FastMask

Native Android app for managing Fastmail masked emails

Features • Screenshots • Installation • Setup • Tech Stack • Architecture • Contributing

---

About

FastMask is a native Android application that lets you manage your Fastmail masked email addresses directly from your phone. Masked emails are disposable addresses that forward to your real inbox, helping you protect your privacy and reduce spam.

Features

Feature	Description
View All Masks	Browse your masked emails in a clean, searchable list
Create New	Generate new masked addresses with custom descriptions
Enable/Disable	Toggle masks on or off without deleting them
Edit Details	Update description, domain, and URL associations
Quick Copy	One-tap copy to clipboard
Archive	Disable masks reversibly (mail bounces, restorable later)
Search & Filter	Find specific masks instantly, filter by Active / Off / Archived
Sorted by Activity	Newest mail at the top, not just newest creation
Warm-Ink Design	Custom parchment/ink palette, Instrument Serif + JetBrains Mono typography
Light & Dark	Both modes follow system theme
20 Languages	Full localization with in-app language picker
Settings	Language selection, contact/feedback, and logout

Screenshots

Screenshots coming soon

Installation

Download APK

1. Go to the Releases page
2. Download the latest APK file
3. Enable "Install from unknown sources" if prompted
4. Install the APK

Build from Source

# Clone the repository
git clone https://github.com/pawelorzech/FastMask.git
cd FastMask

# Build debug APK
./gradlew assembleDebug

# Or build release APK
./gradlew assembleRelease

The APK will be generated in app/build/outputs/apk/

Requirements

• Android 8.0 (API 26) or higher
• Fastmail account with API access

Setup

1. Create a Fastmail API Token

1. Log in to Fastmail
2. Navigate to Settings → Privacy & Security → Integrations → API tokens
3. Click New API token
4. Name it (e.g., "FastMask")
5. Select scope: Masked Email (read/write)
6. Copy the generated token

2. Log in to FastMask

1. Open the app
2. Paste your API token
3. Tap "Log in"

Your token is stored securely using Android's EncryptedSharedPreferences.

Tech Stack

Category	Technology
Language	Kotlin 100%
UI Framework	Jetpack Compose (BOM 2024.09)
Design System	Custom warm-ink palette on top of Material 3 primitives
Typography	Instrument Serif (display) + Inter Tight (text) + JetBrains Mono (mono), via Google Fonts
DI	Hilt
Networking	Retrofit + OkHttp
Serialization	Kotlinx Serialization
Async	Coroutines + Flow
API Protocol	JMAP (Fastmail's native protocol)

Architecture

The app follows Clean Architecture principles with MVVM pattern:

app/
├── data/                    # Data layer
│   ├── api/                 # JMAP API service & models
│   ├── local/               # Secure token storage
│   └── repository/          # Repository implementations
│
├── domain/                  # Business logic layer
│   ├── model/               # Domain models
│   ├── repository/          # Repository interfaces
│   └── usecase/             # Use cases
│
├── di/                      # Dependency injection modules
│
└── ui/                      # Presentation layer
    ├── auth/                # Login screen
    ├── list/                # Masked email list
    ├── create/              # Create new mask
    ├── detail/              # View/edit mask details
    ├── settings/            # Settings screen
    ├── components/          # Reusable UI components
    ├── navigation/          # Navigation setup
    └── theme/               # Material 3 theming

Privacy & Security

• Local Storage Only: Your API token is stored locally using Android's EncryptedSharedPreferences
• Direct API Communication: The app communicates directly with Fastmail's servers - no intermediary servers
• No Tracking: No analytics, no advertising ID, no event or screen tracking, no profiling — Google Analytics is deliberately not part of the app, and Firebase's session-reporting SDK is switched off in the manifest (firebase_sessions_enabled=false)
• Opt-out Crash Reporting (from 1.10.0): release builds send technical crash diagnostics — the stack trace plus app and device state, as Firebase defines it — to Firebase Crashlytics. On by default, off in Settings → Crash reports. Reports never carry masked addresses, descriptions, domains, your API token or email; the SDK is called from one file, the CrashReporter seam offers no way to pass data into a report, and CrashReportingPrivacyTest — reading the sources and the compiled classes — fails the build if any other class names the SDK or if the seam grows a way to pass data. While reporting is on the SDK also registers the install and fetches its config at startup; the toggle stops both. Debug builds never report. Details in the Privacy Policy.
• Open Source: Full source code available for audit

Contributing

Contributions are welcome! Here's how you can help:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Development Setup

1. Install Android Studio (latest stable)
2. Clone the repository
3. Open the project in Android Studio
4. Sync Gradle and run on an emulator or device

