Is Unroll.Me Safe? Privacy Terms & FTC History

A documentary review cannot certify Unroll.Me as universally “safe.” Its current policy says the service collects copies of and information from commercial email for market-intelligence, analytics, measurement, dataset, and advertising-model products. Its support pages describe Block as routing future messages to an Unroll.Me/Unsubscribed folder—not proof that a sender received or honored an unsubscribe request. The FTC's 2019 settlement is relevant disclosure history, but it is not evidence about current security or reliability.

Verification note: This is a documentary source review checked against current sources on August 24, 2026. We did not hands-on test the named product or workflow during this review, so claims are limited to the cited documentation. Interfaces can vary by account, region, rollout, and app version.

Research disclosure: Flick Editorial checked official Unroll.Me support and legal pages plus the FTC record on August 24, 2026. We did not create an account, connect a mailbox, test signup, inspect code, audit security, observe deletion, or measure unsubscribe outcomes. We also build Flick, a competing email tool; read our editorial policy and research methodology before treating this as a product recommendation.

What does Unroll.Me currently do?

Unroll.Me's service overview says it scans a connected mailbox for subscription email and gives each detected subscription one of three treatments. Its current editing guide documents:

• Keep: future messages remain in the normal inbox.
• Block: future messages go to the Unroll.Me/Unsubscribed folder.
• Rollup: future messages go to a daily digest and remain available in the Unroll.Me folder.

Those are vendor-documented mechanics, not results we observed. In particular, Block is folder routing. It can remove mail from the primary inbox without proving that the sender stopped sending. Our guide to whether unsubscribing works explains the difference between submitting an opt-out, filtering mail, and verifying sender honor.

What data use does the current policy describe?

Unroll.Me's cost article says users are not charged. It describes recognizing commercial emails, extracting purchase information, removing identifying details, and using the result in anonymized measurement products.

The current privacy notice is broader than e-receipts alone. It describes copies of and information from categories such as transactional messages, purchase and sales receipts, delivery confirmations and returns, subscription confirmations and cancellations, and marketing or promotional email. It names market intelligence, analytics, datasets, measurement products, advertising-campaign measurement, and lookalike models, audiences, and segments among the uses.

For US users, the notice says Unroll.Me may “sell” or “share,” as those terms are defined by applicable law, some personal-information categories. It also says directly identifying information is not sold or shared with customers to target or sell to the panelist, and that panelists are removed from lookalike audiences. These are policy statements; this review did not independently audit implementation.

The accurate shorthand is therefore not “only anonymized e-receipts.” The no-user-charge service documents a broader commercial-email data exchange. Read the live notice shown to your region before connecting because policy wording and available rights can change.

What did the FTC settlement actually require?

The FTC's final December 2019 settlement release says Unrollme was barred from misrepresenting how it collects, uses, stores, shares, or discloses consumer information.

The notice-and-deletion remedy was narrower than “delete everyone's data.” It covered stored e-receipts collected from consumers who signed up after seeing the challenged statements, unless Unrollme obtained their affirmative consent to retain them. The case concerned representations about data collection and use. It does not establish whether the current product is secure, reliable, or effective.

What happened in 2017?

Contemporaneous reporting described Slice Intelligence, then Unroll.Me's parent, selling anonymized Lyft receipt data to Uber. That episode explains why readers still ask about disclosure and consent, but it should not be converted into a claim that raw personal emails were sold to Uber or that today's controls have been independently tested.

The regulator record is the strongest source for the later legal remedy. For the current service, use the live privacy notice and support pages rather than relying only on old headlines.

Is Unroll.Me available in Europe?

The current EU/EEA availability page says the service is not available to customers in the European Union or European Economic Area. That page does not state a 2018 departure date or promise a return, so this review does not infer either point from the current notice.

Which providers are documented?

The current provider list names Gmail and Google Apps, iCloud addresses, Yahoo, AOL, Outlook.com, Hotmail, MSN, and Live Mail. It does not list generic IMAP or on-premises Exchange. A support list is not proof that a particular account will finish signup or that every documented action will work; we did not test those outcomes.

How should you make the safety decision?

Separate four questions:

1. Capability: what mailbox data can the granted authorization reach?
2. Purpose: what does the current policy say the company does with commercial-email information?
3. Control: how can you opt out, delete an account, and revoke mailbox access?
4. Evidence: which claims are vendor statements, regulator findings, independent audits, or hands-on observations?

No single “legit” or “malware” label answers all four. If the documented commercial-email measurement and advertising-model purposes do not fit your requirements, do not connect the mailbox. If they do, still verify the exact consent screen, deletion route, and account eligibility presented to you.

How is Flick different?

We make Flick, so this is a disclosed product boundary, not an independent endorsement. Flick uses a finite card deck for mailbox decisions rather than a permanent Rollup. On supported messages, a separate control asks for confirmation and can submit an advertised unsubscribe route. Flick does not independently prove that every sender honors the request.

The current live connector report identifies Gmail as the only smoke-tested provider and reports verifiedFinish:false. An empty displayed deck is not proof that an entire mailbox is empty. Google's restricted gmail.modify permission is technically able to read, compose, send, and modify mail; Flick's current build does not expose or invoke Gmail Send. See Flick's privacy boundary and the broader email-cleaner comparison before connecting.

FAQ

Is Unroll.Me safe to use?

This documentary review cannot certify a universal safety verdict. The service is documented and its current policy discloses broad commercial-email data uses, but we did not test security, reliability, deletion, or unsubscribe outcomes. Decide whether the current permissions, purposes, and controls fit your requirements.

Does Unroll.Me unsubscribe from senders?

Its current support pages describe Block as routing future messages to an Unroll.Me/Unsubscribed folder. That can clean the inbox view, but it does not prove the sender received an unsubscribe request or stopped sending.

Does Unroll.Me sell data?

Its current privacy notice uses “sell” and “share” as defined by applicable US law for some categories and describes commercial-email information used in market-intelligence, analytics, measurement, dataset, and advertising-model products. It also states limits around direct identifiers and lookalike audiences. Read the current notice for the exact regional terms.

What did the FTC require Unroll.Me to delete?

The 2019 remedy covered stored e-receipts collected from affected consumers who had signed up after seeing the challenged statements, unless affirmative consent was obtained. It was not described as deletion of every user's data.

Why is Unroll.Me unavailable in Europe?

The current official page says the service is unavailable to EU and EEA customers. It does not state the current legal rationale, a departure date, or a return timetable, so this page does not speculate beyond that notice.