Privacy policy

ClearInbox (“we”, “us”) operates the email cleanup service at clearinbox.app. For any privacy question or request, email [email protected].

We collect only what the service needs to clean and organize your mail:

• Your ClearInbox account: your email address, an optional name, your password (stored only as a bcrypt hash) and your app settings.
• Connected mailboxes: the address, provider and connection credentials (OAuth tokens for Gmail and Outlook, or an app password for IMAP providers), encrypted at rest with AES-256-GCM.
• Message metadata: for each message we sync the headers needed to classify it: sender and recipients, subject, date, size, folder and labels, read/starred state, attachment flag, mailing-list headers (List-Id, List-Unsubscribe) and a short preview snippet of the text.
• What you create in the app: Auto Clean rules, sender settings (blocked, muted, trusted), screener decisions, saved searches and the activity log of actions taken.

We do not download or store full message bodies. When you compose, reply to or forward a message, its content passes through our servers to your email provider to be sent and is not retained by us.

• We never sell, rent or share your data for advertising.
• We never use your email to train AI models, ours or anyone else’s.
• We run no third-party analytics, advertising pixels or tracking scripts.
• We never read your mail for any purpose other than the actions you ask the app to take.

To provide the service you asked for, and nothing else:

• to sort your mail into smart categories and show cleaning suggestions;
• to carry out the actions you take or schedule (archive, delete, move, label, block, Auto Clean rules);
• to unsubscribe you from mailing lists when you ask. This sends the list’s own unsubscribe request, so the sender learns that your address unsubscribed;
• to check your connected addresses against known data breaches (Privacy Monitor);
• to keep the service secure and to answer your support requests.

• Your email provider (Google, Microsoft or your IMAP host): we connect to your mailbox through their APIs or IMAP to read metadata and apply your actions.
• Have I Been Pwned: when breach monitoring runs, your connected email addresses are sent to the Have I Been Pwned API to look up known breaches. No message data is sent.
• Infrastructure providers: our hosting provider runs the servers and database, and Cloudflare handles network traffic to the site.

We do not hand your email to any other outside processor.

ClearInbox’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the cleanup features you use in the app, is never transferred for advertising, and is never read by humans except with your explicit consent for support, for security, or where the law requires it.

Connections to ClearInbox and to your providers are encrypted in transit with TLS. Mailbox credentials are encrypted at rest with AES-256-GCM, and account passwords are stored only as bcrypt hashes. Every cleanup action, manual or automatic, is written to an activity log you can review.

• Disconnecting a mailbox in Accounts deletes its stored credentials, message metadata, sender data and screener entries from our database.
• Deleting your account: email [email protected] from your account address and we will delete your account and all associated data.
• You can also revoke ClearInbox’s access at any time from your Google account connections or Microsoft account app permissions, or by deleting the app password at your IMAP provider.

Otherwise we keep your data for as long as your account is active.

The app stores your sign-in token and your selected account in your browser’s local storage so you stay signed in. We use no advertising or analytics cookies.

Depending on where you live (for example under the UK or EU GDPR), you can ask to access, correct, export or delete your personal data, or object to how we process it. Email [email protected] and we will respond. You also have the right to complain to your local data protection authority.

ClearInbox is not directed at children under 16 and we do not knowingly collect their data.

If we change this policy we will update the date at the top of this page, and tell signed-in users about material changes in the app. See also our terms of service.