How Sender Sweep Keeps Your Email Private
Giving any app access to your mailbox deserves scrutiny — it’s your email. Sender Sweep is built so that trusting it is easy: your mail is analyzed and cleaned up entirely in your browser, and none of it is ever stored on our servers. Here’s exactly how that works.
Everything happens in your browser
When you scan your mailbox, Sender Sweep talks directly from your browser to the Microsoft Graph API. The per-sender counts, read rates, and charts are all computed on your device. Your emails, their subjects, and your sender lists are never sent to, or stored on, a Sender Sweep server.
There’s no server-side copy of your inbox because there’s no server-side processing at all. The heavy lifting runs in the browser tab in front of you.
What our backend actually sees
Sender Sweep does have a small backend — but only for billing and plan limits. It stores just:
- Your account identifier and email.
- Your plan (free or Pro).
- Your usage counts (how many deletes/unsubscribes this month).
That’s it. It never sees an email, a subject line, or who emails you.
You sign in with Microsoft — we never see your password
Sign-in uses OAuth (“Sign in with Microsoft”). You authenticate on Microsoft’s own page, and Sender Sweep receives a limited access token — it never sees or stores your password. You can revoke that access anytime from your Microsoft account, with no effect on your password. (See is it safe to give an app access to your Outlook mailbox?)
Least-privilege permissions
Sender Sweep requests only two permissions:
- User.Read — to show your name and email after sign-in.
- Mail.ReadWrite — to read sender info and to move, archive, or mark messages (needed for cleanup).
It deliberately does not request permission to send email as you, and it can’t touch anyone else’s mailbox. (See Outlook app permissions explained.)
Deleting is safe and recoverable
When you delete, Sender Sweep moves messages to your Deleted Items folder — exactly like Outlook’s own delete button. Nothing is permanently erased, so anything caught by mistake is recoverable from Outlook.
Your session stays on your device
Access tokens are kept in your browser’s session storage, scoped to the tab — not persisted to a database. Close the tab and the session ends. Come back and you sign in again through Microsoft.
The short version
- Your mailbox is processed in your browser, never on our servers.
- The backend stores only your plan and usage counts — never your email.
- Sign-in is OAuth — we never see your password.
- Permissions are least-privilege (no send-as-you access).
- Delete is a move to Deleted Items — fully recoverable.
Want to see who’s filling your inbox without handing your email to anyone? Try Sender Sweep — it’s free to scan, and your email never leaves your device.
FAQ
Does Sender Sweep store my emails? No. Your mailbox is processed in your browser; the backend only stores your plan and usage counts.
Can Sender Sweep read my email on its servers? No — there’s no server-side processing. All mailbox access happens client-side via Microsoft Graph.
How do I revoke Sender Sweep’s access? Go to myaccount.microsoft.com → Settings & Privacy → App permissions and revoke it. It’s instant and doesn’t affect your password.
Related: Is it safe to give an app access to your Outlook mailbox? and Outlook app permissions (Mail.ReadWrite) explained.