From source ZIP
to your own workspace.

1. Prepare your environment.

• Debian/Ubuntu-style Linux with systemd and Nginx; host administrator access.
• Node.js 20.19+ and Python 3.10+ with standard-library SQLite. Runtime needs no npm/pip installation.
• Your domain and valid HTTPS certificate, DNS, firewall and a private writable application-data directory.
• Existing Purelymail mailboxes and mailbox/app passwords. Provider subscription and infrastructure are separate.

The application is one-owner software, not an email hosting server. The supplied configuration targets one server and binds Node to loopback behind Nginx.

2. Verify, install, then create the owner.

1. Verify the source ZIP hash and included file manifest before adding configuration.
2. Create the dedicated service user, immutable release directory and private state directory.
3. Render and review the environment, systemd and Nginx configuration. Point to your real TLS certificate.
4. Start the service. Retrieve the private, time-limited setup URL through your server console.
5. Complete system check → owner creation → first mailbox or skip → completion. Public visitors cannot claim an HTTPS installation without the private setup link.
6. Connect your mailbox and run your own clearly labelled send/receive/reply test. Enable optional TOTP and store recovery codes safely. English is the default; choose English or Türkçe in the language selector. Your browser remembers the choice. Close open dialogs before switching languages; message content is not translated.

Never put passwords in URL parameters or support messages. The owner password, mailbox password and optional provider management API key are different credentials.

3. Keep ready data close to the interface.

The first sync creates encrypted SQLite snapshots of headers, UID identity and read flags. Lists and header search use the local index; message bodies and attachments are fetched from the provider when opened. Initial synchronization still needs a provider connection.

• Latest 2,000 headers per indexed folder; encrypted database budget about 64 MiB, up to 128 snapshot entries.
• One background synchronization job at a time. New UID headers are fetched; flags and removals are reconciled. Changed UIDVALIDITY replaces the old snapshot.
• Connected INBOXes are watched by shared IMAP IDLE connections (default budget 64). Other folders are indexed when selected.
• IDLE-driven updates plus a five-minute background reconciliation. List views do not poll IMAP; cached records remain available during a provider outage.
• Domain view: up to 30 connected mailboxes and 100 recent messages. Header search is not a full message-body archive search.

4. Protect owner access and message reading.

Use a unique owner password and enable optional authenticator-based two-step login. Keep recovery codes offline. Sensitive account and provider changes require owner verification; review active sessions, revoke unused sessions and inspect the security log. Failed-login protection includes IP-based limits; configure the reverse proxy and trusted client-address handling correctly.

Messages open as plain text by default. HTML uses an isolated view and remote images are blocked until explicitly allowed. Treat links and downloads cautiously: attachments display a confirmation warning and are not antivirus-scanned. Never send passwords, recovery codes or provider keys through a support form.

5. Back up before you upgrade.

The private state contains the owner, encrypted mailbox vault, its key, drafts, index, operation records, security log and limits. Keep an encrypted backup and its passphrase separately. The app backup does not back up the provider’s full message archive.

The compatible-release helper verifies current/candidate sources, takes an encrypted pre-update backup, switches the release and checks the candidate version. On failed health it returns to the previous code. It does not automatically overwrite data from an old backup or perform unknown schema migrations. Restarting ends browser sessions.

Keep the host patched, maintain TLS and time synchronization, monitor disk capacity, and verify backup restoration into an empty directory. Support and installation work are agreed separately.

6. Know the scope of your delivery.

Editable source, tests, first-run wizard, configuration renderer, encrypted maintenance tools, upgrade helper, installation documentation and licence notices. The 200 € + applicable tax one-time licence covers only the named buyer’s internal use in one project and one production installation, with necessary private development, test, staging and backup copies. No resale, transfer, sublicensing or paid/free redistribution is permitted, subject to mandatory applicable law. The full licence and a named-buyer order are provided before purchase; tax treatment and additional services are confirmed with the order.

Purchase flow: sign in at Buy source licence, provide invoice details and accept the licence. Softwexa records the request in CRM and provides a final payment link including tax. After staff verify payment and attach the final invoice, your account downloads include the original source ZIP and a personal licence certificate. Refunds or disputes close access.

Single administrator, English by default, with Turkish language support and Purelymail. Multi-tenant SaaS, multiple roles, other-provider certification, rich-text composition, antivirus and zero-downtime/HA operation are not included. Attachments require an explicit warning/confirmation and are not virus-scanned.