Mail Cleaner privacy policy

Last updated October 13, 2026.

This policy covers Mail Cleaner, the free and open source app made by XxSeRyIxX that cleans up Outlook, Gmail and IMAP mailboxes: the website and the desktop edition for Windows, macOS and Linux.

In short

Mail Cleaner runs in your browser, or with the desktop edition on your own computer. It has no server of its own, no accounts, no analytics and no ads. Your mail goes straight between your device and Microsoft, Google or your mail server. Nobody else receives it, including the author.

What data it accesses

• Your email address, to show which account is signed in.
• Your folders or labels, with how many mails they hold and how much space they use.
• For each mail in the folders you choose to scan: the sender, subject, date, size, read state, folder or labels (including Gmail's Spam, Promotions and Social), whether it has attachments, its unsubscribe headers and the short text preview your mail service provides.
• The full content of a mail, only when you open that mail in the app.
• Your inbox rules in Outlook, or your filters in Gmail, so it updates its own block rule and never blocks a sender twice.
• With Gmail, your Google storage quota, through a Google Drive permission (drive.appdata) that can't see your files.

How it uses that data

Only to provide the features you see in the app, on your device: grouping your mail by sender or domain, the filters and the spam score, the storage card and the mail viewer. It changes your mailbox only after you confirm an action in the app:

• moving mail to the trash, deleting it, archiving it, or marking it as read or unread;
• creating its block rule (Outlook) or block filters (Gmail);
• emptying the trash;
• unsubscribing: to senders that support one-click unsubscribe, the app sends the standard request to the address they put in their mail; for the others it shows you their links to open yourself.

Your data is never used for advertising, never sold, never used to train AI or machine learning models and never read by people.

Where it keeps data, and for how long

• What it reads from your mailbox stays in the page's memory. It is deleted when you sign out, close or reload the tab, or close the desktop app, and it is never saved to disk or sent to any server.
• Sign-in tokens stay in the tab's session storage and are deleted when you sign out or close the tab. Signing out of Gmail also withdraws the app's access. In the desktop edition you sign in in your own browser, and the app keeps the sign-in in memory until you close it.
• Your settings and your remove list (the addresses and domains you chose) are kept in your browser's local storage, on your device, until you clear this site's data in your browser.
• Desktop edition with IMAP: your mail password is only sent to your mail server, over an encrypted connection. On Windows it's stored on your computer, encrypted with your Windows account; on macOS and Linux the app keeps it only until you close it. Signing out deletes it.
• Files you export are made only when you ask: the website gives them to you to copy or download, and the desktop edition saves them in your Downloads folder.

Who receives data

Mail Cleaner doesn't share, sell or transfer your data to anyone. The app only talks to:

• Microsoft (sign-in and Microsoft Graph) or Google (sign-in, the Gmail API and the Google Drive API), to do what you ask with your own mailbox;
• the unsubscribe addresses senders put in their mails, only when you choose to unsubscribe from them;
• in the desktop edition, your IMAP server, and autoconfig.thunderbird.net, which receives only the domain of your address when the app looks up your server.

The text for an AI (Export for AI) lists your senders with their statistics and, if you tick those options, their recent subjects and the start of their latest mail. The app never sends it anywhere: you decide whether to paste it into an AI service, and that service's own privacy policy then applies.

How it protects your data

• Every connection uses HTTPS or, for IMAP, an encrypted connection (TLS).
• You sign in on Microsoft's or Google's own page: the app never sees the password of those accounts.
• Mails are shown in a locked-down frame: their scripts never run, and remote images, which tell senders you opened a mail, load only when you allow them.
• The page runs only its own code and Google's sign-in library, enforced by its Content Security Policy, and it refuses to run inside other sites' frames.
• The code is open source, so anyone can check that it does what this policy says.

Google user data

Mail Cleaner's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described above, which you use in the app. It is not stored on any server, not transferred to anyone, not used for advertising or to train AI or machine learning models, and not read by people.

Your control

Sign out at any time. You can also remove the app's access in your Microsoft account (Privacy, Apps and services) or at myaccount.google.com/permissions. To delete your settings and remove list, clear this site's data in your browser.

Changes to this policy

If Mail Cleaner ever uses your data differently, this page changes first and the date at the top says when. Every version of it is public in the project's history.

Contact

Open an issue at github.com/XxSeRyIxX/mail-cleaner.