Please open a private security advisory on GitHub (Security → Report a vulnerability) or email the maintainer. Do not open a public issue for exploitable problems. You should receive a response within 7 days.

• Reads: Gmail message metadata only — sender, subject, date, labels, size estimate, and the List-Unsubscribe header — via the Gmail API format=metadata.
• Never reads, stores, or transmits email bodies.
• Writes to Gmail: label add/remove (archive = remove INBOX), move to Trash. Never permanent deletion. Only with --confirm.
• Writes to disk:
  • ~/.gmail-ai-cleaner/token.enc — your OAuth refresh token, encrypted with AES-256-GCM.
  • ~/.gmail-ai-cleaner/key — random 32-byte local key material (file mode 0600 where the OS supports it).
  • Optional report files (--export) containing metadata rows only.
• Third parties: nothing, unless you opt in with --llm, in which case sender + subject line of ambiguous messages are sent to the Anthropic API using your own key. Responses are used in memory and never persisted.

The token is encrypted at rest with a key derived from a local secret file. This protects against casual disclosure (backups, file sync) but not against an attacker with full access to your OS user account, who can read the key file too. OS-keychain integration (e.g. via keytar) is a welcome contribution.

Only gmail.modify and gmail.labels are requested. Revoke access anytime at https://myaccount.google.com/permissions.