Privacy Policy — Adinand Email Cleaner

Last Updated: November 3, 2026

Adinand Email Cleaner was previously published as Zen Inbox Cleaner; this document applies to the app under both names.

At Adinand Email Cleaner, we value your privacy and your peace of mind. Our app is built on the principle that your email data belongs to you. This Privacy Policy explains our commitment to transparency and how we handle your information.

1. Our Privacy-First Approach

Adinand Email Cleaner comes in four forms: the iOS app, the Android app, the Google Workspace add-on for Gmail (§10 describes the add-on), and the Chrome extension (§11 describes the extension). On iOS and Android, your email data stays inside your email account — your Google account, or the Microsoft account of an Outlook account you connect (§12) — and on your device — we operate no servers, databases, or cloud infrastructure that touch user data, all processing occurs on-device, and your email content never reaches any system we control. The Workspace add-on works differently, and §10 describes it in full: it is Apps Script code that runs on Google's own servers inside your Google account, not on your device. In all four, we operate no server of our own and your email content never reaches any system we control. The only narrow exception is a small free-tier usage counter (a tally of emails cleaned (trashed, archived or labelled) and bytes recovered — never any email content), which on iOS may sync across your own Apple devices through Apple's iCloud Keychain if you have it enabled. That stays entirely within your personal Apple account and never reaches us or any third party. See §4 for details.

2. Data We Access

Adinand Email Cleaner only accesses the data strictly necessary to help you manage your inbox:

• Email metadata only. We read message identifiers, sender addresses, subject lines, and date/timestamp headers. On the dashboard path we also read the List-Unsubscribe, List-ID, and Precedence headers to power the unsubscribe and sender-trust features. The List-Unsubscribe-Post header (per RFC 8058) is fetched only when you explicitly tap "Unsubscribe" on a sender — never proactively, never stored to disk, and never used by background workers.
• No email body content or attachments are read or stored.
• No access to: email body content, attachments, contacts, device storage, camera, microphone, location, or SMS.

Adinand Email Cleaner does not access or store email body content or attachments.

The list above describes the iOS and Android apps. For an Outlook account, on iOS and on Android, the app reads the same kinds of message details from Microsoft Graph instead, and §12 lists exactly which ones. The Workspace add-on reads headers only, never message bodies, and §10 says exactly what it reads. The Chrome extension also reads headers only, and §11 says exactly what it reads.

3. OAuth Scopes Requested

The iOS and Android apps request three Google OAuth scopes at sign-in, and the Chrome extension requests the same three. The Workspace add-on requests four: the same three, plus https://www.googleapis.com/auth/gmail.addons.execute, which is what allows an add-on to run inside Gmail at all. See §10. These scopes support the following functionality:

• https://www.googleapis.com/auth/gmail.modify — Used to read email metadata (sender, subject, date, and unsubscribe headers), move user-selected emails to Trash, archive them, or add a label to them on your explicit confirmation, list your Gmail labels and create a new label you choose, and send one-click unsubscribe requests on your behalf when the sender supports RFC 8058. All writes are user-initiated; there is no automated or scheduled modification.
• https://www.googleapis.com/auth/gmail.settings.basic — Used only to create and remove the Gmail filters used by the optional Cleanup Rules feature. A filter may archive, label or trash a sender's future emails, as you choose. Filters are never created without an explicit user-tap confirmation.
• https://www.googleapis.com/auth/userinfo.email — Used once at sign-in to fetch your Google account email address. This is needed as a stable per-account identifier, so that each account's local data is kept apart — on iOS, where you can connect more than one account, each account's data is stored separately and removing one account leaves the others untouched; on Android, which holds one account at a time, signing out clears that account's local data — and so the in-app Settings screen can show which account is in use. openid and userinfo.profile are not requested — we do not access your profile photo, display name, or any other userinfo fields.

The app requests only the permissions essential to its core functionality. The optional Pro in-app upgrade does not require any additional Google OAuth scopes; it is handled by the platform's built-in App Store (iOS) and Google Play (Android) services.

Microsoft permissions (Outlook accounts, iOS and Android). If you connect an Outlook.com, Hotmail, or work or school Microsoft account on iOS or Android, the app signs in through the Microsoft Authentication Library (§7) and its own code asks Microsoft for three delegated permissions:

• Mail.ReadWrite — which Microsoft describes as "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail." (Microsoft Graph permissions reference, read 28 October 2026). The app uses it to read the message details listed in §12; to move emails you select to Deleted Items or to Archive, and, if you tap Undo, back to where they were; and to add an Outlook category you choose to emails you select. Every change follows your explicit confirmation.
• MailboxSettings.ReadWrite — which Microsoft describes as "Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail." (Microsoft Graph permissions reference, read 28 October 2026). The app uses it to list, create and delete the Inbox rules behind the optional Cleanup Rules feature, and to list your Outlook categories and create a new one you choose.
• User.Read — which Microsoft describes as "Allows users to sign-in to the app, and allows the app to read the profile of signed-in users. It also allows the app to read basic company information of signed-in users." (Microsoft Graph permissions reference, read 28 October 2026). The app uses it only to convert the message identifiers that Microsoft's search returns into the stable form every other request uses; it does not request your profile.

