The boundary: what we store, what we never store
The strongest security control is not holding the data at all. DeclutrMail’s boundary is literal: Full bodies fetched: 0. Message data is fetched from Gmail’s API in metadata form only — never the full or raw message format.
Message data we store:
- Gmail message and thread IDs
- Sender name and email address
- Subject
- Gmail Preview (the short snippet shown in your inbox list)
- Received date
- Gmail labels
- Read or unread state
- Whether a message was sent by you
- Recipient email addresses from To and Cc on mail you sent
- Unsubscribe links and whether one-click unsubscribe is supported
- Gmail message size estimate
We never fetch or store:
- Full message body
- HTML
- Attachments
- Inline images
- Raw MIME
- Headers other than From, Subject, To, Cc, and List-Unsubscribe fields
Because full message bodies and attachments are never in our systems, that content cannot leak from DeclutrMail. Subjects and Gmail Preview snippets can still contain sensitive information; we store those bounded fields as disclosed above and protect them accordingly.
OAuth scopes, and why
DeclutrMail requests one Gmail scope, gmail.modify, plus openid and your email address to identify the connected account. The product’s job is to act on your mail at your instruction — archive, label, delete, unsubscribe — and gmail.modify is the scope that permits those label changes.
The scope is broader than what we use, and that gap is closed in code: message data is fetched with Gmail’s metadata format and an explicit header allowlist, never the full or raw formats that carry bodies and attachments. You can revoke access at any time from Settings or from your Google account permissions page.
Encryption
All data is encrypted in transit (TLS) and at rest. Your Gmail OAuth tokens get an extra layer: each token is envelope-encrypted with its own fresh 256-bit data key (AES-256-GCM), and that key is in turn wrapped by a key-management-service key that never enters the application process. Tokens are never sent to your browser and never included in data exports.
Independent assessment (CASA Tier 2)
Apps using restricted Gmail scopes are subject to Google’s independent CASA (Cloud Application Security Assessment) process. DeclutrMail’s current Tier 2 assessment cycle is in progress. We will publish the issued evidence here after it is available; this page does not claim a current verification letter before then.
No ML category prediction
DeclutrMail does not use machine learning to predict email categories or route senders. It can automatically protect a sender using deterministic product rules when strong engagement signals, such as your reply history, cross the documented threshold; you can review and change that protection. Mail-changing automation follows preset rules you explicitly enable — never a model’s guess. We also do not use Gmail data to train generalized AI or machine-learning models.
Leaving cleanly
You can disconnect an inbox (which revokes our Google access, stops syncing, and preserves its historical DeclutrMail record for reconnection), delete one inbox’s indexed data, or schedule deletion of your whole account from Settings. Account deletion has a 7-day grace period, and if you have actions still inside a longer undo window, deletion is scheduled after the latest window expires so undo keeps working for its full window. Details are in the Privacy Policy.
Report a vulnerability
If you believe you have found a security vulnerability in DeclutrMail, email privacy@declutrmail.com with the details. We read every report and will respond, and we ask that you give us reasonable time to fix an issue before disclosing it publicly.