sender list — pre-filtered, no detour.

Tidied house.

• A counting bug that made "unread" totals climb across scans is fixed. The number you see now is what your inbox actually has.

Foundations for engagement-aware cleaning.

• Every scan now records, per sender, whether you read anything and when. This is what powers Dormant Subscriptions, the engagement labels on every row, and the velocity chart on the Dashboard.

Amazon-the-receipt and Amazon-the-marketing are two different things.

• Senders that send you several kinds of mail now appear as separate rows — one per type. You can trash the marketing without ever touching the order confirmations. Ciela re-checks every message against its category at the moment of trashing, so a Finance email from the same sender is never caught up in a marketing sweep.

Scans got faster, and quieter.

• After your first scan, every later one only checks what's arrived since. New senders merge in; the rest stay put.
• Under the hood, Ciela now asks Gmail in batches instead of one-message-at-a-time — much less back-and-forth.
• The "N senders found!" pop-ups are gone. Finding junk is not an achievement worth celebrating.

Ciela learns to remember.

• Scan results now save to an encrypted database on your computer. Restart the app and your sender list is there before the new scan finishes.
• You stay signed in across restarts — no more reconnecting to Gmail every time.
• The Connect screen is now a single button. We carry the credentials so you don't have to.

One stubborn bug, gone.

• A rare condition where an interrupted scan would loop forever on the next launch is fixed. If it ever happened to you, it won't again.

Tests, tests, tests.

• No visible changes this release. Behind the scenes, we wrote enough tests that we now trust ourselves to ship faster without breaking your inbox.

A quiet security pass.

• A careful read of the OAuth flow, the Gmail query string, and every place we handle a URL. A handful of small holes patched, none ever exploited. The kind of work you only notice in its absence.

First light.

• The first build of Ciela. Connect Gmail, scan the inbox, classify every sender into one of nine plain-language categories, and move what you want to Trash. Resume an interrupted scan. Filter by category, search by name, decide a sender at a time.
• Everything local. Everything reversible. Everything free.