Your account's sign-in name (for most accounts, your email address) and Microsoft's identifiers for your account and organisation come back from Microsoft's sign-in itself. The app uses them to keep each account's local data apart and to show which account is in use.

The Microsoft Authentication Library adds three of Microsoft's standard sign-in scopes to every sign-in and token request on its own: openid, profile and offline_access. Microsoft says openid gives the app "a unique identifier for the user", profile gives "access to a large amount of information about the user" — including given name, surname, preferred username and object ID — and offline_access gives "access to resources on behalf of the user for an extended time" (Microsoft identity platform, Scopes and permissions in the Microsoft identity platform, read 31 October 2026).

If your organisation requires an administrator's approval, the approval link — in the app and on our IT admins page — asks your administrator for exactly what the sign-in itself uses: the three permissions above plus offline_access, openid and profile, which Microsoft describes as "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.", "Allows users to sign in to the app with their work or school accounts and allows the app to see basic user profile information." (Microsoft Graph permissions reference, read 28 October 2026) and "Allows the app to see your users' basic profile (e.g., name, picture, user name, email address)" (Microsoft Graph permissions reference, read 31 October 2026).

4. Local Data Storage

• On iOS: Local caches use SwiftData (ZenInboxDB) for cached sender statistics and dashboard summaries, and SQLite via GRDB (one ZenInboxMailbox file per connected account) for the sender intelligence index. Both stores live inside the app sandbox and never leave your device.
• On Android: Local caches use Room (a ZenDatabase for cached sender statistics and dashboard summaries, and a MailboxDatabase for the sender intelligence index). Both stores live inside the app sandbox and never leave your device.
• OAuth tokens are stored in secure device storage — the iOS Keychain on iOS and EncryptedSharedPreferences on Android. For an Outlook account on iOS, the Microsoft Authentication Library keeps its token cache in the iOS Keychain under the app's own private access group, so it is not shared with other apps — Microsoft: "If you don't want to share SSO state between multiple apps, or use any keychain access group, disable keychain sharing by passing the application bundle ID as your keychainGroup" (Microsoft Learn, Configure keychain, read 28 October 2026). The current Microsoft access token is otherwise held in memory only. For an Outlook account on Android, the Microsoft Authentication Library keeps its token cache in the app's private storage, encrypted with a key protected by the Android Keystore. If Microsoft Authenticator, Intune Company Portal or Link to Windows is installed, Microsoft's sign-in can run through that app instead. Microsoft: "On Android, the Microsoft Authentication Broker is a component that's included in the Microsoft Authenticator, Intune Company Portal and Link to Windows apps." and "When a broker is installed on a device, all subsequent interactive token requests (calls to acquireToken()) are handled by the broker rather than locally by MSAL." (Microsoft Learn, How to enable cross-app SSO on Android using MSAL, read 3 November 2026). On Android, too, the current Microsoft access token is otherwise held in memory only.
• Outlook accounts (iOS). An Outlook account gets the same per-account local stores as a Gmail account — its own ZenInboxMailbox file, its rows in ZenInboxDB, and its preferences and history — plus an entry in the app's list of connected accounts (the address, the provider and an outlook: identifier built from Microsoft's account ID). If a work or school sign-in stops at an approval step, the app also remembers your organisation's Microsoft tenant identifier and that step in its local preferences, so it can show the right screen; this is cleared when that account connects or is signed out. None of it leaves your device.
• Outlook accounts (Android). On Android, which holds one account at a time, an Outlook account uses the same local stores as a Gmail account — ZenDatabase, its own MailboxDatabase file for the sender index, and the app's preferences — and the app records it as the signed-in account by its address and an outlook: identifier built from Microsoft's account ID. If a work or school sign-in stops at an approval step, or your organisation requires Microsoft Authenticator, the app remembers that step in a separate local preferences file (outlook_connection_state), with your organisation's Microsoft tenant identifier for an approval step. An approval step is cleared when an account from that organisation connects; Sign Out and Delete Account & Data do not otherwise clear this file, and uninstalling the app removes it. None of it leaves your device.