Code Style

• Follow Kotlin coding conventions
• Use meaningful commit messages
• Write tests for new features when applicable

Changelog

v1.5 (April 2026) — Security hardening

• Security: Removed unconditional HTTP body logging — release builds emit zero network logs; debug builds log headers only with Authorization redacted
• Security: Release signing config no longer falls back to the public Android debug keystore — keystore must be supplied via FASTMASK_KEYSTORE/Gradle properties or the APK is left unsigned for external signing (e.g., Play App Signing)
• Security: android:allowBackup="false" — app data is no longer included in cloud backup or device transfer
• Security: Network Security Config restricts trust for api.fastmail.com to the system CA store; user-installed CAs cannot intercept JMAP traffic (SPKI pinning scaffold included for follow-up)
• Security: Added FLAG_SECURE and filterTouchesWhenObscured on the main window — token field, alias list, and detail screens are blanked in screenshots, screen recording, Recents thumbnail, and protected against tapjacking overlays
• Security: JMAP apiUrl from the session response is now validated against *.fastmail.com before being used for token-bearing requests
• Security: Login token is cleared from in-memory UI state immediately after the login attempt resolves
• Security: GitHub Actions pinned to commit SHAs; Dependabot configured for actions and Gradle dependencies
• Hygiene: Untracked .idea/ and .gradle/config.properties from version control (already in .gitignore)
• Docs: Full security audit report added at Plans/security-audit-report.md; SECURITY.md updated to reflect actual implementation

v1.4 (April 2026)

• Redesign: Complete UI overhaul to a warm-ink visual language — parchment background, Instrument Serif display type, JetBrains Mono labels, single amber accent
• New typography: Three Google Fonts (Instrument Serif, Inter Tight, JetBrains Mono) replace the Material default
• Sort by activity: List defaults to most recently active mask at the top (uses lastMessageAt, falls back to createdAt)
• Archive instead of Delete: Destructive action renamed to "Archive" with restorable copy ("Mail sent here will bounce. You can restore it later.")
• New custom components: PillButton, PillIconButton, StateDot, StatePill, DesignCard, DesignInput replacing M3 stock variants
• Filter pills with counts: Active / Off / Archived show live count next to the label
• Performance: Removed per-item animations and pre-computed timestamps for smoother scrolling on large libraries (100+ masks)
• Removed: Material You / dynamic color (replaced by fixed warm palette)
• Fixed: R8/ProGuard rules for Retrofit suspend functions and kotlinx.serialization on release builds
• i18n: English and Polish strings rewritten for the new design language; other 18 locales fall back to English for new keys

v1.3 (January 2026)

• New: Settings screen with language picker, contact button, and logout
• New: Localization support for 20 languages (English, Chinese, Spanish, Hindi, Arabic, Portuguese, Bengali, Russian, Japanese, French, German, Korean, Italian, Turkish, Vietnamese, Polish, Ukrainian, Dutch, Thai, Indonesian)
• New: In-app language override using AppCompatDelegate
• Improved: All UI strings now use centralized string resources
• Fixed: Choppy navigation transitions between Settings and List screens
• Fixed: Language preference now persists correctly across app restarts
• Improved: Navigation animations simplified (slide-only, 220ms with FastOutSlowInEasing)
• Improved: Soft refresh prevents shimmer loading when returning from Settings

v1.2 (January 2026)

• Fixed: Login crash caused by ParameterizedType casting error at runtime
• Improved: TokenStorage now uses lazy initialization for EncryptedSharedPreferences
• Stability: Deferred crypto initialization prevents reflection errors during Hilt injection

v1.1 (January 2026)

• Fixed: ProGuard/R8 minification crash with ParameterizedType casting error
• Improved: Added proper ProGuard rules for Google Tink (security-crypto dependency)
• Stability: Release builds now work correctly with code minification enabled

v1.0 (Initial Release)

• Manage Fastmail masked emails
• Create, edit, enable/disable, and delete masks
• Material 3 dynamic theming
• Secure token storage with EncryptedSharedPreferences

Roadmap

• Add screenshots to README
• Widget for quick mask creation
• In-app accent picker (amber / ink / sage / plum / cobalt)
• Bulk archive
• Custom design system (warm-ink palette, serif/mono typography)
• Sort by latest activity
• Localization support (20 languages)
• Settings screen with language picker

License

This project is licensed under the MIT License - see the LICENSE file for details.

Acknowledgments

• Fastmail for their excellent email service and JMAP API
• JMAP for the open standard specification
• The Android and Kotlin communities for amazing tools and libraries

---

Made with Kotlin and Jetpack Compose

Report Bug • Request Feature