Which Apps Can Read Your Gmail? Remove Access

Last checked: Nov 7, 2026. Based on The Wall Street Journal reporting from July 2, 2018, The New York Times reporting from April 24, 2017, FTC settlement materials from 2019, and current account security guidance.

You clicked "Allow" on an email app or productivity tool to let it manage your inbox, unsubscribe from newsletters, or track packages. That permission can give the app full access to read every email you've ever received.

In 2018, The Wall Street Journal reported that hundreds of outside developers were scanning the inboxes of millions of users. In some cases, employees at those companies read actual emails. The permission model remains the same: when you grant access, apps can read your inbox.

If you've connected email apps over the years and haven't checked those permissions recently, this guide explains what was found in 2018, what happened after, and how to revoke access to apps you no longer use.

#Watch: Apps let strangers read your inbox

This video explains how app permissions work and what you can do about it.

#What The Wall Street Journal found in 2018

On July 2, 2018, The Wall Street Journal published an investigation titled "Tech's 'Dirty Secret': The App Developers Sifting Through Your Gmail."

The investigation, reported by Douglas MacMillan, found that hundreds of outside developers had the ability to scan the inboxes of millions of users who had granted them access. The WSJ reporting was corroborated by The Verge, MacRumors, and Engadget in July 2018.

#Return Path employees read about 8,000 emails

Per the WSJ reporting, Return Path, a company that provided email optimization services, had employees read about 8,000 unredacted personal emails to help train the company's software.

Return Path told the WSJ that its engineers reviewed emails to train algorithms and that its user agreement disclosed the practice. The company said it had the consent of the people whose emails were reviewed.

#Edison Software engineers read hundreds of emails to build smart replies

The Wall Street Journal also reported that engineers at Edison Software, maker of the Edison Mail app, had read emails from hundreds of users to help build a smart reply feature.

According to The Verge's July 2, 2018 reporting, Edison Software responded: "We have since stopped this practice and expunged all such data."

Edison Software told the WSJ that its privacy policy disclosed the practice and that the reading was done to improve products.

#The WSJ found no evidence of misuse

The Wall Street Journal stated in its 2018 investigation that it found no evidence the data was misused. The investigation focused on the extent of access and the fact that human employees at some companies read actual emails, not on unauthorized use of the data.

#What The New York Times found in 2017 about Unroll.me

On April 24, 2017, The New York Times reported that Unroll.me, a free service that helps users unsubscribe from email lists, scanned users' inboxes for e-receipts.

Unroll.me's parent company, Slice Intelligence, used anonymized purchase data derived from those receipts. Per the Times reporting, Uber purchased market research from Slice to monitor the use of competitor Lyft by reviewing receipts for Lyft rides.

Users reacted with surprise. Many said they thought Unroll.me's promise to "never touch your personal stuff" meant it would not use their email data commercially.

#FTC action in 2019

The Federal Trade Commission's Decision and Order with Unroll.me was issued December 16, 2019. The Federal Register published notice on August 20, 2019.

The FTC order prohibits misrepresentations about how consumer email data is disclosed or used. It requires Unroll.me to send notice to specified existing consumers within ten days. The order also required deletion of specified older receipt data unless express consent permits storage.

#What the sources document

On July 3, 2018, a blog post by Suzanne Frey, Google's Director of Security, Trust and Privacy, stated that Google vets apps and that "no one at Google reads your Gmail, except in very specific cases where you ask us to and give consent, or where we need to for security purposes, such as investigating a bug or abuse."

These sources document historical practices, not their status in 2026. Edison said in 2018 that it stopped the practice and deleted the data.

#How app permissions work

When you sign in to a third-party app using your email account, you see a permission screen that lists what the app wants to access.

For email apps, the permission screen may ask for:

• Read all your email messages and settings - The app can read every email in your inbox, including sent mail and archived messages.
• Send email on your behalf - The app can send emails from your account.
• Delete emails from your inbox - The app can permanently delete messages.

Once you click Allow, the app receives an OAuth access token. Tokens can expire, but many apps request renewable authorization that remains valid until you revoke it or the app deletes it. The app can perform the granted actions as long as the authorization is valid and the token hasn't expired.

#What apps can see

An app with read access to your inbox can see:

• Every email you've received, including old messages
• Your sent mail
• Email addresses of your contacts and correspondents
• Attachments in your emails
• Email metadata like timestamps and subject lines

The app does not need to ask for permission each time it reads an email. While granted and tokens remain valid, the access is ongoing until you revoke the authorization.

#How to see what apps have access to your account

Internet platforms provide tools to review and remove third-party apps connected to your account.

The exact steps vary by platform, but the general process is:

1. Go to your account security settings
2. Look for a section about third-party apps, connections, or access
3. Review the list of apps that have access
4. Select an app to see what permissions it has
5. Remove access to apps you don't use or don't recognize

For Google accounts, current steps from Google Account Help:

1. Go to Google Account linked apps at https://myaccount.google.com/linkedapps
2. Under "Access to your Google Account," select an app
3. Select "See details" to review permissions
4. Select "Remove access"
5. Select "Confirm"

A product filter can distinguish Gmail read access from generic account access. Check each app's specific granted scopes to confirm Gmail permissions.

#What to look for when reviewing app access

When you review connected apps, pay attention to:

#Apps you don't recognize

If you see an app you don't remember authorizing, remove access immediately. It could be:

• An app you tried once and forgot about
• An app that rebranded and now has a different name
• An unauthorized app if someone else accessed your account

After removing access, check your account activity for suspicious behavior. If you see unauthorized activity, change your password and enable two-factor authentication.

#Apps you no longer use

If you see an app you used in the past but haven't opened in months or years, remove access. If its authorization remains valid and includes Gmail read access, an unused app may still access your email.

