Your inbox is yours.

When you connect Gmail, the first permission lets I Hate Spam inspect message headers and labels for the latest inbox messages, not their bodies. If you approve cleanup actions, Google may ask for additional permission to change labels, move messages to Trash or create Gmail filters. You decide every action.

For automatic unsubscribe, our server also asks Gmail for the account email address to validate your access token and bind the operation to your mailbox. The address is converted to a keyed identifier for abuse prevention; the server does not persist the address or access token.

Outlook starts with Mail.ReadBasic and examines senders and headers for up to 100 recent inbox messages. Cleanup can ask separately for Mail.ReadWrite to move selected scanned messages from Inbox to Archive or Deleted Items, with restoration to Inbox. If you choose to send future messages automatically to Deleted Items, Microsoft also asks for MailboxSettings.ReadWrite so the application can create one Inbox rule for each exact sender address you selected. Actions run only after you review them and click Apply email actions; if Microsoft then asks for permission, approving it continues those reviewed actions automatically.

We do not maintain a database of emails, message bodies, contacts, headers or access tokens. For automatic unsubscribe, the server reads headers directly from Gmail or Outlook using the temporary token for this operation. It does not persist that token. Encrypted short-lived plans are returned to the browser.

An operational database stores only keyed opaque identifiers, counters and outcome codes to prevent abuse and repeated requests. Request counters expire after their time window; attempt records expire after 7 days. Expired records are removed on the next authorised use, so an inactive database may retain expired entries until it is used again. Hosting backups may retain these records longer.

Tokens and archive/undo state otherwise remain in page memory. The language preference and a limited record of sender and account addresses that you confirm as treated are stored only on your device. Treated-sender records expire after 90 days and let later scans avoid proposing the same future action again; you can remove them by clearing this site’s browser data. Hosting and sign-in providers process connection information needed to operate their services.

For Outlook moves, we request a minimal response, but Microsoft may return additional message fields. The application discards the move response without parsing or storing it and verifies the result with a separate metadata-only request. For an Outlook routing rule, the application sends only the selected sender address and reads the created rule identifier to confirm success. Access tokens and rule identifiers remain in page memory. We do not claim that write permissions technically prevent Microsoft from returning additional data.

Automatic sending currently supports Gmail messages whose unsubscribe headers are cryptographically verified and match a trusted Gmail DKIM result, with destinations limited to supported platform-controlled Beehiiv, Bloomreach, Kit and ActiveCampaign hosts. Outlook currently falls back to manual review because its receiver authentication provenance is not yet verified by this service.

The sender receives the personalised unsubscribe URL and a fixed one-click request, never your mailbox access token. Public DKIM domain and selector names, and supported destination hostnames, are sent to Cloudflare DNS for validation; personalised URLs are not sent to DNS.

An accepted HTTP request is not independent proof of removal from a mailing list. Unsupported or unverified requests require manual review. External pages apply their own privacy policies and may cancel the subscription on opening. A manual action is marked as treated only after you explicitly confirm that you completed it; this remains your report, not an independent verification. We do not read message bodies to find footer links.

Gmail blocking uses a filter that sends future messages from the selected address to Trash. For Outlook, the service opens Microsoft’s blocked-senders settings and records the sender as treated only after your confirmation.

• Encrypted transport: the site and its mailbox API requests use HTTPS. Google access tokens are sent only to Google and, for automatic unsubscribe checks, to our own HTTPS endpoint. They are never sent to newsletter senders.
• Limited access: Gmail analysis initially requests only gmail.metadata. Permission to modify selected messages (gmail.modify) or create sender filters (gmail.settings.basic) is requested when needed for your reviewed actions. We do not request permission to permanently delete email, and do not use the broader write permission to read message bodies, compose or send messages.
• Token handling: access tokens are held in page memory, not browser persistent storage or our database. During automatic unsubscribe checks the server processes the token temporarily. Our application does not log tokens, message headers or message content. Closing or reloading the page clears its in-memory session; disconnecting Gmail also requests revocation.
• Protection of unsubscribe plans: short-lived plans are encrypted and authenticated with AES-GCM. Server-keyed HMAC identifiers associate operations with the verified mailbox without persisting its address in the operational database. Encryption keys are configured as hosting secrets, not shipped to the browser.
• Misuse prevention: the server checks the request origin and Google credential, limits request size and frequency, and checks plan expiry and single use. Before automatic unsubscribe it verifies signed headers and restricts destinations. It does not follow unsubscribe redirects or automatically retry uncertain requests.
• Browser and storage boundaries: security headers restrict scripts and framing. Operational records contain opaque identifiers, counters and outcome codes, with the retention limits described above. The separate treated-sender history stays on your device and can be removed by clearing this site's browser data.

No online service can promise absolute security. Hosting and identity providers operate their own infrastructure and security controls. Contact us if you suspect unauthorised access or want help removing device-local records.

I Hate Spam's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the email analysis and user-approved cleanup features described here, not for advertising, sale, or training general-purpose AI models.

You can disconnect and review each proposed action. Gmail disconnect requests token revocation. Outlook disconnect clears the application’s in-memory session without signing you out of other Microsoft services; to withdraw ongoing consent, remove the app’s access in your Microsoft account settings. Rules created for future Outlook emails remain in Outlook until you remove them in Outlook settings. You can also revoke Gmail access in your Google Account settings.

Confirmed Outlook archive and Deleted Items moves can be undone on the results screen until a new scan, disconnect or reload. You can also move messages back to Inbox directly in Outlook. The application does not permanently delete messages or empty trash. Do not empty Deleted Items during the test; mailbox retention policies still apply and may limit recovery.

I Hate Spam is operated by Ethia. For privacy, support or Gmail authorisation questions, contact ethia.studio@gmail.com.