If you use Xpressed, you'll notice that every post gives you a choice: send the full update as an email, or send a secure link that your readers tap to open the post in the app.
Both options work. They're designed for different situations. Here's how to think about which one to use.
What the secure link does
When you send a secure link, the email your readers receive contains almost nothing — a short notification that a new update is waiting, and a link they tap to read it. The actual content of your post never appears in the email.
Your reader taps the link, the app recognizes them, and they're reading your update in a private, login-gated environment. No password required — the link itself is the credential. One tap and they're in.
If that email is intercepted, forwarded, or ends up somewhere it shouldn't, there's nothing in it. The content stayed behind the login.
What full email does
When you send the full email, your update arrives in your readers' inboxes fully rendered — text, photos, everything. They can read it without tapping through to anything. It's the most frictionless experience for the reader.
The tradeoff is that the content is now in an inbox. It will stay there. It can be forwarded. If that reader's account is ever accessed by someone else, the content is there to be read.
How to decide
The default in Xpressed is the secure link, and that's intentional. For most people doing field work, research, or anything with any degree of sensitivity, keeping content out of inboxes is worth the one extra tap.
Full email makes sense when your readers are in straightforward contexts and the content of your update doesn't require extra care. Some people switch specific readers to full email — a parent who's less comfortable with apps, a close friend in a context where there's no sensitivity concern.
You can set this at the account level, override it per post, and set it per reader. The rule is always most-secure-wins: if a post is set to secure link, all your readers get the link regardless of their individual settings.
One more thing: expiry
If you're sending an update with a secure link and you've also set an expiry date, the content will disappear from the app on that date. Readers who tap the link after expiry won't find anything there.
If you send the same update as a full email, the content has already landed in inboxes and can't be recalled — the expiry only affects the app copy. Xpressed will warn you about this before you send, so you can decide with full information.
The combination of secure link and expiry is the strongest privacy posture. Whether you need that depends entirely on your situation.