A sorter that never looks at content cannot sort. Privacy-minded inbox tools should say what they access, why, which APIs, and how you pull the plug—not hide behind slogans.
Questions worth asking
Does mail stay in Gmail? What Google scopes are requested? Is content sent to a model to classify or draft? Is there a mailbox archive on the vendor’s disk? Can you revoke Google access in one place?
Red flags
Claims of never reading mail while offering Act/Know/Noise. Selling content for ads. Required send/modify scopes for a read-only overlay. Fake certifications.
InboxSift’s actual practice
Emails remain in Gmail. We request gmail.readonly plus basic Google profile. The extension calls /api/inbox-sift/inbox, /thread, and /classify; OpenAI sees clipped payloads for labels and Briefing lines; Smart Reply uses generate APIs if you tap it. Tokens are stored so Inbox can load until you revoke. Local cache and contact prefs live in Chrome storage. PostHog may get usage events, not full bodies. Details: the Privacy Policy.
Frequently asked questions
- Do you sell my email?
- No. We do not sell, rent, or share email content for advertising.
- How do I revoke access?
- Google Account → Security → Third-party access, or uninstall the Chrome extension.
Sources & further reading
Published 2026-09-04. See also our full article library.