Privacy & Data

Is Unroll.Me safe? (2026)

October 23, 2026

10 min read

Copy Link

Quick answer. Unroll.Me is safe in the sense most people mean: it is a long-running, legitimate service, and its well-known scandal was never a hack. It is not private. Unroll.Me is owned by NielsenIQ, and its privacy notice says it collects copies of the commercial emails you receive and provides data about them to customers that include data brokers. If you are fine with that trade, it works. If you are not, delete the account and revoke its mailbox access, in that order.

Last updated October 2026.

Safe from whom?

When people type "is Unroll.Me safe" into a search bar, they usually mean something like: will this app leak my email, or let a stranger into it? That is a fair worry for anything you connect to your inbox. It is also the easier half of the question.

The harder half is what we call the on-purpose question. Forget what an attacker could do with your data. What does the company do with it deliberately, every day, as the way it pays its bills? A tool can be perfectly secure and still be built to collect what you hand it. Those two things are not in tension. Plenty of the most profitable data businesses on the internet are very good at security, because the data is the asset they are protecting.

We came to Yorba from the marketing side of the industry, so we tend to read a free product the way a restaurant critic reads a menu with no prices on it. Somebody is paying for the meal. With Unroll.Me, the answer is written down, and it is worth reading slowly.

What Unroll.Me does with your inbox today

Unroll.Me costs nothing, and its own site explains why. Its data page says the service is owned by NielsenIQ, which it describes as an e-commerce measurement and consumer data company. NielsenIQ's job is telling brands, retailers and investors what people buy. An inbox full of order confirmations is a very good place to find that out.

The privacy notice, in force since spring 2025, spells out the arrangement. Unroll.Me collects copies of, and information from, the commercial emails you receive. It may pass data about those emails, along with some of your demographic details, to customers it lists as e-commerce businesses, investment companies, consumer brands, media companies and data brokers. Under its US section, it says it may "sell" or "share" some personal information in the legal sense of those words. It also promises that your directly identifiable information will never go to those customers to target you or sell to you.

Put plainly, your purchases become part of a measurement panel, and your name stays behind. That is the product working as designed. It is not a breach, a loophole or a secret.

One technical detail matters here. To find your newsletters, an inbox cleaner needs permission to read your mailbox, and Gmail does not offer a permission that covers only newsletters. Google treats broad mailbox access as a restricted scope, which means apps that handle it on their own servers must pass verification and an annual security assessment. That is a real safeguard against sloppy security. It says nothing about what a company is allowed to do with data it collects lawfully and discloses in its policy.

Why people still ask: 2017 and the FTC

The reason this question has a search volume at all is April 2017. A New York Times profile of Uber's then-CEO revealed that Slice Intelligence, Unroll.Me's parent at the time, had been pulling Lyft receipts out of users' inboxes and selling the anonymized data to Uber. People had connected Unroll.Me to clear out newsletters. They found out they had been feeding a competitor's market research.

Notice what kind of story that was. Nobody broke in. The data went exactly where the business model sent it.

The FTC followed. Its complaint, filed in August 2019, did not object to the data business itself. It objected to what Unroll.Me told people while they were deciding whether to connect, including a promise that it would not touch their personal stuff. The settlement, finalised in December 2019, carried no fine. It bars Unroll.Me from misrepresenting how it handles email, required notice to affected users, and required deletion of stored receipts from people who signed up before June 2017 unless they consented to keep them. The order runs for 20 years, so it still applies.

Ownership moved on twice after that. Slice became Rakuten Intelligence, and NielsenIQ bought Rakuten Intelligence in 2021, naming Unroll.Me as one of the sources for its consumer panel. We have written the full history, with every filing and date, in our Unroll.Me alternatives guide. The short version is that the disclosure changed and the trade did not.

What is genuinely fine about it

We make a competing product, so it would be easy to stop here. We would rather give you the parts that hold up, because they are real.

The biggest one is that the terms are honest now. In 2017 the problem was a reassuring line at signup that did not match what happened next. Today the data arrangement sits in the privacy notice in plain language, and the FTC order gives Unroll.Me a strong legal reason to keep it that way until 2039.

You can also switch the panel off without leaving. Unroll.Me's help centre documents an opt-out from its measurement panel and says new collection from your mailbox stops as soon as you use it. Anything collected before then stays, anonymized and flagged, and only deleting the account removes it. Most people never find this setting. If you like the tool and dislike the trade, it is the first thing to look for.