• In-app purchase data (Pro upgrade). Adinand Email Cleaner offers an optional paid tier (the Pro plan), available as a monthly auto-renewing subscription, an annual auto-renewing subscription, or a one-time lifetime purchase. All payment processing is handled by the operating system — Apple's App Store on iOS, Google Play on Android. We never receive your payment method, billing address, Apple ID / Google account credentials, or the Apple ID / Google Play billing email (which may differ from the Gmail or Microsoft address you signed in with under §3).
  • On iOS: The app uses Apple's StoreKit 2 framework. To determine whether you have purchased the Pro plan, the app queries Apple's local Transaction.currentEntitlements API, which returns Apple-signed transaction objects from iOS-managed on-device storage outside the app's own ZenInboxDB / ZenInboxMailbox.sqlite databases. From those transactions the app derives a single boolean (isPro) that is held in memory only — it is never persisted to our databases or transmitted off-device. The fields exposed to the app are the product identifier (one of the constants com.jyoti.zeninboxcleaner.pro.monthly, com.jyoti.zeninboxcleaner.pro.annual, or com.jyoti.zeninboxcleaner.pro.lifetime), Apple's opaque transaction identifier (non-PII), and Apple's revocation timestamp. For subscriptions the app performs no receipt validation and operates no server of its own — Transaction.currentEntitlements already excludes expired subscriptions, so a lapsed plan simply stops appearing and the in-memory flag returns to false. "Restore Purchase" calls Apple's AppStore.sync() directly device-to-Apple-server; we do not proxy or observe this exchange. Apple Family Sharing is enabled for the lifetime product only.
  • On Android: The app uses Google's Play Billing Library for both the one-time lifetime product and the monthly and annual subscriptions. Entitlement is re-derived at app launch directly from Google's on-device billing service via queryPurchasesAsync over both ProductType.INAPP and ProductType.SUBS rather than being cached to disk; the resulting Pro state is held in memory only. Any purchase identifiers returned by Google are kept on-device and are not transmitted to any server we operate.
• Free-tier usage counter. A small per-account record storing your free-tier usage record (the lifetime count of emails cleaned (trashed, archived or labelled) and bytes recovered, plus — once the first-clean allowance is used up — the date the current monthly allowance window opened and the cleaned-count at which it opened; never any email content) is kept on-device — on iOS as a JSON blob in the iOS Keychain (com.zeninbox.freeQuota service); on Android as a plain (unencrypted) entry in the app's local DataStore (file free_quota.preferences_pb), keyed by your Google account email or, for an Outlook account, by the outlook: identifier built from Microsoft's account ID. On iOS each entry is keyed by the account's identifier in the app — your Gmail address, or, for an Outlook account, the outlook: identifier built from Microsoft's account ID. On iOS this counter is set to kSecAttrAccessibleAfterFirstUnlock, which permits iCloud Keychain to sync the counter across your own Apple devices when you have iCloud Keychain enabled — Google sign-in tokens are set to a stricter device-only setting and do not sync. Microsoft sign-in tokens for an Outlook account use a device-only setting too, which Apple describes as "Items with this attribute do not migrate to a new device." (Apple Developer Documentation, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, read 31 October 2026). The counter is wiped via Settings → Delete Account & Data; on Android it is additionally wiped when the app is uninstalled.
• "While you were away" summary (iOS, Gmail accounts). If you have Cleanup Rules that move mail to Trash, the app checks, at most once every six hours, roughly how many emails from those rules' senders are in Gmail's Trash and dated after your last visit, and shows the result as a dashboard card. For each account it keeps, in the app's local preferences on the device, the time of the last check, the start of the current window, and the pending card's two numbers (emails and senders) with its two dates — never an email, a sender or a subject. It is removed with that account when you sign out of it or delete it. It is not offered for Outlook accounts.
• Optional refill reminder (iOS). If you reach the free plan's limit, the app may ask iOS for permission to show one quiet local notification when your next 250 free emails are ready. It is scheduled and shown entirely on your device: there is no notification service, server or push token, and nothing is sent to us or to anyone else. Turn it off in Settings → Your Plan, or in iOS Settings → Notifications.

The app does not log access tokens, refresh tokens, email bodies, or personally identifying message content.

5. Data Deletion & Account Revocation

Because Adinand Email Cleaner operates on-device and does not create or store user accounts on external servers, "deleting" your account is a matter of revoking permissions and clearing local data. You have several paths to do this — all of them are under your control.

