Privacy Policy
Last Updated: February 25, 2026
Your Privacy is Our Priority
100% Browser-Based: All email scanning happens entirely in YOUR browser
Never Leaves Your Device: Your emails NEVER leave your computer
Zero Server Storage: We NEVER see, store, or process your email content
No AI blackbox: Our approach is purely algorithmic, leaving no room for surprises
1. Introduction
Email Unsubscriber, operated by Micro Solutions LLC ("The company", "we", "us", or "our") provides a browser-based tool that helps you identify and unsubscribe from unwanted email subscriptions. This Privacy Policy explains how we handle your information when you use our service.
We built this service with privacy as the foundation. Unlike other email management tools, we designed our architecture so that your email data never touches our servers.
2. Information We Do NOT Collect
We want to be absolutely clear about what we never access:
- Email content - We never see the body, subject lines, or text of your emails
- Email metadata - Senders, recipients, timestamps, or any header information
- Subscription lists - Your scan results and subscription data stay on your device
- Inbox data - Any information from your email inbox
- Email provider access tokens - The credentials that allow reading your emails stay in your browser and are never sent to our servers
3. Information We Do Collect
We collect minimal information necessary to provide our service:
- Account Email Address: Used solely for account identification and authentication
- Subscription Status: For paid users, we track payment status to provide full access to all features
- Basic Usage Analytics: Anonymous page views and feature usage (not tied to email data)
- Unsubscribe History: When you unsubscribe from a sender through our service, we store a record of the sender's email address and name as part of your unsubscribe audit log. This data enables our Unsubscribe Violation Detection feature, which monitors whether senders comply with your unsubscribe requests by flagging any non-individual emails received from them after your request.
- Referral Data: If you participate in our referral program, we store your unique referral code and track your referral progress (number of successful referrals). Referral relationships are tracked using anonymized identifiers, not raw email addresses.
4. Legal Basis for Processing
We process your personal data under the following legal bases as defined by GDPR Article 6:
- Contract Performance (Art. 6(1)(b)): Processing your email address and account data to provide the email unsubscription service, process payments, and maintain your account.
- Consent (Art. 6(1)(a)): Analytics cookies, session recording, and behavioral tracking — only activated when you explicitly consent via our cookie banner.
- Legitimate Interest (Art. 6(1)(f)): Essential error tracking and performance monitoring to maintain service reliability; security measures including blacklist maintenance for fraud and abuse prevention.
- Legal Obligation (Art. 6(1)(c)): Retention of anonymized payment records for 7 years as required by applicable tax and financial regulations.
5. How Our Service Works
Understanding our architecture helps explain why your data stays private:
Direct Browser-to-Provider Communication
All email API requests go directly from your browser to your email provider's servers (e.g., Google or Microsoft). Our servers are never involved in this data flow.
OAuth Authentication Only
Our servers never receive your email access credentials. Authentication happens directly between your browser and your email provider - our backend only receives an identity token (JWT) that proves who you are, but cannot be used to access your emails.
Local Processing
The dashboard code runs entirely in your browser. Email scanning, analysis, and unsubscribe detection all happen on your device.
Token Separation Architecture
When you sign in with your email provider, two different tokens are created: an access token (which can read your emails) and an identity token (which only proves who you are). The OAuth standard requires a backend intermediary to securely exchange your authorization code for these tokens. To maximize transparency, we have split this intermediary into a standalone, open-source, fully auditable service that is hosted separately on a public cloud (Cloudflare Workers). This token-exchange service is fully isolated from the rest of our backend, meaning our backend has no chance of ever seeing your access token. After the exchange, your browser keeps the access token and uses it to communicate directly with your email provider. Our backend only ever receives the identity token, which cannot be used to access your emails. This architectural choice means our servers are physically incapable of reading your emails, even if compromised.
7. Local Data Storage
Your scan results and authentication data are stored locally in your browser:
- IndexedDB: Scan results and subscription data are stored in your browser's IndexedDB
- localStorage: OAuth tokens are stored in browser localStorage for session persistence
- Data Clearing: All local data is automatically cleared when you clear your browser data
This data never leaves your device and is only accessible to you.
