How in-boxed works
A plain-English explanation of what happens when you use in-boxed, technically accurate, no jargon.
You connect Gmail or Outlook with read-only access
When you click "Scan my inbox", Google's or Microsoft's own consent screen opens directly in your browser, depending on which you connect. You grant in-boxed read-only access using the official gmail.readonly OAuth scope (Gmail) or the delegated Mail.Read scope (Outlook, Hotmail, Live), the same kind of permission each provider uses for its own unsubscribe button. We never see your password, and the access token stays in your browser, it is never sent to our servers.
Google Identity Services token flow (OAuth 2.0, gmail.readonly) for Gmail; manual OAuth 2.0 authorization-code + PKCE flow (delegated Mail.Read) for Outlook. In both cases the short-lived access token lives only in the browser, no refresh token, nothing stored server-side.
We read email headers, never content
Your browser calls the Gmail API or Microsoft Graph API directly and requests email metadata only: the From header (who sent it), the List-Unsubscribe header (how to opt out), and List-Id and Reply-To (to recognise mailing lists and reach their support). The body, subject line and attachments are technically excluded from the response. The data goes straight from Google or Microsoft to your browser, it never touches our servers.
Gmail: messages.get with format=metadata and metadataHeaders=['List-Unsubscribe','List-Id','Reply-To','From'], called client-side to gmail.googleapis.com. Outlook: $select=from,replyTo,internetMessageHeaders, called client-side to graph.microsoft.com. No message content, no inbox data through our servers, for either provider.
We build a deduplicated list of senders
We search your whole mailbox, up to 1,000 emails including archived mail, and list every unique sender that is a mailing list. If you received 20 emails from the same newsletter, it appears once. You see the full list before paying anything.
Map deduplication by full sender address. A sender counts as a newsletter if it exposes a List-Unsubscribe or a List-Id header. Sorted by method: one-click HTTP first, email second.
You pay once, we send opt-out requests to all
After payment, your browser sends opt-out requests to every sender. For senders using RFC 8058 one-click unsubscribe, a single HTTP request does it. For senders with no automatic option, we open a ready-made opt-out email to their support address (a legal GDPR objection). Payment runs separately via Stripe and involves no Gmail or Outlook data.
HTTP POST with body "List-Unsubscribe=One-Click" per RFC 8058, sent client-side. Legal basis: GDPR Article 21, CAN-SPAM Section 5. Senders without List-Unsubscribe fall back to a GDPR opt-out email to Reply-To or From.
Your session ends, everything is gone
When you close the tab, the short-lived Gmail or Microsoft token, which only ever lived in your browser, is discarded with it, and so is the scan list. Our servers never received your inbox data. We have no database, so there is no record of your email address, your senders, or anything else. You can revoke access anytime in your Google Account permissions or your Microsoft account's app permissions.
The access token is held only in the browser tab and expires quickly (Gmail: about one hour). Our servers never receive or store Gmail or Outlook data, no database, no logs.
From chaos to clean
Drag the slider. This is an inbox before and after in-boxed.
Frequently asked questions about how it works
Can in-boxed see my email subjects or message content?
No. We request only header metadata from the Gmail API or Microsoft Graph API, which explicitly excludes message content, subject lines and attachments. The response contains only the headers we specify.
Does in-boxed store my email address?
No. We don't know your email address unless you voluntarily provide it through the feedback form. Your Gmail or Outlook account is accessed via a short-lived token that stays in your browser and is never sent to our servers.
How is this different from clicking Unsubscribe in Gmail or Outlook?
Functionally identical, both use the List-Unsubscribe header. The difference is that Gmail or Outlook does it one email at a time. in-boxed does it for your entire inbox at once.
What if a sender has no List-Unsubscribe header?
If the sender is still a mailing list (it carries a List-Id header), we generate a ready-made GDPR opt-out email to their support or sender address, so even senders that deliberately omit the header are handled.
Is the opt-out legally binding?
Yes. Under GDPR Article 21 and CAN-SPAM, opt-out requests carry full legal force. GDPR requires senders to act without undue delay (within one month at the latest); CAN-SPAM requires action within 10 business days.
See it for yourself
The scan is free. No payment until you decide to unsubscribe.
Scan my inbox for free →