How in-boxed works
What actually happens when you use in-boxed, step by step, in plain English. The technical detail is there too, one click away.
Try the whole thing
Only marketing mail. Receipts, invoices and password resets keep arriving.
Sample data with well-known senders as an example, no affiliation with these brands. No inbox is connected, nothing is sent and nothing is charged.
Scanning your inbox…
senders found so far
Going through your messages, reading only the sender lines.
You connect Gmail or Outlook, metadata only
When you click "Scan my inbox", Google's or Microsoft's own consent screen opens directly in your browser, depending on which you connect. You grant in-boxed access using the gmail.metadata OAuth scope (Gmail) or the delegated Mail.ReadBasic scope (Outlook, Hotmail, Live), the same kind of permission each provider uses for its own unsubscribe button. We never see your password, and the access token stays in your browser, it is never sent to our servers.
The technical version
Google Identity Services token flow (OAuth 2.0, gmail.metadata) for Gmail; manual OAuth 2.0 authorization-code + PKCE flow (delegated Mail.ReadBasic) for Outlook. In both cases the short-lived access token lives only in the browser, no refresh token, nothing stored server-side.
We read email headers, never content
Your browser calls the Gmail API or Microsoft Graph API directly and requests email metadata only: the From header (who sent it), the List-Unsubscribe header (how to opt out), and List-Id and Reply-To (to recognise mailing lists and reach their support). The body, subject line and attachments are technically excluded from the response. The data goes straight from Google or Microsoft to your browser, it never touches our servers.
The technical version
Gmail: messages.get with format=metadata and metadataHeaders=['List-Unsubscribe','List-Unsubscribe-Post','List-Id','Reply-To','From'], called client-side to gmail.googleapis.com. Outlook: $select=from,replyTo,internetMessageHeaders, called client-side to graph.microsoft.com. No message content, no inbox data through our servers, for either provider.
We build a deduplicated list of senders
We check a privacy-preserving sample of your recent and relevant emails, including archived matches, and list the unique senders that identify as mailing lists. If you received 20 emails from the same newsletter, it appears once. You see the full list before paying anything. Only senders that mail you as a mailing list end up on it: promotions, newsletters, campaigns. Receipts, invoices, account and security emails and personal mail normally aren’t mailing lists, so they aren’t on it and keep arriving.
The technical version
Map deduplication by full sender address. A sender counts as a newsletter if it exposes a List-Unsubscribe or a List-Id header. Sorted by volume, most emails first: that is the order in which you actually make the decision, not our unsubscribe method.
You decide per sender, then we get to work
You see the full list for free, sorted by how much each sender mails you. Every sender is set to leave; tap Keep on the ones you still want to hear from, because that is your call and never our assumption. After a one-time payment through Stripe, which never touches any Gmail or Outlook data, we go through the senders with you, one at a time, and explain each step. Per sender we offer the route that leaves you something to hold on to: a written opt-out email, which we write and you send yourself, or their own preferences page, which we open for you. When you open either one, your browser also sends the standard one-click unsubscribe request if the sender offers it, as extra support. If a sender offers only that standard request, we tell you so and you decide whether to send it. Some senders publish no way out at all, and we tell you that instead of pretending.
The technical version
HTTP POST with body "List-Unsubscribe=One-Click" per RFC 8058, sent client-side. Legal basis: GDPR Article 21, CAN-SPAM Section 5. An https URL without a matching List-Unsubscribe-Post header is not a machine endpoint but a page meant for people, so it is handed to you as a link instead of being POSTed. Senders without List-Unsubscribe fall back to a GDPR opt-out email to Reply-To or From.
Your session ends, everything is gone
When you close the tab, the short-lived Gmail or Microsoft token, which only ever lived in your browser, is discarded with it, and so is the scan list. Our servers never received your inbox data. We have no database, so there is no record of your email address, your senders, or anything else. You can revoke access anytime in your Google Account permissions or your Microsoft account's app permissions.
The technical version
The access token is held only in the browser tab and expires quickly (Gmail: about one hour). Our servers never receive or store Gmail or Outlook data, no database, no logs.
AFTER THE CLEANUP
Clean another inbox, or keep this one calm.
When a cleanup is finished, you can connect another Gmail or Outlook inbox. Or open the Inbox Reset Playbook for a focused five-minute setup covering structure, filters, important mail, suspicious messages and a simple maintenance routine. These follow-up instructions do not need broader mailbox permissions.
From chaos to quiet
Drag the slider. This is the marketing mail arriving before and after in-boxed. We stop the stream; we never delete anything.
Frequently asked questions about how it works
Can in-boxed see my email subjects or message content?
No. We request only header metadata from the Gmail API or Microsoft Graph API, and our scan requests only the sender and unsubscribe-related fields it needs. The scan code does not request message bodies, subject lines or attachments.
Does in-boxed store my email address?
No. We don't know your email address unless you voluntarily provide it through the feedback form. Your Gmail or Outlook account is accessed via a short-lived token that stays in your browser and is never sent to our servers.
How is this different from clicking Unsubscribe in Gmail or Outlook?
Gmail and Outlook use the List-Unsubscribe header too, one email at a time, and you get no confirmation. in-boxed shows every sender in your inbox at once, and then helps you with the routes that leave a record: an opt-out email in your name or the sender’s own page. The standard request goes along as extra support.
What if a sender has no List-Unsubscribe header?
If the sender is still a mailing list (it carries a List-Id header), we generate a ready-made GDPR opt-out email to their support or sender address, so senders without that automatic route may still have a manual opt-out path.
Is the opt-out legally binding?
The List-Unsubscribe header itself is a technical standard, not a law. What obligates the sender is GDPR: Article 21 requires action without undue delay (within one month at the latest), and CAN-SPAM requires action within 10 business days. If marketing continues after a valid opt-out and the applicable legal period, the sender may be in breach; enforcement and exceptions depend on the circumstances.
See it for yourself
The scan is free. No payment until you decide to unsubscribe.
Scan my inbox for free →