• Sign out from inside the app. On iOS, signing out removes the account you sign out of: its own local sender file, its rows in ZenInboxDB, its OAuth tokens in the Keychain, its entry in the app's list of connected accounts, and its preferences and history. Any other account you connected stays exactly as it was. On Android, signing out wipes both local stores (ZenDatabase and MailboxDatabase), clears the OAuth tokens from EncryptedSharedPreferences, clears the cached account email, and resets local preferences and history. On both platforms Sign Out keeps the free-tier usage counter, so signing out and back in does not reset your allowance.
• Revoke Gmail access from inside the app's Settings screen ("Manage Google Permissions"). The app posts to Google's OAuth revocation endpoint and then performs the same local wipe as sign-out.
• Delete Account & Data from inside the app's Settings screen. It revokes the app's Google access for that account, removes the same local data as Sign Out, and also deletes that account's free-tier usage counter.
• Outlook accounts (iOS): Sign Out and Delete Account & Data. For an Outlook account, Sign Out removes that account's Microsoft sign-in from the app's token cache on this device, its local sender file, its rows in ZenInboxDB, its entry in the list of connected accounts, any remembered approval step for its organisation, and its preferences and history. Delete Account & Data does the same and also deletes that account's free-tier usage counter. Neither one asks Microsoft to withdraw the permissions you granted — the app has no Revoke row for Outlook accounts — so to withdraw them, use Microsoft's own pages below.
• Outlook accounts (Android): Sign Out and Delete Account & Data. On Android, Sign Out of an Outlook account removes its Microsoft sign-in from the Microsoft Authentication Library's token cache on this device and then wipes local data exactly as a Gmail sign-out does (above). Delete Account & Data does the same and also deletes that account's free-tier usage counter. If a Microsoft broker app (§4) is installed, Microsoft says: "If your app is configured to use a broker, and a broker is installed on the device, the account won't be removed from the broker when you call removeAccount. Only tokens associated with your client are removed." (Microsoft Learn, Single and multiple account public client apps, read 3 November 2026). As on iOS, neither one asks Microsoft to withdraw the permissions you granted — the app has no Revoke row for Outlook accounts — so to withdraw them, use Microsoft's own pages below.
• Revoke Microsoft access — work or school accounts. You can review the permissions you personally granted the app in Microsoft's My Apps portal and select Revoke Permissions; Microsoft: "You can revoke any of the permissions you consented to by selecting Revoke Permissions", and, for permissions an administrator granted, "You can't revoke these permissions because the administrator consented to them" (Microsoft Support, Edit or revoke application permissions in the My Apps portal, read 28 October 2026). An administrator revokes organisation-wide permissions in the Microsoft Entra admin center: "Browse to Entra ID > Enterprise apps > All applications.", then the app's Permissions, the Admin consent tab, and "Select Revoke permission." (Microsoft Learn, Review permissions granted to enterprise applications, read 28 October 2026).
• Revoke Microsoft access — personal accounts (Outlook.com, Hotmail). Sign Out or Delete Account & Data (above) removes the app's Microsoft sign-in from this device. Microsoft's own help pages do not describe how to remove an app's access from a personal Microsoft account (searched 31 October 2026), so we do not give steps for that here; if you need help, write to us at support@adinandemail.com.
• Revoke access from your Google Account directly. You can visit your Google Account Security Settings at any time, find Adinand Email Cleaner in the list of connected apps and select Remove Access. After revoking this way, the app can no longer communicate with the Gmail API; the next time you open the app, it will detect the revocation and prompt you to sign in again. Until you sign out of that account in the app or uninstall, the local metadata cache remains on the device — to clear it without reopening the app, simply uninstall.
• Uninstall the app. What uninstalling removes differs by platform:
  • On Android: Uninstalling removes the entire app sandbox — all local stores (the Room caches, the EncryptedSharedPreferences holding OAuth tokens, for an Outlook account the Microsoft Authentication Library's token cache, and the DataStore free-tier counter) and all preferences. Because the app disables Android cloud backup and device transfer, none of this data is retained off the device.
  • On iOS: Uninstalling removes the SwiftData/GRDB caches and app preferences, but iOS does not automatically delete Keychain items. The OAuth tokens (for an Outlook account, the Microsoft sign-in cache) and the free-tier usage counter are stored in the iOS Keychain and therefore remain on the device after uninstall. The OAuth tokens are cleared by Sign Out (for an Outlook account, Sign Out or Delete Account & Data), Revoke Access ("Manage Google Permissions") or Delete Account & Data inside the app; the free-tier usage counter is cleared by Delete Account & Data. While they remain, these orphaned Keychain items stay encrypted and are readable only by this app's signed bundle identifier — never by other apps — and reinstalling Adinand Email Cleaner restores access to them.

Cleanup Rules (Gmail filters). If you created any Cleanup Rules, the underlying Gmail filters remain on your Google account even after you sign out, revoke access, or uninstall the app. To remove them either delete them from within the app (the Rules screen → tap a rule → Delete) before signing out or uninstalling, or remove them later from Gmail directly (Settings → Filters and Blocked Addresses).

Cleanup Rules (Outlook Inbox rules). On an Outlook account, Cleanup Rules are Inbox rules in your Outlook mailbox and stay there after you sign out, delete the account in the app, or uninstall. Delete them in the app first (the Rules screen → tap a rule → Delete), or later in Outlook.com: "At the top of the page, select Settings. Select Mail > Rules. In the rule you want to delete, select More actions (⋯) > Delete rule." (Microsoft Support, Manage email messages by using rules in Outlook, read 28 October 2026).

