Are Gmail cleaner apps safe? Read the permission, not the promise

Your inbox holds password resets, bank statements, medical letters and years of private conversations. Any cleanup tool needs some access to it. The question isn't whether the app says it's trustworthy. It's how much Google's consent screen lets it do, and where your mail ends up.

The four levels of Gmail access

When an app asks to connect, Google's consent screen lists what it's requesting. For Gmail, it's one of these, from most to least powerful:

Notice that "read-only" still means read everything. The only level that keeps the content of your emails out of reach is metadata.

Why cleaners often ask for a lot

Deleting inside the app requires modify or full access. Reading a message to spot an unsubscribe link requires read access. Those are real features, but each one widens what the app could do with your account. The trade-off is convenience against exposure, and it's worth making consciously rather than by reflex.

The other half: where does your mail go?

Access level is what an app may do. Architecture is what it does:

• Server-side apps fetch your mail (or data derived from it) onto their own servers to process it. Google requires apps that handle restricted Gmail data on servers to pass an annual security assessment, but your data still lives somewhere you don't control.
• In-browser apps talk to Gmail directly from your browser tab. Nothing passes through the developer's servers, because there aren't any.

A checklist before you click Allow

• Which access level? Does the app need to read your messages for what you want to do?
• Where is data processed? The privacy policy should say plainly whether mail touches its servers.
• Is there a Limited Use disclosure? Apps using Google user data must state they follow Google's API Services User Data Policy. No mention is a red flag.
• How does it make money? If a tool is free and processes your mail on its servers, find out what pays for those servers.
• Can you leave easily? Access should be revocable at any time, and local data erasable.

How to revoke an app's access

1. Open myaccount.google.com/permissions.
2. Pick the app from the list of third-party apps with account access.
3. Remove its access. It takes effect immediately. It's worth reviewing this list once a year anyway.

How MailBalance handles it

We built MailBalance around the most restrictive option that can still do the job:

• Metadata only. It requests gmail.metadata and nothing else: sizes, dates, labels and a few headers. It cannot read your emails or open your attachments, by design, not by promise.
• No backend. The scan runs in your browser tab and the index stays on your device. There's no server that could store your data.
• It never deletes. It shows you what's heavy and links you to the matching Gmail search. You do the deleting, in Gmail.

The trade-off is that last step: one extra click in Gmail. We think that's the right price for never handing over your mail. Full details are in the privacy policy.

Questions

See also