Is Clean Email safe? How its Gmail security model works
TL;DR
- Yes — Clean Email signs in through Google OAuth only. You type your Google password into Google's own page, never into Clean Email.
- Clean Email reads Gmail metadata only (sender, labels, size, thread ID) to build counts. It never reads or stores the body of any email.
- Full Gmail access is requested only because optional permanent delete requires it; Google has no narrower scope that supports it.
- Every deletion is checked twice — once when the search query is built, once again message-by-message right before deletion — so protected mail can't slip through.
- You can revoke Clean Email's access at any time from myaccount.google.com/permissions.
This page covers the full security model in one place: how sign-in works, exactly which Gmail permissions are requested and why, what Clean Email can and can't see, and how deletion is safeguarded.
Sign-in: Google OAuth, never a password form
Clean Email has no login form of its own. Clicking 'Sign in with Google' sends you to Google's own accounts.google.com page, where you enter your Google credentials directly into Google's interface.
Once you approve, Google hands Clean Email an OAuth token, not your password, scoped to only the permissions shown on the consent screen. This is the same standard OAuth 2.0 flow used by most 'Sign in with Google' buttons.
The Gmail permissions requested, and why
Google's consent screen lists two permission scopes. Each maps to a specific need — none are requested speculatively.
| Scope | Why Clean Email needs it |
|---|---|
| https://mail.google.com/ (full Gmail access) | Permanent delete needs it — Gmail's only narrower option (gmail.modify) can move mail to Trash, but can't delete it outright. |
| https://www.googleapis.com/auth/gmail.settings.basic | Creates an archive filter for senders you unsubscribe from with the Stop Ads add-on, so their future mail skips your inbox automatically. |
What Clean Email can see, and what it can't
The full Gmail scope is broad by necessity, but Clean Email's own code path only ever touches message metadata — never the content of a message.
- Reads: sender address, Gmail labels, message size, thread ID, and whether an attachment is present
- Never reads: the subject line or body text of any email
- Never stores: email content of any kind, in any form
- Stores: counts only — how many emails match each cleanup category, and how much storage they'd free
Deletion is checked twice before anything is removed
Protection isn't a single filter — it's enforced at two separate points, so a mistake in one can't cause a wrong deletion.
First, protected mail (starred, important, labeled, attachments, sent, drafts, two-way conversations, whitelisted senders) is excluded when Clean Email builds the Gmail search query.
Second, right before deleting, each individual message is checked again against the same rules. This second check is the authoritative guard: it holds even if a Gmail search operator behaves unexpectedly, so a bad search shortcut can never bypass it.
Where access is stored, and how to revoke it
Clean Email stores only the OAuth access tokens Google issues after you approve the consent screen. It never stores your Google password, because it never receives it in the first place.
You control the connection from both sides, and can end it whenever you choose:
- From Google: go to myaccount.google.com/permissions, select Clean Email, and click Remove access
- From Clean Email: use the disconnect option inside the app
- Revoking access does not undo cleanups already run, but it stops any further access instantly
FAQ
- Is Clean Email safe to connect to my Gmail account?
- Yes. Clean Email connects through Google's official OAuth sign-in, never sees your Google password, reads only email metadata (never message bodies), and checks its protection rules twice before deleting anything.
- Does Clean Email ever see or store my Google password?
- No. You sign in entirely on Google's own page. Clean Email receives an OAuth token proving you approved access — it never receives, sees, or stores your password.
- Why does Clean Email request full Gmail access (https://mail.google.com/) instead of a limited scope?
- Because permanent deletion (the Gmail API's messages.batchDelete) isn't available under the narrower gmail.modify scope, which can only move mail to Trash. Google doesn't offer a scope that supports permanent delete without also granting full Gmail access.
- Does Clean Email read the content of my emails?
- No. Clean Email only reads message metadata — sender address, labels, size, and thread ID — to build counts. It never fetches, reads, or stores the subject line or body text of any email.
- What data does Clean Email store about my mailbox?
- Clean Email stores counts, such as how many promotional emails exist or how much storage a cleanup would free. It does not store the content of any message, in any form.
- How does Clean Email make sure it doesn't delete the wrong email?
- Every cleanup is checked twice. Protected mail is excluded when the Gmail search query is first built, then each message is checked again individually right before deletion. The second check is authoritative and holds even if a search operator behaves unexpectedly.
- How do I revoke Clean Email's access to my Gmail account?
- Go to https://myaccount.google.com/permissions, find Clean Email, and click Remove access. You can also disconnect it from within the Clean Email app itself.
- If I revoke access, does Clean Email still have my mailbox data?
- No email content was ever stored in the first place — only counts. Revoking access on Google's side immediately stops Clean Email's ability to reach your Gmail account going forward.
Sources
Sign in with Google, scan your mailbox for free, then clean it in one click.
Clean your Gmail inbox nowUpdated: 2026-07-29