Privacy Policy

What data we access

When you connect your Gmail account, Email Slayer requests access to:

Data type	What we access	Why
Message headers	From, Subject, Date, To, List-Unsubscribe, List-Unsubscribe-Post	To analyze who sends you the most email and detect unsubscribe links
Message metadata	Size and labels per message	To show storage usage and group messages
Message counts	Total messages and threads	To show inbox statistics
Labels	Label names and counts	To understand inbox organization
Existing Gmail filters	List of your filters	To detect which senders are already blocked
Your email address	Gmail address	To identify your account
Your name	Display name	To personalize the app

What we do NOT access

• Email body content (the actual message text)
• Attachments
• Draft emails
• Sent email content
• Contact list
• Calendar
• Your Gmail password

Email deletion feature

When you use the "Delete emails from sender" feature:

• Emails are moved to your Gmail Trash (not permanently deleted)
• Gmail keeps trashed emails for 30 days before automatic permanent deletion
• You can restore trashed emails from Gmail if needed
• We keep a local audit log of what was deleted for your reference

Where data is stored

All data is stored locally on your device only.

Platform	Data location
macOS	~/Library/Application Support/Email Slayer/
Windows	%APPDATA%\Email Slayer\
Linux	~/.config/Email Slayer/

What's stored locally

File	Contents
emailslayer.db	SQLite database with scan results (message metadata, sender aggregates)
settings.json	Your app preferences
Keychain / Credential Store	OAuth tokens (encrypted by your OS)

Data transmission

Nothing. Email Slayer does not transmit any of your email data to any external server.

The app only connects to:

Service	Purpose
accounts.google.com	OAuth authentication
gmail.googleapis.com	Fetch email metadata (directly from Google)
downloads.emailslayer.com	Check for app updates (fetches version.json only — no user data sent)

All connections use HTTPS encryption.

Permissions rationale

Email Slayer requests the minimum Google OAuth scopes needed:

gmail.modify

What it allows: Read email metadata (headers, labels) and move emails to trash.

Why we need this: To enable the "Delete emails from sender" feature, which moves unwanted emails to your Gmail Trash.

What we actually use:

• messages.list — Get message IDs
• messages.get with format: 'metadata' — Read a limited set of headers only: From, Subject, Date, To, List-Unsubscribe, and List-Unsubscribe-Post. The email body is never downloaded.
• messages.trash — Move emails to trash (when you request deletion)
• labels.list — List your labels

gmail.settings.basic

What it allows: Read and create Gmail filters.

Why we need this: To detect existing filters (blocked senders) and create new ones when you block a sender.

userinfo.email and userinfo.profile

What it allows: Access to your email address and display name.

Why we need it: To show which account is connected and personalize the dashboard.

Data security

OAuth token storage

Your Google OAuth tokens are stored securely using your operating system's credential storage:

Platform	Storage method
macOS	Keychain (encrypted)
Windows	Data Protection API (DPAPI)
Linux	Secret Service / libsecret (if available)

If secure storage isn't available, tokens are encrypted with AES-256 before saving to disk.

Local database

The SQLite database is stored in your user data folder with standard file system permissions. It contains only metadata — never email content.

How to delete your data

Option 1: Log out

1. Open Email Slayer
2. Click Log out at the bottom of the sidebar
3. This removes your OAuth tokens. Your scan history stays on disk.

Option 2: Delete individual scan sessions

1. Go to History
2. Delete any individual scan session you no longer want

Option 3: Full reset

1. Go to Settings → Data management
2. Click Reset everything
3. This deletes all scan data, signs you out, restores default settings, and restarts the app.

Option 4: Complete removal

1. Uninstall Email Slayer
2. Delete the data folder (see locations above)

Option 5: Revoke Google access

1. Go to Google Account Security
2. Find "Email Slayer" in the list
3. Click Remove Access

This immediately invalidates all tokens and prevents further access.

Third-party services

Service	Purpose	Data shared
Google Gmail API	Fetch email metadata	OAuth token (for authentication)
Email Slayer update server	App updates	None (fetches a public version.json file only)

We do not use analytics, advertising, or tracking services.

Children's privacy

Email Slayer is not intended for users under 13 years of age. We do not knowingly collect data from children.

Changes to this policy

We may update this policy occasionally. Changes will be noted with an updated "Last Updated" date. Significant changes will be announced in app update notes.

Contact

For privacy questions or concerns:

• Email: support@emailslayer.com