We prefer never to hold a password
Gmail and Outlook connect by OAuth. We receive a scoped token, never your password, and you can revoke it from your Google or Microsoft account at any moment without involving us.
Security
A tool that deletes mail has to earn trust twice
Once for holding the keys to your mailbox, and again for the irreversible thing it does with them. Here is exactly how both are handled.
Credentials are encrypted, and bound to you
OAuth refresh tokens and IMAP app passwords are encrypted with AES-256-GCM before storage. Your account identifier is mixed into the ciphertext as authenticated data, so a record lifted into another account simply fails to decrypt.
Message content is never written down
When a keyword rule needs the body of a message, that text is evaluated in memory and discarded. It is never stored, never logged and never leaves the process. Attachments are never opened at all.
Passwords are hashed, not encrypted
Account passwords are stored as scrypt hashes with per-user salts. We cannot read them, recover them, or hand them to anyone.
Two-factor authentication
Every account can enable TOTP with any authenticator app, backed by ten single-use recovery codes. With 2FA on, a stolen password alone cannot produce a session. Turning it off requires the password again.
Brute force gets slow, fast
Failed sign-ins are recorded and rate-limited per account, with temporary lockout after repeated failures. Non-existent accounts are hashed anyway so response timing reveals nothing.
The deletion safety model
Most of the engineering here went into not deleting the wrong thing.
| Guard | What it does |
|---|---|
| Preview first | Every job counts matches, breaks them down by folder and shows a sample before anything is touched. Deletion only starts when you confirm. |
| Trash by default | Deletions move mail to your provider's Trash. Permanent deletion is opt-in, refused for scheduled rules, and always warns that it cannot be undone. |
| Recorded undo | Every affected message id and its original folder is stored, so undo restores them precisely rather than guessing. |
| Protected folders | Sent, Drafts and Archive are never included unless you name them explicitly. "Clean everything" never means those. |
| Starred excluded | Starred and flagged mail is excluded from every query by default. |
| No unbounded queries | A rule with no folder, keyword, sender or date filter is refused outright rather than matching your whole mailbox. |
| Large-job confirmation | Jobs above the configured ceiling require a second, explicit acknowledgement. |
| Never-delete lists | Per-account sender and keyword lists that override any rule, however it was written. |
| Proof required | If a message cannot be proven to match — unknown date, unknown size, unknown flags — it is kept, not deleted. |
| Audit log | Every connect, preview, confirmation, deletion and undo is recorded with a timestamp. |
Infrastructure
- All traffic over HTTPS with HSTS; HTTP redirects permanently to HTTPS.
- Strict Content-Security-Policy,
X-Frame-Options: DENY,nosniffand a restrictive Permissions-Policy on every response. - The application binds to localhost only and is reachable solely through the reverse proxy.
- It runs as an unprivileged system account with a read-only filesystem apart from its own data directory, with
NoNewPrivileges,PrivateTmpand syscall restrictions. - Structured logs are scrubbed of anything matching a credential, token or password pattern before they are written.
- Session cookies are
HttpOnly,SameSite=LaxandSecureover HTTPS.
Responsible disclosure
If you find a vulnerability, please tell us before telling anyone else. Email security@emailcleaner.xyz with enough detail to reproduce it.
We will acknowledge within 3 working days, keep you updated, and credit you when the fix ships if you would like that. Please do not run automated scanners against the production service, access data that is not yours, or degrade the service for other users.
Machine-readable contact details are at /.well-known/security.txt.
We have no bug bounty programme yet, but we will always act on a credible report and acknowledge the reporter.
Read the fine print
The privacy policy sets out exactly what we access and how long we keep it, including our Google API Limited Use disclosure.