Is Unroll.me safe? Reddit remembers, and it is right to
Ask this anywhere and someone will bring up the data selling. They are not being dramatic. Unroll.me's business model was famously reported to involve selling inbox data to advertisers — not a breach, a design. Whether that is acceptable is your call, but make it knowing.
What happened, without the pile-on
We sell a competing product, so take the framing with appropriate salt and note what we are deliberately not doing: embellishing. The documented, widely-reported fact is that Unroll.me’s business model was famously reported to involve selling inbox data to advertisers. We are not going to dress that up with details we have not verified, invented specifics, or a moral lecture. The plain version is damning enough and it does not need help.
The important word is business model. This was not a hack. Nobody broke in. The arrangement was disclosed in terms of service that approximately nobody reads, and it functioned exactly as intended. Which is why “have they been breached?” is the wrong question to ask any email tool. The right one is: what does this company do when everything works as designed?
Why this became the permanent reply
Years later, this is still the first thing raised in any thread about email tools, and it should be. It is the clearest available example of a structural fact: an inbox is the most complete dossier that exists about a person. Every receipt, every service you use, every account, every flight. Anyone who can read it can reconstruct your life with more accuracy than your browser history.
And there is a second, quieter lesson people take from it. A free tool with real infrastructure costs is monetising something. If you cannot name what, that is the answer.
What to check before you grant anything
This applies to Unroll.me, to us, and to whatever tool replaces both of us in five years.
- Read the scope on the consent screen. It is Google’s screen, not the company’s, and it states what the app can reach. A tool that only needs to find and delete mail does not need to read the contents of your messages.
- Name the revenue. Subscription, one-time fee, both fine. Unexplained free is the flag.
- Ask what it retains. This is the one Unroll.me teaches. Revoking access stops future requests; it does not delete what already sits in someone else’s database. Retention outlives the token.
- Audit what you already granted. Your Google Account lists every connected app and what it can reach. Removing one takes two clicks and needs nothing from the company.
Where we sit, tested against our own checklist
We use Google’s official Gmail API with the narrowest scope possible: we can list message metadata — sender, subject, size, date — and call delete. We never read body content and never store messages on our servers. The revenue is $9.99 once, or $0 for the free tier. We have nothing to sell to advertisers because we hold nothing worth selling — which is a design decision, not a virtue.
Do not take that from a page we wrote. The consent screen states our scope before you approve anything, and revocation is two clicks whenever you want. Our privacy policy has the full version. If you would rather grant nobody anything, that is a legitimate answer and Gmail’s own operators will do the job.
Related
Questions people actually search
Is Unroll.me safe to use?
That is your call to make with the facts in hand. Unroll.me business model was famously reported to involve selling inbox data to advertisers. That was not a breach — it was the design, disclosed in terms most people did not read. Whether that is acceptable depends on what you consider your inbox to be worth, but you should decide it knowingly.
Did Unroll.me really sell user data?
Its business model was famously reported to involve selling inbox data to advertisers. We are deliberately not embellishing that beyond what is widely documented. The useful lesson is structural rather than about one company: a free tool with real infrastructure costs is monetising something, and if the product is free the data is usually the product.
What should I check before giving an app access to my email?
Read the consent screen scope before clicking, ask how the company makes money, and ask what it stores rather than only what it reads. Retention outlives revocation — cancelling access stops future requests but does not remove what was already copied to someone else servers.
How do I revoke Unroll.me access to my Gmail?
Open your Google Account, find the connected-apps section, select the app and remove its access. It takes effect immediately and needs nothing from the company. While you are there, look at the full list — most people find several tools they signed into years ago and forgot about entirely.
Are all email cleanup tools like Unroll.me?
No, and treating them as identical is as lazy as trusting them all. The variables are the permission scope and the revenue model. A tool that never reads message bodies has far less to monetise than one that reads everything. Check the scope on the consent screen — that is the difference you can actually verify.