And the product itself works. The daily Rollup digest is a good idea, and it connects to Gmail, Outlook, Yahoo, AOL and iCloud without costing you a cent.

One practical catch for some readers: Unroll.Me has not been available in the EU or the European Economic Area since GDPR took effect in 2018. If you are reading this from Europe, the safety question is already settled for you.

Should you keep using it?

Run the on-purpose question on yourself. Imagine every order confirmation in your inbox for the last few years, minus your name, sitting in a dataset that brands and investors pay to read. If that leaves you indifferent, Unroll.Me is a reasonable free tool, and the panel opt-out is there if you change your mind. If it bothers you, nothing about the security of the service fixes that, because the collection is the point.

If you decide to leave, it takes two steps, and the order matters.

Delete the account first. On the web, click your email address in the top right, open Settings and choose Delete My Account at the bottom. In the app, tap your profile, open Mailboxes, pick the account, then My Account and Delete Account. If you cannot log in, Unroll.Me has a standalone deletion page that verifies you with a six-digit code. Deleting is what removes the data already collected. Opting out of the panel alone does not.
Then cut off mailbox access at your provider. Deleting an account inside an app does not always revoke the permission you gave it. For Google, open your Google Account, go to Security and remove Unroll.Me from third-party apps with account access. For Microsoft, go to account.microsoft.com, open Privacy and revoke it under apps and services that can access your data. For iCloud, remove the Unroll.Me app-specific password under Sign-In and Security at appleid.apple.com.

Be realistic about what this does. It stops anything new from being collected and removes what Unroll.Me holds. It cannot pull back figures that already went into aggregated reports, since by then they are statistics rather than your records. That is the honest case for doing it now rather than next year.

Where Yorba fits, and the question you should ask us

We ask for mailbox access too, so the on-purpose question applies to us as much as anyone. Here is our answer. Yorba reads email headers to find the signup confirmations and automated messages that show an account exists, and we do not store message content. Our data storage page covers the details. Our privacy policy says we will never sell your data to a third party.

The business model is the part you can check without trusting us. Yorba is a Public Benefit Corporation with no venture funding. The free plan covers one inbox, unlimited unsubscribes, a breach check and deletion instructions. Premium is $6 a month or $60 a year, and that subscription is how we pay for the service. When a company charges you money, you can see what it is selling. When it charges nothing, the answer is somewhere in the privacy policy.

We are also built for a different job. Unroll.Me manages the mail. Yorba goes after the accounts sending it, including the ones you forgot you made, and helps you close them. An unsubscribe leaves the account and your saved card exactly where they were. If you want the full picture of what closing an account actually does, we wrote about what happens when you delete an online account.

The honest limits: Yorba connects Google and Microsoft mailboxes only, so Yahoo, AOL and iCloud users are better served elsewhere. And if a tidy daily digest is all you want, we are more tool than you need.

Frequently asked questions

Is Unroll.Me safe to use in 2026? It is a legitimate service, and its past problems came from its business model rather than a security failure. It is not private: its privacy notice says data about your commercial emails goes to customers that include data brokers, with your name removed.

Does Unroll.Me sell your data? Its privacy notice says it may "sell" or "share" some personal information as US law defines those terms, and that it provides data about your commercial emails to paying customers. It also says your directly identifiable information will never be sold to target you.

Who owns Unroll.Me? NielsenIQ, the consumer data and measurement company, which acquired Unroll.Me's former parent, Rakuten Intelligence, in 2021.

Can Unroll.Me read my personal emails? To work, it needs permission to read your mailbox, and Gmail has no permission limited to newsletters. Its privacy notice describes collecting commercial email, such as receipts and promotions, rather than personal messages.

Can I use Unroll.Me without joining its data panel? Yes. Its help centre documents an opt-out that stops new collection immediately. Data gathered before you opted out stays until you delete the account.

Does deleting my Unroll.Me account remove its access to my email? Not necessarily. Delete the account, then revoke Unroll.Me's access in your Google, Microsoft or Apple account settings.

Did the FTC fine Unroll.Me? No. The 2019 settlement had no monetary penalty. It bars Unroll.Me from misrepresenting how it handles email and runs for 20 years.

Is Unroll.Me available in Europe? No. It has been unavailable in the EU and the European Economic Area since 2018.