GmailDeleter Privacy Policy

Last updated: February 8, 2025

Overview

GmailDeleter is a tool that helps you clean up your Gmail inbox. We are committed to protecting your privacy and being transparent about how your data is handled. We do not collect, store, or share any personal email content.

Data We Access (Temporarily, In Your Browser Session)

When you use GmailDeleter, the application accesses your Gmail account through Google's OAuth2 system with the following scopes:

• gmail.modify — to read email metadata (sender, size, labels) and move emails to trash on your behalf
• gmail.settings.basic — to create auto-trash filters when you request them

Email metadata (sender addresses, message sizes, list-IDs) is processed only during your active session to group and display results. This data is stored temporarily in a server-side database tied to your scan session and is not retained after you reset your scan or your session expires.

Data We Collect and Store

These counters are used solely to display community-wide impact statistics on the home page (e.g., "10,000 emails cleaned, 2.5 GB saved"). They are fully anonymous — they cannot be traced back to any individual user or email account. No other data is collected or stored permanently.

Data We Do NOT Collect

• We do not read, store, or process the content or body of any email
• We do not store email addresses of your contacts or correspondents
• We do not store your email address beyond your active login session
• We do not use analytics, tracking pixels, or third-party trackers
• We do not build user profiles or perform behavioral tracking
• We do not sell, share, or transfer any data to third parties
• We do not use your data for advertising purposes
• We do not train AI or machine-learning models on your data

OAuth Tokens

Your Google OAuth2 refresh token is stored in an encrypted server-side database so you do not need to re-authenticate on every visit. You can revoke this at any time by clicking "Reset permissions" in the app, which immediately deletes your stored token. You can also revoke access from your Google Account permissions page.

Data Retention

• Scan data (sender groups, message IDs): deleted when you reset your scan or start a new one. Not retained after your session ends.
• OAuth tokens: stored until you click "Reset permissions" or revoke access via Google.
• Aggregate counters (total emails trashed, total bytes saved): stored indefinitely as anonymous, non-personal statistics.

Security

GmailDeleter uses HTTPS for all communications. OAuth tokens are stored server-side and are never exposed to the browser. The application requests only the minimum Gmail permissions needed to function and uses batchModify with trash labels rather than permanent deletion — trashed emails are recoverable in Gmail's Trash for 30 days.

Children's Privacy

GmailDeleter is not directed at children under the age of 13. We do not knowingly collect personal information from children.

Changes to This Policy

If we update this policy, the "Last updated" date at the top will change. Continued use of GmailDeleter after changes constitutes acceptance of the updated policy.

Contact

If you have any questions about this privacy policy or your data, please open an issue on our GitHub repository.