Is Disponed safe? How its Gmail security model works
TL;DR
- Yes — Disponed signs in through Google OAuth only. You type your Google password into Google's own page, never into Disponed.
- Disponed reads Gmail metadata only (sender, labels, size, thread ID) to build counts. It never reads or stores the body of any email.
- Full Gmail access is requested only because optional permanent delete requires it; Google has no narrower scope that supports it.
- Every deletion is checked twice — once when the search query is built, once again message-by-message right before deletion — so protected mail can't slip through.
- You can revoke Disponed's access at any time from myaccount.google.com/permissions.
This page covers the full security model in one place: how sign-in works, exactly which Gmail permissions are requested and why, what Disponed can and can't see, and how deletion is safeguarded.
Sign-in: Google OAuth, never a password form
Disponed has no login form of its own. Clicking 'Sign in with Google' sends you to Google's own accounts.google.com page, where you enter your Google credentials directly into Google's interface.
Once you approve, Google hands Disponed an OAuth token, not your password, scoped to only the permissions shown on the consent screen. This is the same standard OAuth 2.0 flow used by most 'Sign in with Google' buttons.
The Gmail permissions requested, and why
Google's consent screen lists two permission scopes. Each maps to a specific need — none are requested speculatively.
| Scope | Why Disponed needs it |
|---|---|
| https://mail.google.com/ (full Gmail access) | Permanent delete needs it — Gmail's only narrower option (gmail.modify) can move mail to Trash, but can't delete it outright. |
| https://www.googleapis.com/auth/gmail.settings.basic | Creates an archive filter for senders you unsubscribe from with the Stop Ads add-on, so their future mail skips your inbox automatically. |
What Disponed can see, and what it can't
The full Gmail scope is broad by necessity, but Disponed's own code path only ever touches message metadata — never the content of a message.
- Reads: sender address, Gmail labels, message size, thread ID, and whether an attachment is present
- Never reads: the subject line or body text of any email
- Never stores: email content of any kind, in any form
- Stores: counts only — how many emails match each cleanup category, and how much storage they'd free
Deletion is checked twice before anything is removed
Protection isn't a single filter — it's enforced at two separate points, so a mistake in one can't cause a wrong deletion.
First, protected mail (starred, important, labeled, attachments, sent, drafts, two-way conversations, whitelisted senders) is excluded when Disponed builds the Gmail search query.
Second, right before deleting, each individual message is checked again against the same rules. This second check is the authoritative guard: it holds even if a Gmail search operator behaves unexpectedly, so a bad search shortcut can never bypass it.
Where access is stored, and how to revoke it
Disponed stores only the OAuth access tokens Google issues after you approve the consent screen. It never stores your Google password, because it never receives it in the first place.
You control the connection from both sides, and can end it whenever you choose:
- From Google: go to myaccount.google.com/permissions, select Disponed, and click Remove access
- From Disponed: use the disconnect option inside the app
- Revoking access does not undo cleanups already run, but it stops any further access instantly
FAQ
- Is Disponed safe to connect to my Gmail account?
- Yes. Disponed connects through Google's official OAuth sign-in, never sees your Google password, reads only email metadata (never message bodies), and checks its protection rules twice before deleting anything.
- Does Disponed ever see or store my Google password?
- No. You sign in entirely on Google's own page. Disponed receives an OAuth token proving you approved access — it never receives, sees, or stores your password.
- Why does Disponed request full Gmail access (https://mail.google.com/) instead of a limited scope?
- Because permanent deletion (the Gmail API's messages.batchDelete) isn't available under the narrower gmail.modify scope, which can only move mail to Trash. Google doesn't offer a scope that supports permanent delete without also granting full Gmail access.
- Does Disponed read the content of my emails?
- No. Disponed only reads message metadata — sender address, labels, size, and thread ID — to build counts. It never fetches, reads, or stores the subject line or body text of any email.
- What data does Disponed store about my mailbox?
- Disponed stores counts, such as how many promotional emails exist or how much storage a cleanup would free. It does not store the content of any message, in any form.
- How does Disponed make sure it doesn't delete the wrong email?
- Every cleanup is checked twice. Protected mail is excluded when the Gmail search query is first built, then each message is checked again individually right before deletion. The second check is authoritative and holds even if a search operator behaves unexpectedly.
- How do I revoke Disponed's access to my Gmail account?
- Go to https://myaccount.google.com/permissions, find Disponed, and click Remove access. You can also disconnect it from within the Disponed app itself.
- If I revoke access, does Disponed still have my mailbox data?
- No email content was ever stored in the first place — only counts. Revoking access on Google's side immediately stops Disponed's ability to reach your Gmail account going forward.
Sources
Sign in with Google, scan your mailbox for free, then clean it in one click.
Clean your Gmail inbox nowUpdated: 2026-07-29