Security

Last reviewed: July 21, 2026 · Markdown version

Zen Inbox Cleaner asks for access to something deeply personal — your inbox. This page explains, in plain language, how that access is protected: an independent security audit, Google's own verification process, and an architecture designed so your email never leaves your device.

Independently audited — CASA Tier 2

Zen Inbox Cleaner has completed the Cloud Application Security Assessment (CASA) — the independent security assessment framework created by the App Defense Alliance and required by Google for applications that access Gmail data through restricted API scopes. The Tier 2 assessment was performed by TAC Security, an independent security lab authorized by the App Defense Alliance.

Framework: App Defense Alliance ADA-CASA, based on the industry-standard OWASP Application Security Verification Standard (ASVS)
Performed by: TAC Security — an independent, ADA-authorized security lab
Assurance level: AL1 (Lab Tested — Lab Verified)
Result: Complete — every security requirement assessed received a PASS verdict
Certification ID: 72dbda45 · Issued July 13, 2026 · Valid through July 14, 2027

The assessment covers authentication, session management, access control, cryptography, data validation and sanitization, and secure configuration. And it is not a one-time exercise: to keep its Gmail access, the app must renew the assessment annually.

Verified through Google's OAuth review

Separately from CASA, the app has completed Google's own verification process for restricted Gmail scopes. Both its data access (exactly which permissions it requests, and what it does with the data) and its branding (that the app is who it says it is) have been reviewed and verified. This is the process behind the consent screen you see when you sign in with Google.

No servers to breach

The strongest security control in Zen Inbox Cleaner is architectural: there is nothing on our side to attack. The app operates no servers, databases, or cloud infrastructure that touch user data. Your device talks directly to Google's Gmail API over HTTPS (TLS 1.2 or higher), and all processing happens on-device. Your email data exists in exactly two places: your Google account and your own device.

Metadata only. The app reads email headers — sender, subject, date, and unsubscribe information. Email bodies and attachments are never read, stored, or transmitted.
No third-party tracking, analytics, or advertising SDKs — the app is completely ad-free.
Nothing is permanently deleted by the app. Cleaned emails move to Gmail Trash, where they remain recoverable for 30 days.

How data is protected on your device

On iOS, OAuth tokens are stored in the iOS Keychain, protected by hardware-backed encryption tied to the device's Secure Enclave and readable only by this app's signed bundle identifier.
On Android, OAuth tokens are stored in EncryptedSharedPreferences — values encrypted with AES-256-GCM and keys with AES-256-SIV, using a master key held in the Android Keystore.
Android cloud backup and device transfer are disabled, so local data never leaves the device through backups.
Production builds never log access tokens, refresh tokens, email bodies, subjects, or addresses.

Minimal permissions

The app requests exactly three Google OAuth scopes — the minimum for its features:

Read metadata & move to Trash — reads sender, subject, date, and unsubscribe headers, and moves emails to Trash only after your explicit confirmation. Also sends the standard one-click unsubscribe request when a sender supports it.
Manage cleanup filters — creates and removes the Gmail filters behind the optional auto-trash rules, never without a confirming tap.
Identify your account — fetches your account email address once at sign-in, so the app can show which account is connected and keep accounts cleanly separated.

No profile scopes are requested — the app cannot see your name or photo. The optional Zen Pro purchase is handled entirely by the App Store or Google Play and needs no additional Google permission. The exact scope strings and their use are documented in the Privacy Policy.

You stay in control

Sign out at any time — all local data and tokens are wiped instantly.
Settings → Delete Account & Data revokes the app's Gmail access with Google and wipes everything local.
You can also remove the app's access directly from your Google account at myaccount.google.com/permissions.

Report a security issue

If you believe you have found a security vulnerability in Zen Inbox Cleaner, email support@zeninboxcleaner.com with "security" in the subject line. We usually respond within 2 business days. Please never include email contents or passwords in your report.

For the complete picture of what data is accessed, stored, and deleted, read the Privacy Policy.