Email recovery (Outlook accounts). On an Outlook account the app moves emails to Deleted Items or Archive; it never deletes an email permanently and never empties Deleted Items. How long Deleted Items keeps them is set by Microsoft and your mailbox, not by the app.

Email recovery. Nothing is permanently deleted by the app. Emails the app moves to "Trash" remain there for 30 days under Google's standard Gmail retention policy, during which you can restore them from the official Gmail app or website.

Because Adinand Email Cleaner operates entirely on-device, there is no server-side data to retain or dispose of.

6. Unsubscribe Functionality

Adinand Email Cleaner offers an optional unsubscribe feature that follows the unsubscribe method specified by the sender in their email headers (List-Unsubscribe and List-Unsubscribe-Post, per RFC 2369 and RFC 8058). When you tap "Unsubscribe," the app uses the most direct method the sender supports, in this order:

1. One-click unsubscribe (RFC 8058). If the sender supports one-click unsubscribe, the app sends a single standard HTTP POST request to the sender's unsubscribe URL on your behalf. The request body contains only the List-Unsubscribe=One-Click form parameter required by RFC 8058. No personal data, no Gmail or Google credentials, no Authorization header, and no tracking identifiers are included. (Android additionally sends a standard User-Agent: Zen-Inbox-Cleaner/1.0 HTTP client identifier, which identifies the application — not you.) The request is sent directly from your device to the sender; we have no servers involved.
2. Browser redirect. If one-click unsubscribe is unavailable or fails (any non-2xx HTTP response), the app opens the sender's official unsubscribe webpage in your device's secure in-app browser — SFSafariViewController on iOS, Chrome Custom Tabs on Android. You then complete the unsubscribe yourself on the sender's website.
3. Email (mailto:) fallback. If neither of the above is available, the app opens an email composer pre-filled with an unsubscribe message addressed to the sender — presented in-app on iOS via the system MFMailComposeViewController using your default Mail account configuration, or handed off to your chosen mail client on Android via a standard mailto: intent. You review and send the email yourself.

In all three cases, the actual processing and honoring of the unsubscribe request is performed by the sender, not by Adinand Email Cleaner. We do not collect, store, or transmit any additional personal data as part of this process beyond what is already present in the email's unsubscribe headers and what the sender's own unsubscribe mechanism requires.

7. Third-Party Sharing and Ads

• No data selling or transfer. We do not sell, trade, rent, or transfer your personal information to any third party. We do not use it to train AI/ML models, target advertising, or build user profiles.
• No ads. Adinand Email Cleaner is a completely ad-free experience. No advertising SDKs are linked into the app.
• No tracking or analytics. We do not include third-party tracking, telemetry, or analytics SDKs that monitor your behavior. There is no Firebase Analytics, no Google Analytics, no Crashlytics, no Mixpanel, no AppsFlyer, no AdMob, and no equivalent in the iOS or Android build.
• This website is separate from the app. adinandemail.com counts page visits with Cloudflare Web Analytics. Cloudflare says that service “does not collect or use your visitors’ personal data” (Cloudflare Web Analytics docs, read 20 October 2026). The count covers visits to this site only; the app is not part of it.

No external servers operated by us. Your device talks directly to the Gmail API — or, for an Outlook account, to Microsoft Graph (graph.microsoft.com) and Microsoft's sign-in service (login.microsoftonline.com).

Third-party dependencies are limited to well-known libraries:

• On iOS: AppAuth-iOS (Google sign-in), the Microsoft Authentication Library for iOS and macOS (MSAL, microsoft-authentication-library-for-objc 2.16.0 — Microsoft sign-in for Outlook accounts) and GRDB.swift (local SQLite wrapper). The optional Pro purchase uses Apple's first-party StoreKit 2 framework, which is part of iOS and not a third-party dependency.
• On Android: Google API client, AndroidX Security (token encryption), Room (local database), Koin (dependency injection), OkHttp (HTTP transport), Google Play Services Auth (OAuth sign-in), the Google Play Billing Library (for the optional Pro purchase), and the Microsoft Authentication Library for Android (com.microsoft.identity.client:msal 8.5.0 — Microsoft sign-in for Outlook accounts).

Microsoft's library declares, in its own Apple privacy manifest, the data it may collect: name, email address, phone number, other contact info, customer-support data, user ID, device ID and other diagnostic data — each for app functionality and none for tracking. The app's App Store privacy label lists the same types, for app functionality and not for tracking. The app gives the library no address of ours to send anything to, and we operate no server that could receive it.

The optional Pro upgrade introduced no analytics, attribution, advertising, crash-reporting, or third-party billing-platform SDKs (such as RevenueCat) on either platform — purchases are handled solely by Apple's first-party StoreKit (iOS) and Google's Play Billing Library (Android). All dependencies are kept up to date to incorporate upstream security fixes.

