Are AI Email Assistants Safe? A Privacy Checklist for 2026

AI email assistants can be safe — but the safety lives in the vendor's data practices, not in the AI. What matters is which OAuth scopes the tool requests, whether your message content leaves your mailbox, whether your mail is used to train models, whether humans can read it, and whether the company sells what it learns. The safest tools are the ones that need the least of your mail. Before you click "Allow" on any inbox tool, ask the seven questions below — and if a vendor can't answer them plainly, don't grant the scope.

An AI email assistant is any tool that connects to your mailbox — usually through OAuth — and reads, sorts, summarizes, drafts, or acts on your email for you.

We build a tool that asks for the same kind of access. Flick (flicked.email) is a swipe-to-triage email client, and we ask people to connect their Gmail to it. That means we've spent a lot of time on the other side of this question, deciding what a tool like ours should be allowed to see. This guide is the checklist we'd want you to run on us — and on everyone else.

What can an email app actually see once you click "Allow"?

More than most people assume. Email access is granted through OAuth scopes — permission tiers that range from "see your address" to "read, modify, and send mail on your behalf." The consent screen you skim past is the only moment a vendor is forced to tell you exactly which tier it wants.

This is not a hypothetical concern. In 2018, after reporting on third-party access to Gmail messages, Google publicly clarified how non-Google apps get to your mail: they pass "a multi-step review process that includes automated and manual review of the developer," and they must "only request relevant data" needed for their function. Google's own reassurance — "No one at Google reads your Gmail, except in very specific cases where you ask us to" — was necessary precisely because third-party apps can read it, once you've granted them the scope.

Since then the fence has gotten taller. Apps requesting sensitive or restricted Gmail scopes must pass Google's OAuth app verification, including a security assessment, and re-verify annually. And the Limited Use policy that binds every Gmail-API app prohibits transferring or selling user data to "advertising platforms, data brokers, or any information resellers," and forbids humans from reading your data without your affirmative agreement.

Good fences. But a fence is not a substitute for reading the gate sign. Verification tells you a vendor cleared Google's bar — it doesn't tell you what the vendor does inside the boundary of what's allowed, or what happens if it quietly changes its mind.

What is the worst case? Ask Unroll.me

The canonical cautionary tale in this category is an unsubscribe tool. In April 2017, the New York Times revealed that Unroll.me — a free service that cleaned up newsletter subscriptions — was, in TechCrunch's words, using "the premise of 'free' but not very useful 'email management' services to gain access to people's email inboxes in order to data-mine the contents for competitive intelligence," and selling the gleaned insights "to the likes of Uber." The famous example: Lyft ride receipts, scraped from user inboxes and sold to Uber via Unroll.me's parent company.

The story didn't end with an apology. In 2019, Unrollme Inc. settled FTC allegations that it "deceived some consumers about how it accesses and uses their personal emails." A year earlier, in May 2018, the company had simply shut off access for EU users rather than bring its practices in line with GDPR — which tells you what the data pipeline was worth to the business.

The lesson is not "unsubscribe tools are evil." The lesson is that "free email cleanup" has a documented history of being a data business wearing a productivity costume. It's the reason we wrote a whole piece on what to look for in an Unroll.me alternative, and it's the reason this checklist exists.

What seven questions should you ask before connecting an AI to your inbox?

Run every mailbox tool — ours included — through this table before you connect.

#	Question	Good answer	Walk away if
1	Which OAuth scopes does it request?	The narrowest set that can do the job, listed plainly on the consent screen	It wants full read/write/send access for a feature that only needs metadata
2	Does message content leave my mailbox?	A clear description of what is processed, where, and for how long	The privacy policy is vague about processing, storage, or third-party processors
3	Is my mail used to train AI models?	An explicit "no" for generalized models, in the privacy policy — not a blog post	Training use is unmentioned, or buried in an opt-out
4	Can employees read my mail?	Only with your explicit case-by-case consent, per Limited Use	"Authorized personnel may access data to improve the service"
5	Does the vendor sell or share inbox-derived data?	A binding "no" covering affiliates and "trusted partners"	Unroll.me-style language about sharing with a parent company or partners
6	How do I revoke access, and what happens to collected data?	Revocation instructions plus a stated deletion path	Revocation is undocumented, or deletion requires a support ticket that goes nowhere
7	Has the app passed Google's OAuth verification?	Yes — sensitive and restricted scopes require it, re-verified annually	The consent screen warns the app is unverified

If a vendor's answers to questions two through five exist only in marketing copy, treat them as unanswered. Marketing copy is not binding. Privacy policies are.

Why does less access beat smarter AI?

Here is the claim we'd put on a billboard, if we were the billboard type: the safest AI email feature is the one that needs the least of your mail.