8. Third-Party Services
We integrate with the following third-party services:
- Google (OAuth & Gmail API): We use Google's OAuth 2.0 for authentication. Your browser communicates directly with Google's Gmail API to read email data. Google's privacy policy applies to data they process.
- Microsoft (OAuth & Outlook API): We use Microsoft's OAuth 2.0 for authentication. Your browser communicates directly with Microsoft's Graph API to read email data. Microsoft's privacy statement applies to data they process.
- Stripe (Payment Processing): If you purchase access to our service, Stripe handles payment processing. We never see or store your full credit card information. Please note that after account deletion, your email address and payment details may still be retained by Stripe in accordance with their own data retention policies. We anonymize all payment records stored on our servers, but cannot force deletion of data held by Stripe.
- Cloudflare (Hosting & CDN): Our service is hosted on Cloudflare. Cloudflare may collect standard server logs (IP addresses, request times) as part of their service.
- PostHog (Product Analytics): We use PostHog for basic product analytics. To protect your privacy, we only ever send a cryptographically hashed (obfuscated) version of your email address to PostHog — your real email address is never transmitted and cannot be recovered, even by PostHog themselves. The hashed identifier is used solely to distinguish between users, not to identify them. No email content, metadata, or inbox data is ever sent to PostHog. PostHog's privacy policy applies to data they process.
9. Data Retention & Account Deletion
You can delete your account at any time using the "Erase Data" feature in your profile. When you erase your account, we process your data as follows:
9.1 Anonymization Process
Account deletion is performed through anonymization rather than hard deletion. All personally identifiable information (PII) associated with your account (which is your email address only as we never collect any other PII) is permanently replaced with an irreversible, one-way cryptographic hash. After this process, your account record can no longer be linked back to you.
9.2 Data That Is Permanently Deleted
- Unsubscribe history: All records of your unsubscribe actions, which may contain third-party sender information, are permanently and fully deleted — not anonymized.
- Whitelist/early access entries: Any early access or whitelist entries associated with your account are removed.
9.3 Data That Is Retained
Certain data is retained after account deletion for legal and security purposes. In all cases, personally identifiable information is replaced with the anonymized hash described above.
- Payment records (up to 7 years): Anonymized payment records — including payment amounts, dates, currency, and Stripe transaction identifiers — are retained to comply with tax and financial reporting obligations. This retention is permitted under GDPR Article 17(3)(b), which allows data controllers to retain data necessary for compliance with a legal obligation.
- Anonymized user identifier: A one-way cryptographic hash derived from your email address is retained to detect returning users and prevent abuse of promotional offers (such as referral incentives). This hash cannot be reversed to recover your email address. This retention is justified under legitimate interest as recognized by GDPR Recital 47 — specifically, the prevention of fraud and misuse of services.
- Blacklist entries: If your account was placed on a security blacklist prior to deletion, that entry is retained for ongoing security and abuse prevention purposes.
9.4 Local Browser Data
The "Erase Data" feature removes your account from our servers. Data stored locally in your browser (localStorage, IndexedDB) is not affected by this process. You can clear local data at any time through your browser settings.
10. Your Rights
You have full control over your data and access:
- Revoke Access: You can revoke our access at any time through your Google Account settings or Microsoft Account settings, depending on which provider you signed in with.
- Clear Local Data: Clear your browser's localStorage and IndexedDB to remove all locally stored data.
- Account Deletion: Use the "Erase Data" feature in your profile to anonymize and remove your account data from our servers. See Section 9 for details on what is deleted, what is anonymized, and what is retained.
- Data Export: Since all scan data is stored locally in your browser, you already have direct access to your data.
11. Contact Us
Data Protection Contact
For data protection inquiries, you may contact our Data Protection Officer:
Dyanko Yovchev
Email: gdpr@email-unsubscriber.com
General Inquiries
For general inquiries about this Privacy Policy or our data practices, contact us at:
Email: contact@email-unsubscriber.com
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.