8. Google API Services User Data Policy — Limited Use

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide or improve user-facing features that are prominent in the application's user interface.
• We do not transfer this data to others except as necessary to provide or improve user-facing features, or to comply with applicable law.
• We do not use this data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read this data, except where we have your explicit consent for specific messages, where it is necessary for security purposes (such as investigating abuse), where it is necessary to comply with applicable law, or where the data has been aggregated and anonymized and is used for internal operations.
• We do not use Google user data for credit-worthiness or lending decisions.

9. Data Protection Mechanisms for Sensitive Data

We treat the following as sensitive: OAuth access tokens, OAuth refresh tokens, the cached email-metadata store, the sender-intelligence index, your account email address (Google, or Microsoft for an Outlook account), and your cleaning history. The mechanisms below protect those categories at rest, in transit, and operationally.

9.1 Protection at rest

• OAuth tokens.
  • iOS: OAuth state (access token + refresh token + expiry) is stored in the iOS Keychain, one item per connected account. The list of connected accounts (each account's email address and provider) is kept in the app's local preferences on the device. Keychain items are protected by hardware-backed encryption tied to the device's Secure Enclave and are only readable by this app's signed bundle identifier. For an Outlook account, the Microsoft sign-in cache is kept by the Microsoft Authentication Library in the iOS Keychain under the app's private access group (§4).
  • Android: OAuth state and the cached account email are stored in EncryptedSharedPreferences, which encrypts keys with AES-256 SIV and values with AES-256 GCM, using a master key backed by the Android Keystore (MasterKey.KeyScheme.AES256_GCM). For an Outlook account, the Microsoft sign-in cache is kept by the Microsoft Authentication Library in its own encrypted store in the app's private storage (§4).
• Local cache stores. Both SwiftData/GRDB (iOS) and Room (Android) databases reside inside the application sandbox. On iOS the sandbox is protected by NSFileProtectionComplete-class file protection by default; on Android the app's private data directory is only accessible to the app's UID and is wiped on uninstall.
• No body content, no attachments. We never store, cache, or persist email body content or attachments.
• No tokens in logs. We do not log access tokens, refresh tokens, email body content, subjects, or addresses to disk in production builds.

9.2 Protection in transit

• All communication with Google APIs — and, for Outlook accounts, with Microsoft Graph and Microsoft's sign-in service — is conducted exclusively over HTTPS using TLS 1.2 or higher, with certificate validation enforced by the operating system. iOS App Transport Security (ATS) is left at its strict default — the app's Info.plist does not declare NSAppTransportSecurity exemptions or arbitrary-loads allowances.
• Unsubscribe POSTs (RFC 8058) and browser fallbacks use HTTPS where the sender supports it.

9.3 Operational protection

• Sensitive operations (token storage, network calls) are isolated in dedicated, reviewed modules.
• On iOS: Production builds are distributed exclusively through the Apple App Store after Apple's review process, and are signed with the developer's Apple-issued distribution certificate, which provides install-time integrity verification. Release builds are compiled with Swift's whole-module optimization. All sender-domain and email-address values that are logged via AppLogger are routed through OSLogPrivacy.private, so they render as <private> in production Console output. The Microsoft Authentication Library's own logging is set to mask all personal data, and the app's Microsoft sign-in log lines carry only the mode, the outcome, Microsoft's error codes and a duration.
• On Android: Production builds are signed with a private signing key held by the developer and distributed only through the Google Play Store, which provides additional install-time integrity verification. Release builds enable code shrinking and resource optimization via R8. Application loggers (Timber tree planting and Koin internal logging) are gated by BuildConfig.DEBUG, so no development logging executes in release builds.

We continuously review these practices to ensure user data remains protected against unauthorized access, alteration, disclosure, or destruction.

If we ever become aware of an incident that may have exposed user data, we will notify affected users without undue delay and, where required, the appropriate authorities, in line with applicable data-protection law.

If a vulnerability is discovered in the app, we will publish a patched release through the relevant app store and, where appropriate, notify affected users through the app or our support email.

10. Google Workspace add-on for Gmail

Availability. The Workspace add-on is available to install, free, from its Google Workspace Marketplace listing. This section describes what it does, so that you can check it against the add-on.

Where it runs. The add-on is Google Apps Script code that runs on Google's servers inside your own Gmail account. We operate no server of our own, and the add-on makes no outbound network calls of any kind — none to us, to any analytics service, or to any third party.

What it reads. When you open an email, the add-on reads two headers of that message: From and List-Unsubscribe. It requests message metadata only and never reads message bodies or attachments. To count and to move email it reads the message IDs that Gmail's own search returns, and nothing else about those messages. To show its Cleanup Rules it reads your list of Gmail filters.

What it stores. Nothing about you is stored on any system we operate, because we operate none. The add-on holds two short-lived items in your own Google account's script cache for six hours: the message IDs of the batch you just moved to Trash, so that Undo can restore them, and the sender counts it just measured, so that reopening the same email does not re-count it. Both expire on their own. There is nothing to export and nothing to delete when you uninstall, because nothing persists beyond that window.