Every scope you grant is attack surface. And with LLM-based assistants, the mail itself becomes attack surface — because an AI that reads message bodies can be manipulated by message bodies. In June 2025, the EchoLeak vulnerability (CVE-2025-32711) showed exactly this: an AI command injection in Microsoft 365 Copilot allowed attackers to exfiltrate information with no user interaction — a malicious email, read by the assistant, was enough. Microsoft scored it 9.3, critical; NIST scored it 7.5, high. Either way: the assistant's intelligence was the vulnerability.

Now compare that to the most useful "AI-adjacent" email feature there is — unsubscribing — which needs no intelligence at all. One-click unsubscribe is defined by RFC 8058, published in January 2017: the sender declares an HTTPS unsubscribe endpoint in the List-Unsubscribe header, marks it one-click-capable with List-Unsubscribe-Post, and signs both with DKIM. Honoring it is a deterministic HTTP POST. No model. No reading your mail. The headers are so reliable that Google requires senders of roughly 5,000 or more messages a day to include them, with enforcement tightening from November 2025 into outright rejection of non-compliant mail. We wrote up the full mechanics in our one-click unsubscribe explainer, and covered whether unsubscribing actually works and when it's safe separately.

The pattern generalizes. Before you accept "our AI reads your email to help you," ask whether the job could be done by parsing structure instead of prose. Deterministic header parsing can't be prompt-injected, can't hallucinate, and can't leak what it never read. When a vendor insists it needs your message bodies, the honest follow-up is: for which feature, exactly?

How does Flick answer its own checklist?

Fair is fair. Here is our own row-by-row, answered only from facts we can stand behind — and where a blog post is the wrong place for a promise, we say so instead of improvising one.

#	Question	Flick's answer
1	Which scopes?	We connect to Gmail via OAuth. The consent screen lists every scope at connect time — it's the one place no vendor can editorialize, so read it there, not here.
2	Does content leave?	Our core unsubscribe feature doesn't need your message bodies at all: it parses the List-Unsubscribe / List-Unsubscribe-Post headers per RFC 8058 — the same mechanism behind Gmail's own unsubscribe button. For everything beyond that, read the privacy policy; summaries are where nuance goes to die.
3	Trains AI on my mail?	The Workspace API policy bars every Gmail-API app — us included — from using your data to "create, train, or improve" AI models beyond your own personalized features. For our own commitments: privacy policy.
4	Humans read mail?	Limited Use binds us like everyone else: no human access without your affirmative agreement, outside security and legal-compliance cases.
5	Sells data?	If a vendor answers this question only in a blog post, be suspicious — including of us. The binding answer has to live in the privacy policy, so that's where we put ours.
6	Revocation?	myaccount.google.com/connections cuts our access the same as any app's. No special exit door required.
7	Verified?	Check us the way you'd check anyone: the consent screen warns you at connect time if an app is unverified. Sensitive and restricted Gmail scopes require verification to operate at all.

One more thing we do that fits this page: we grade real senders A–F on whether they actually honor unsubscribe requests — our Exit Gap Index. You can look up any sender's grade before deciding whether to trust its unsubscribe link. The same skepticism this checklist applies to email tools, applied to email senders.

How do you revoke access if you change your mind?

Revocation is instant; deletion is not. Go to myaccount.google.com/connections, find the app, and remove its access — from that moment it can't touch your mailbox. But per Google's own documentation, "you may need to contact the developer of the app to request that they delete the data they already have." Revoking closes the door; it doesn't empty the room.

So make deletion part of the exit: revoke the scope, then email the vendor and request deletion of previously collected data. A vendor that handles that request gracefully is one you can consider reconnecting. A vendor that can't tell you what it stored is answering question six for you — just not the way you hoped.

FAQ

Is it safe to give AI access to your email?

It's safe when the vendor requests minimal scopes, processes only what the feature needs, and binds its promises in a privacy policy rather than marketing copy. The Limited Use policy prohibits Gmail-API apps from selling your data or letting humans read it without consent, and verification is required for sensitive and restricted scopes. The risk isn't the AI — it's a vendor whose business model needs more of your mail than its features do.

Can AI email assistants read all my emails?

If you grant a full-mailbox read scope, yes — that's exactly what the scope authorizes. The consent screen at connect time is the definitive list of what a tool can see, which is why skimming past it is the single most expensive habit in email privacy. Tools built on structured data — headers, senders, metadata — can do real work without ever touching message bodies.

Do AI email tools train models on my emails?

Under Google's Workspace API policy, apps may not use your Workspace data to train generalized AI or machine-learning models — only personalized features for you. That's the floor, not the ceiling: a trustworthy vendor also states its own training policy explicitly in its privacy documents. If training use is unmentioned, treat the answer as "yes" until shown otherwise.

How do I revoke an app's access to my Gmail?

Open myaccount.google.com/connections, select the app, and remove its access — it takes effect immediately. Data the app already collected isn't deleted by revocation, so follow up with the vendor and request deletion directly. Google's documentation is explicit that you "may need to contact the developer" for that step.