Examples of apps people often forget about:

• Email clients you tried but didn't keep
• Productivity tools you used for a project that's finished
• Receipt trackers or expense tools you no longer need
• Calendar integrations for services you've stopped using

#Apps with broad permissions

Some apps ask for full inbox access when they only need limited access. For example:

• A calendar app might ask to read all email when it only needs to see calendar invitations
• A receipt tracker might ask for full inbox access when it only needs to see receipts

If an app has broader permissions than it needs for the service it provides, consider whether you still want to use it.

#What removing access does and doesn't do

When you remove an app's access:

What it does:

• Revokes the app's authorization to access your account
• Invalidates the app's current access token
• The app can no longer read new emails or send emails on your behalf (subject to granted scopes)

What it doesn't do:

• It does not delete data the app already collected before you removed access
• It does not delete your account with that app
• It does not prevent you from granting access again in the future

If you want the app to delete data it collected, you need to contact the app or use the app's data deletion tools separately from revoking access.

#The realistic approach to third-party email apps

Email apps and productivity tools can be genuinely useful. Many people rely on third-party email clients, receipt trackers, calendar integrations, and unsubscribe tools to manage their inboxes.

The question is not whether to ever grant access. The question is which apps to trust and how often to review those permissions.

Here's a practical routine:

#When you're about to grant access to a new app

1. Check what permissions the app is asking for. Does it need full inbox access, or could it work with more limited permissions?

2. Read the app's privacy policy. Does it say whether the app shares email data with third parties? Does it use email data to train AI or build features?

3. Search for recent news about the app. Has the app been involved in privacy controversies? Has it changed ownership recently?

4. Consider alternatives. Are there apps that provide the same service with fewer permissions or better privacy practices?

#Every six months

1. Review your connected apps. Go to your account security settings and check which apps have access.

2. Remove apps you no longer use. If you haven't opened an app in the past few months, you probably don't need to keep its access active.

3. Check for apps you don't recognize. If you see an app you don't remember, remove it and check your account activity for suspicious behavior.

#When an app changes ownership or policy

Apps sometimes get acquired, and the new owner may have different privacy practices. When you hear that an app you use has changed hands or updated its privacy policy, recheck what access it has and decide whether you still want to use it.

#What this means for data brokers and privacy

Email scanning is one piece of a larger data collection ecosystem. Apps that read your inbox can extract:

• Purchase history from order confirmations and receipts
• Travel patterns from flight confirmations and hotel bookings
• Financial information from bank statements and payment confirmations
• Health information from appointment reminders and prescription notices
• Social connections from the people you email

Some apps may use inbox data for purposes disclosed in their privacy policies, which can include advertising, analytics, or commercial purposes. Apps vary in how they handle this data, so review each app's privacy policy to understand its practices.

If you're working to remove your personal information from data brokers and people-search sites, limiting what email apps can access is part of the same effort. Our main guide, how to remove your personal information from the internet, covers the full process. Email tracking is another privacy concern you can address: see can senders see if you opened their email for how email tracking pixels work.

Revoking access to old email apps won't delete data those apps already collected and shared. But it stops them from continuing to scan your inbox and extract new data.

#The bottom line

The 2018 Wall Street Journal investigation and the 2017 New York Times reporting on Unroll.me revealed that third-party apps with inbox access were using email data in ways many users didn't expect. Employees at some companies read actual emails.

These sources document historical practices, not their status in 2026. The permission model remains: when you grant an app access to your Gmail, the app can read your emails according to the granted scopes, as long as the authorization is valid.

The practical step is to review your connected apps and remove access to apps you don't use or don't recognize. It takes a few minutes and limits how many companies have continuous access to your inbox.

UndoLeak erases your data from data brokers and keeps it off.

Run a free privacy check

---

#Sources

1. The Wall Street Journal, Douglas MacMillan, "Tech's 'Dirty Secret': The App Developers Sifting Through Your Gmail" (July 2, 2018): https://www.wsj.com/articles/techs-dirty-secret-the-app-developers-sifting-through-your-gmail-1530544442 (paywalled)

2. The Verge, "Gmail app developers have been reading your emails" (July 2, 2018): https://www.theverge.com/2018/7/2/17527972/gmail-app-developers-full-email-access

3. MacRumors, "Some Third-Party Email Apps Let Employees Read User Emails" (July 2, 2018): https://www.macrumors.com/2018/07/02/third-party-email-apps-reading-user-emails/

4. Engadget, "Third-party app developers could be reading your Gmail" (July 3, 2018): https://www.engadget.com/2018-07-03-third-party-app-developers-reading-gmail.html

5. The New York Times, Mike Isaac (April 24, 2017): https://www.nytimes.com/2017/04/24/technology/personal-data-firm-slice-unroll-me-backlash-uber.html (Unroll.me/Slice/Uber investigation; paywalled)

6. The Verge, "Unroll.me settles with FTC after falsely claiming it didn't collect and sell email data" (December 17, 2019): https://www.theverge.com/2019/12/17/21027159/unroll-me-email-privacy-ftc-settlement

7. Federal Trade Commission, "In the Matter of Unroll.me Inc." Decision and Order (December 16, 2019): https://search.ftc.gov/system/files/documents/cases/c-4692_172_3139_-_unrollme_order.pdf

8. Google, "Ensuring your security and privacy within Gmail" (July 3, 2018): https://blog.google/innovation-and-ai/technology/safety-security/ensuring-your-security-and-privacy-within-gmail/

9. Google Account Help, "Manage links between your Google Account & apps from other developers" (2026): https://support.google.com/accounts/answer/13533235?hl=en

---

Not affiliated with any company mentioned. These sources document practices from 2017-2018, not their status in 2026.