What it changes. The add-on makes exactly two kinds of change to your mailbox, and only after you confirm. It moves the messages you chose to Gmail's Trash, where Gmail keeps them for 30 days before deleting them permanently. And, if you ask for it, it creates a Gmail filter that moves future email from that sender to Trash — a filter you can see and delete yourself in Gmail's Settings, and which the add-on can also remove for you. It never deletes email permanently, never sends email, never archives, never applies labels, and never reads or changes anything else.

Your account address. The add-on reads the email address of the signed-in account so it can show you which account you are working in. No other profile information is requested.

Unsubscribing. Where a sender publishes an unsubscribe link, the add-on shows a button that opens that link in your own browser. The add-on does not fetch the link, does not send an opt-out request on your behalf, and sends no email. This is narrower than the iOS and Android apps, which do send one-click opt-out requests as described in §6.

Demo mode. The add-on includes a demo that runs on twelve fictional sample senders. In demo mode it makes no Gmail calls at all and changes nothing in your mailbox.

11. Chrome extension

Availability. The Chrome extension runs in Google Chrome on a computer. This section describes what it does, so that you can check it against the extension.

Where it runs. The extension runs inside Chrome on your computer. We operate no server of our own. The extension connects only to Google's Gmail API and Google's sign-in service, and to a sender's own unsubscribe address when you choose to unsubscribe (see "Unsubscribing" below). It contains no analytics, tracking, advertising or crash-reporting code, and it sends nothing to us.

Signing in. You sign in through Chrome's own Google sign-in, and the extension requests the three scopes listed in §3. Chrome keeps the sign-in token; the extension holds it in memory while it works and never writes it to storage.

What it reads. For each email in your inbox, the extension reads its message ID, its From and Subject headers, its date and size, and whether it has a List-Unsubscribe header (the header's value is not kept). It requests message metadata only and never reads message bodies or attachments. When you clean a sender, it lists the message IDs of every email from that sender's domain, including archived ones, and nothing else about them. When you choose to unsubscribe from a sender, it reads that sender's List-Unsubscribe and List-Unsubscribe-Post headers from one message, uses them once and does not store them. To show its Cleanup Rules it reads your list of Gmail filters. To keep each account's free allowance separate, it reads your Gmail address from Gmail.

What it stores. The list of senders it builds is held in memory and is gone when you close the extension's page. The only thing the extension writes to your computer is your free-allowance counter, in Chrome's local extension storage, filed under your Gmail address: the number of emails cleaned and, once your first 2,500 are used, the date your current monthly allowance began and the count at that date (the record also has a bytes field, which the extension leaves at zero). It never contains any email content, sender or subject, and it is never written to Chrome sync. Signing out does not erase it. Removing the extension does: Chrome's documentation says local extension data is "cleared when the extension is removed" (Chrome storage API reference, read 23 October 2026).

What it changes. The extension changes your mailbox only after you confirm. It moves the emails you chose to Gmail's Trash, where Gmail permanently deletes them after 30 days (Gmail Help, "Delete messages in Gmail", read 23 October 2026), or archives them, which removes them from your inbox and leaves them in All Mail. If you ask for it, it creates a Gmail filter that moves a sender's future email to Trash or archives it — up to three of these Cleanup Rules — which you can see and delete yourself in Gmail's Settings, and which the extension can also remove for you. It never deletes email permanently, never sends email, and never applies labels.

Unsubscribing. When you choose to unsubscribe from a sender, the extension uses the method the sender publishes, in this order. If the sender supports one-click unsubscribe (RFC 8058), it sends one request to the sender's unsubscribe address containing only List-Unsubscribe=One-Click, with no Google credentials, no cookies and no referrer. Otherwise it opens the sender's unsubscribe page in a new Chrome tab, where you finish yourself. If the sender offers only an email address, it opens your own email program with the unsubscribe message for you to send.

Signing out. Signing out clears the token Chrome holds for the extension and asks Google to revoke the extension's access. You can also remove its access at any time from your Google Account's security settings. Cleanup Rules you created stay in Gmail until you delete them, in the extension or in Gmail's Settings.

Links to this website. The extension's "Privacy policy" and "Get the app" links open pages of this website in a new tab when you click them. The extension does not fetch these pages itself. Visits to this website are counted as described in §7.

Demo mode. The extension includes a demo that runs on twelve fictional sample senders. In demo mode it makes no Gmail calls, stores nothing and changes nothing in your mailbox.

Limited Use. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. §8 applies to the extension as it does to the apps.

12. Microsoft Outlook Accounts (Microsoft Graph)

This section applies only if you connect a Microsoft account — Outlook.com, Hotmail, or a work or school account — in the iOS or Android app, both of which offer Sign in with Microsoft on their sign-in screen. It does not change anything above about Google accounts, and section 8 continues to govern information received from Google APIs. The Workspace add-on and the Chrome extension do not connect Outlook accounts. Where the two apps differ, this section says so.

