We never read your inbox.

Why most warmup tools need to read your inbox

A warmup tool works by exchanging emails between seed mailboxes — yours sends to theirs, theirs sends to yours, both sides mark messages as delivered and not spam. For that loop to close, the tool needs to read the incoming warmup emails landing in your inbox, move them out of spam if they arrived there, and reply or engage.

That requires read access. Full read access, in most cases — the same OAuth permission scope that lets an app see everything in your inbox, not just the messages it sent. Many warmup tools request this without explaining why, or bury the reason in documentation most customers never read.

For companies with confidential customer communications, financial data, or legal correspondence sitting in their sending domain’s inbox, that is not a hypothetical risk. It is an active one.

How InboxPlease works instead

InboxPlease’s seed network does not close the loop in your inbox. When you connect a domain to InboxPlease, we request a single OAuth permission: the ability to send email from your account. That is the only scope we request.

The seed mailboxes on the receiving side — the real customer inboxes that your warmup emails land in — belong to InboxPlease customers who have opted into the reputation pool. They manage their own inboxes. We do not touch yours.

The legal commitment

Our Terms of Service state this in two separate sections — one for Google accounts, one for Microsoft accounts — because both platform integrations are governed by their respective API data-use policies, and we are bound by both.

GTerms of Service §10 — Google User Data

“We do not access, read, store, or share your Gmail inbox contents, and we never use Gmail data for analytics, advertising, or any purpose beyond what is explicitly required for the requested feature.”

MTerms of Service §11 — Microsoft User Data

“We do not access, read, store, or share your Outlook inbox contents, and we never use Microsoft data for analytics, advertising, or any purpose beyond what is explicitly required for the requested feature.”

These are not policies we can quietly walk back. Violating them would breach our agreements with Google and Microsoft directly — agreements that govern our OAuth access to both platforms. If we broke this commitment, we would lose the ability to integrate with Gmail and Outlook entirely.

That is a structural constraint, not a voluntary pledge. It is what makes this commitment meaningful.

What to check with any warmup tool

Before connecting a domain to any warmup service, take 60 seconds to verify what permissions you are actually granting:

1. 01

   Check the OAuth permission screen

   When you authorize a Google or Microsoft integration, the consent screen lists exactly what the app can access. "Read all messages" or "Read and write all messages" means the tool can see your inbox. "Send email on your behalf" means it can only send.

2. 02

   Look for it in the Terms of Service

   A tool that does not read your inbox can say so in its ToS. If that commitment is not written down, the absence is the answer.

3. 03

   Revoke access any time

   You can review and remove any connected app from your Google account at myaccount.google.com/permissions, or from Microsoft at account.microsoft.com. This takes about 30 seconds and removes all access immediately.

4. 04

   Ask directly

   A warmup tool with nothing to hide about its permission model will answer straightforwardly. If the answer is evasive, treat that as information.

Your inbox contains your business. A warmup tool is a deliverability utility — it does not need to read it. If the tool you are using does, that is a choice they made, not a technical requirement.