Here is the actual code in the back-end where we use your PGP public key:

Source code for PGP encryption for storage when you're connected (we only use your password in-memory, and never write it to disk on our side) @ https://github.com/forwardemail/forwardemail.net/blob/562a52...

Outbound email automatically checks for PGP key in case you didn't include the recipients (we use WKD): https://github.com/forwardemail/forwardemail.net/blob/562a52...

Your individual mailbox is a SQLite database file and is encrypted using ChaCha20-Poly1305 as well (using your password, which only you have access to; we only use it in-memory and don't write it to disk).

Right, but inbound emails over POP/IMAP will be TLS encrypted. You're saying emails are encrypted at rest, but they cannot be encrypted in-flight because it's forwardemail that holds the TLS private key.