postage

Demo

About

Postage is a forwarding email address that sits between you and anyone you have never corresponded with. You sign up and get an address like you@usepostage.com that forwards to the inbox you already use. Mail that is clearly expected, such as a receipt or a reply in a thread you started, goes straight through. Mail that looks deceptive is blocked. Everything else, which is most cold email, is held: the message is parked unread, and the sender gets an automatic reply, threaded to their own message, asking one question. Are you a person or a program? A person answers by completing a World ID Selfie Check on their phone. It is free, and it proves they are one real human without revealing who they are. A program answers by paying a small amount of USDC on Arc. The price depends on how suspicious the message looks and on the sender's track record across the whole network, which anyone can inspect on the public dashboard. As soon as the sender clears the gate, the original message is delivered exactly as they sent it, with their own signatures intact. The idea is simple: unsolicited email should cost the sender something, a minute of their time or a small fee, rather than costing the recipient their attention. Humans pay with a proof, machines pay with money, and the inbox only sees what was worth sending. What is live today: all four contracts are deployed on Arc Testnet, the classify, hold, challenge and release loop has run end to end against a real Gmail inbox, and a real Selfie Check has been completed on a phone and recorded on-chain.

How it's made

Postage is four independent pieces, each with its own install and no monorepo tooling. The only shared code is one TypeScript type, the gateway verdict. Contracts (Solidity 0.8.28, Foundry), deployed on Arc Testnet. PostageEscrow holds the USDC payments: a sender submits a price quote signed by the pricing server (EIP-712), the contract checks the signer against EnclaveRegistry, then splits the payment 20% to PostageVault and the rest to the recipient's claimable earnings. HumanRegistry records a World ID verified human as an address derived from their nullifier hash, so nothing on-chain links back to a real wallet. PostageVault routes its share 30% to treasury and 70% to a pool that refunds the relayer's gas; anyone may call refill because the funds can only ever go to one fixed address. The escrow and the registry deliberately use different EIP-712 domain versions so a signature for one can never be replayed against the other, and there is no ReentrancyGuard: every external call happens after state is written and events emitted, with a comment at each site saying not to reorder it. 68 Forge tests. Arc was a natural fit because gas is paid in USDC, so a sender uses one asset for both the postage and the transaction. Mail path (Cloudflare Email Routing, an Email Worker, Workers KV). Inbound mail hits the Worker, which parses it, posts the fields to the gateway, and parks the raw bytes in KV. Message content never touches a database. When the gateway releases a message, the Worker re-sends the original bytes through Mailgun's raw-MIME endpoint with tracking and re-signing turned off. This is the hack I am most pleased with: Cloudflare's own send_email refuses a From: header you do not own, so relaying the untouched bytes through Mailgun is what keeps the sender's original DKIM signature valid at the far end. Gateway and UI (Next.js 16, React 19, TypeScript, Tailwind 4, viem 2, a small libSQL database for everything except message content). The classifier is Claude (claude-opus-5) reading only the message's own headers, body and SPF/DKIM/DMARC results, and returning one of four tiers; if the API is unavailable a header-only fallback takes over, and it is not allowed to return the "dangerous" tier. Pricing takes the tier and scales it by the sender's history, read from a subgraph on The Graph that indexes all four contracts. The same subgraph powers the public /network page. Privy handles wallets and login, and the server verifies Privy's JWTs against Privy's own JWKS rather than trusting the SDK. Resend sends the challenge email. World ID is the human lane. The challenge page opens IDKit with a Selfie Check, the server verifies the proof through the Developer Portal, then a relayer signs and submits attest() to HumanRegistry, so the sender never pays gas. One wrinkle worth knowing: Selfie Check currently issues v3 proofs and IDKit v4 rejects those by default, so it takes an explicit legacy opt-in. I wrote that up for the World team in docs/world-feedback.md. Two honest caveats. The pricing signer is a plain server key registered in EnclaveRegistry under a placeholder measurement; the registry is shaped for a real Nitro enclave later but is not one today. And the deployed Selfie Check runs against World's sandbox, because the production World app does not have Selfie Check enabled yet.