bmail

bmail privacy policy

Last updated: 2026-11-08

Who this covers

bmail is software a person installs and runs for their own Gmail account. The person running it is its only user and the only one who holds the data. This page describes what the software does with the Google account data it is granted.

What bmail asks Google for

When you connect an account, Google asks you to grant these permissions (OAuth scopes):

• gmail.modify: read messages, headers, labels and attachments; add and remove labels (archive, mark read or unread, apply bmail's own labels such as bmail/marketing); save a complaint you ask for as a Gmail draft, which you review and send yourself. bmail never permanently deletes mail at Google.
• gmail.settings.basic: create and remove the Gmail filters for senders you block (skip the inbox and add the bmail/blocked label, and move their mail to Trash only if you choose that setting), and nothing else in settings.
• gmail.send: send mailto: unsubscribe requests from your address, only when you confirm an unsubscribe. bmail sends no other mail.
• openid, email: learn which address was connected.

Where the data is kept

Everything bmail stores is in one SQLite database file on your computer, readable only by your user account. It holds message headers from a fixed allowlist, snippets, label ids, compressed raw message bodies for the window you configure, text extracted from attachments, the classifications and extractions bmail derives, your corrections, and the OAuth tokens. bmail stores nothing anywhere else, apart from files you ask it to write, such as exports.

What leaves your computer

• Google: the Gmail API requests described above, to Google's own endpoints only.
• The classifier and the extraction model: run on your own hardware, either on the same computer or on another machine you control, reached over SSH or your own network. Message text does not go to a third party for classification or extraction unless you turn on the options below.
• Optional second opinion (off by default): if you enable the judge and supply your own Anthropic API key, the sender, subject, list headers, attachment names and a text excerpt of the messages the judge is asked about are sent to Anthropic's API to obtain a category verdict. The optional cloud extractor (EXTRACT_CLOUD=1) sends the message text for the messages it is asked to extract from. Both are off unless you configure them.
• Unsubscribing: when you confirm an unsubscribe, bmail uses the unsubscribe endpoint the sender declared in the message's List-Unsubscribe header: an https one-click request, a mailto: message, or the sender's unsubscribe page, which you open and finish yourself. Links inside message bodies are never followed.
• Optional local event feed: if configured, job progress events go to a dashboard on your own network. They carry counts, job and model names and a short internal account id, not mail content.

There is no analytics, telemetry, advertising, or sale or sharing of data. No one other than you reads your data. bmail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting data

Data stays on your computer until you remove it. You can export everything as JSON Lines, delete messages, senders or the whole account from the local database (deleted ids are remembered so they are not re-synced), and disconnect the account, which revokes bmail's token at Google and deletes it locally. You can also revoke access at any time at https://myaccount.google.com/permissions. Deleting the database file removes everything.

Changes

This page ships with the software and changes with it. The date above is the last change.

Contact: the support address shown on this app's Google consent screen.