Privacy Policy — Bulk Delete Emails for Gmail™

Last updated: 20 September 2026 Extension: Bulk Delete Emails for Gmail™ — Mass Unsubscribe & Cleanup Contact: tphuc.me@gmail.com

The short version

Bulk Delete Emails for Gmail™ runs entirely inside your browser.

The content of your emails is never transmitted anywhere. It is never even requested from Google.
The extension reads message metadata only — sender, subject line, date, size and unsubscribe headers — processes it on your own machine, and caches it in your browser's local extension storage.
There is no Bulk Delete Emails for Gmail™ server. We do not operate a backend that receives your data, because there is nothing to receive.
The only outbound network requests are to Google's Gmail API (your own mailbox, with your own token), to Google's token revoke endpoint when you disconnect, and to a sender's own unsubscribe URL — and only when you explicitly ask to unsubscribe from that sender.

What the extension accesses

1. Gmail message metadata

Every message fetch this extension makes uses Gmail's format=metadata mode with an explicit allowlist of headers:

Header	Why it is needed
`From`	Group your mail by sender — the core of the product
`Subject`	Shown as a one-line example so you can recognise a sender
`Date`	Power the "oldest / newest" columns and "older than N months"
`List-Unsubscribe`	Find the unsubscribe endpoint for a mailing list
`List-Unsubscribe-Post`	Detect RFC 8058 one-click support

Gmail also returns sizeEstimate and internalDate with every message; those drive the "space used" figures.

format=metadata means Google does not send us the message body. No email text, no attachments, no inline images. Not "we choose not to look" — the API response does not contain it.

2. Your email address

Read once, from users.getProfile, to display which account is connected in the dashboard header. It is not stored anywhere outside your browser and is not sent to us or anyone else.

3. Labels

The extension adds and removes the TRASH and INBOX labels on messages you select. That is what "move to Trash" and "undo" mean technically.

What is stored, and where

All of it lives in chrome.storage.local — a private, per-extension area on your own computer. Nothing is written to chrome.storage.sync, so none of this travels through your Google account to your other devices.

Stored	Contents	Why
Scan cache	Per-sender name, address, message count, total size, newest/oldest dates, unsubscribe URLs, message ids	So reopening the dashboard is instant instead of re-scanning
Run history	The last 10 cleanups: message ids, action, timestamp, counts	This is the Undo feature. Without the ids, nothing could be restored
Unsubscribe ledger	Sender address → status and timestamp	So you are not asked to unsubscribe from the same list twice
Settings	Your query, scan depth and dry-run preference	Convenience

You can erase all of it at any time by removing the extension, or from chrome://extensions → Bulk Delete Emails for Gmail™ → Details → Site settings. Uninstalling deletes it permanently and immediately.

Network requests, in full

This is the complete list. There are no others.

https://www.googleapis.com/gmail/v1/... and .../batch/gmail/v1 Your own mailbox, authorised by a token Chrome issues to you. Requests go directly from your browser to Google.
https://oauth2.googleapis.com/revoke Only when you click "Reconnect Google account", to revoke the old token.
A sender's unsubscribe URL, and only when you explicitly ask to unsubscribe from that sender. This is an RFC 8058 one-click POST containing the fixed body List-Unsubscribe=One-Click. It is sent with credentials: 'omit', so your cookies for that domain are not included. Permission for that domain is requested at that moment and released afterwards.

What we do NOT do

We do not have a server of any kind. There is no account to create, no licence to check and nothing to log in to.
We do not read, transmit, sell, rent or share message bodies. We never receive them.
We do not use analytics, telemetry, crash reporting or advertising SDKs.
We do not track your browsing. The extension has no content scripts and cannot see any web page you visit.
We do not send email on your behalf. The extension does not hold the gmail.send scope, which is why mailto-only unsubscribes are handed to you rather than automated.
We do not transfer data to third parties for any purpose unrelated to the single purpose stated above.
We do not use your data to train any AI or machine-learning model.

Google API Services User Data Policy

Bulk Delete Emails for Gmail™'s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

Google user data is used only to provide the user-facing features described in this policy — grouping mail by sender, deleting it, and unsubscribing.
Google user data is not transferred to any third party, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice.
Google user data is not used for serving advertisements.
No humans read your Google user data. Message metadata never leaves your device, so there is nothing for anyone to read.
Google user data is not used to develop, improve or train generalised AI/ML models.

Revoking access

At any time: https://myaccount.google.com/permissions → Bulk Delete Emails for Gmail™ → Remove access. The extension also has a "Reconnect Google account" button that revokes its current token.

Retention

Because nothing is transmitted to us, we retain nothing. Data in your browser persists until you clear it or uninstall the extension. The scan cache keeps at most 8 recent scans and the history keeps the last 10 runs; older entries are evicted automatically.

Children

Bulk Delete Emails for Gmail™ is not directed at children under 13 and does not knowingly collect data from them.

Changes to this policy

Material changes will be reflected here with an updated date and noted in the Chrome Web Store listing's changelog.