How the app reaches your Outlook mailbox. The app talks to your mailbox directly from your device through Microsoft Graph (graph.microsoft.com) and signs in through Microsoft's sign-in service (login.microsoftonline.com). It follows Microsoft's paging links only when they use HTTPS and point back to Microsoft Graph. The permissions it asks for are listed in §3.

What the app reads. For each message the app reads its identifier, conversation identifier, sender name and address, subject, received date and time, and size. It also reads your Inbox's total message count, the identifiers of your Archive and Deleted Items folders, your Inbox rules and your Outlook category names. For the sender-trust and unsubscribe features it asks Microsoft Graph for the message's internet headers; these arrive as a single list, so the app receives every header of the message, and it uses only Date, List-Unsubscribe, List-ID, Precedence and List-Unsubscribe-Post (on Android, only the last four, read for the dashboard estimate below and for unsubscribing). To build the dashboard estimate, the app also reads Outlook's Focused/Other classification for a sample of up to 100 of your newest Inbox emails; only the resulting counts are kept. Before a clean-up, it reads which folder each selected email is in, so that Undo can move it back; that is held in memory for the 30-second Undo window and not written to disk. When you label emails, it reads their existing categories so it can add yours without removing any. The app does not request message bodies, body previews, recipient lists or attachments.

What the app changes, and only after you confirm. It moves the emails you select to your Deleted Items folder — which Microsoft describes as "The folder items are moved to when they're deleted." — or to your Archive folder, and never deletes an email permanently (Microsoft Graph mailFolder resource type, read 28 October 2026). If you tap Undo within 30 seconds, it moves them back to the folder each one came from, or to your Inbox where it could not tell. If you choose a label, it adds that Outlook category to the emails, creating the category first if it is new.

Cleanup Rules (Outlook Inbox rules). If you create a Cleanup Rule for a sender, the app creates an Inbox rule in your mailbox named "Auto-trash:", "Auto-archive:" or "Auto-label" followed by the sender's address, whose action moves that sender's future emails to Deleted Items or Archive, or assigns a category — Microsoft describes the rule actions as "Indicates whether a message should be moved to the Deleted Items folder.", "The ID of the folder that a message will be moved to." and "A list of categories to be assigned to a message." (Microsoft Graph messageRuleActions resource type, read 28 October 2026). The rule is kept in your mailbox, not in the app; §5 explains how to remove it.

Unsubscribing. Unsubscribe works on an Outlook account exactly as §6 describes, using the sender's headers read from Microsoft Graph.

Approval for work or school accounts. If your organisation requires an administrator to approve the app, the app shows a "Waiting for your IT admin" screen. From there you can open a pre-written email to your IT admin in your own mail app, or copy the approval link; the app never sends the email itself. The link opens Microsoft's own administrator-approval page for your organisation (on login.microsoftonline.com) and carries the app's client ID, the permissions listed in §3 and your organisation's Microsoft tenant identifier. If your organisation requires Microsoft Authenticator, the app shows a screen that links to it on the App Store (iOS) or Google Play (Android). After your administrator approves or declines, Microsoft sends their browser to https://adinandemail.com/outlook/admin-consent with the result in the page address — admin_consent, tenant, scope and state when approval is given, or error and error_description when it is not (Microsoft identity platform admin consent protocols, read 28 October 2026). That page's own code reads only admin_consent, error and error_description, shows whether approval was given, stores and sends nothing, and then removes the values from the address bar. The website's visit counter does not record them: Cloudflare says Web Analytics does "not log query strings" (Cloudflare Web Analytics FAQ, read 31 October 2026).

What we do not receive. The Outlook code sends mail data only to Microsoft Graph and sign-in requests only to Microsoft's sign-in service; it contains no connection to any server we operate. What the app stores on your device for an Outlook account is in §4; how to remove it is in §5.

Logging. When the iOS app talks to Microsoft Graph, its logs record only the HTTP status, the request method, the attempt number and request counts — never your access token, a request address, an email address or a subject. On Android, release builds suppress the app's own logs altogether (§9.3).

Demo mode. The iOS app's demo includes a sample Gmail mailbox and a sample Outlook mailbox, chosen with a switch on the demo banner; the Android app's demo has a sample Gmail mailbox only. All of it is sample data built into the apps; neither demo signs in to Google or Microsoft.

13. Children's Privacy

Adinand Email Cleaner is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information through use of the app, please contact us and we will take appropriate steps to address the matter.

14. Governing Law

This Privacy Policy is governed by the laws of India. Any dispute about it is resolved as set out in section 15 (Governing Law and Dispute Resolution) of our Terms of Service.

15. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact us at: support@adinandemail.com