> ## Content Index
> Fetch the complete content index at: https://www.petercai.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Automating my personal inbox policy
- URL: https://www.petercai.com/automating-my-personal-inbox-policy/
- Published: 2024-06-13T12:00:00.000Z
- Updated: 2024-06-13T12:00:00.000Z
- Description: In which I build a system to automatically enforce my inbox policies. Introducing mailman.petercai.com
- Author: Peter Cai
- Tags: #Import 2026-08-11 22:26

I have a strict personal policy of never reading legalese updates in my email inbox\[1\], since they don't provide information I intend to use or act on. Even an ironclad "privacy policy" or "terms of service" is useless if there's ever a security breach; hackers don't have a privacy policy I can opt out of. So I have no choice but to assume that my data might get compromised or misused at any time at every service provider I interact with anyway \[2\].

Naturally, I figured it'd be a fun side project to automate this policy using a large language model. So I spent two weeks hacking together a Ruby on Rails app that 1) scans the subject line of every inbound email I receive via the Gmail API, 2) evaluates if it's terms-of-service or privacy related, and 3) deletes the email. I recognize this is probably very niche, but overall I'm delighted with the more focused inbox I have as a result.

![Mailman screenshot](https://www.petercai.com/assets/images/mailman-log.webp)

A typical sample of emails I never have to see in my inbox again.

You can try this for yourself at [mailman.petercai.com](https://mailman.petercai.com/?ref=petercai.com). It has some customization options so you can configure it to suit your own preferences. I can't promise I won't be forced to send you a privacy policy or TOS update someday, but luckily for you it will happily filter its own legalese emails.

## Getting the Google seal of approval

If I don't submit my app for review by Google, then a big scary warning dialog will appear when you try to use it:

![Google verification warning](https://www.petercai.com/assets/images/unverified-app.webp)

This makes sense, since Gmail's API requires I ask for very broad permissions to modify your inbox (for example, if I want to archive or delete an email, I'm forced to ask for a permission that also lets me send emails from your account, even though I don't need that and won't use it).

Here's a summary timeline of my development and review process:

- November 22, 2023: Initial commit
- December 2: Everything is working end-to-end and deployed
- December 6: Add a couple bugfixes and make a proper homepage
- December 27: Polish, submit to Google for review
- December 27: Google: Reply to confirm you are not doing one of these 4 idiotic things, none of which require review.
- December 27: Me: I confirm I am not an idiot.
- December 28: Google: Your privacy policy does not adequately describe the way your application accesses Google user data. Also, we need a demo video to understand your app's functionality. Also, we need a test account authorized to understand how you use the scopes in question.
- January 6, 2024: Me: I've made the requested privacy policy changes, uploaded the requested video, and authorized the requested Google user to test the app.
- January 8: Google: We don't understand your video, please provide screenshots and explanation of what the app is doing.
- January 13: Me: Here is an example user flow with screenshots describing how the app works.
- January 16: Google: We tested your app and it doesn't work as described. Please fix.
- January 17: Me: I don't understand. Can you describe the expected vs actual behavior?
- January 18: Google: \[screenshots of a mailbox that should end up in a particular state, but is in a different state\]
- January 18: Me: I see what you are describing in my logs, but the logs say everything worked perfectly. Is this inbox shared with anyone else?
- January 19: Google: OK let's move on! We recommend you add a privacy disclosure that clearly calls out the app complies with the Google API Services Data Policy.
- January 20: Me: The disclosure has been added to the privacy statement.
- January 22: Google: OK great! So we also require any app that stores data or shares it with external parties to meet the following additional consent and disclosure requirements: \[description of required disclosure content\]. Please show this in a video.
- January 22: Me: OK - here is a video demonstrating how the app clearly describes the data it shares and how it acquires explicit user consent.
- January 23: Google: OK we have completed initial review, now you need to complete TIER 2 CASA security assessment. They'll automatically share their results with us.
- April 15: App passes CASA review after several months of back-and-forth. No application changes were required.
- May 16: Me: My review was completed a few weeks ago, do you still need anything from me?
- May 21: Google: Oh hey! It looks like you need to address some issues we found: 1) Your privacy policy does not specify any data protection mechanisms. 2) Based on the information you provided, we believe the following scope(s) may be a better fit for your use case: \[nonsensical scopes\]
- May 22: Me: The privacy policy has been updated with the requested information. Scopes: the suggested scopes do not work: I'm applying labels to messages, not creating labels. The scopes you are suggesting make no sense for that use case (I wouldn't use them at all) and simultaneously wouldn't let me apply labels.
- May 27: Google: Since you updated your privacy policy, we need you to resubmit the app even though nothing about it (including the privacy policy URL) has changed.
- May 28: Me: OK I have resubmitted the app.
- May 30: Google: Oh hey! It looks like you need to address some issues we found: 1) Based on the information you provided, we believe the following scope(s) may be a better fit for your use case: \[nonsensical scopes\]
- June 4: Google: Thank you for your patience. We've approved your OAuth App Verification request.

May 30: Me:  

![](https://www.petercai.com/assets/images/as-per-my-last-email.webp)

I have experience leading teams through both Apple and Shopify app store approval, but Google was decidedly the most action.
  
  
\[1\] It's not because I don't care about privacy or legal rights; it's just that there is zero probability I will change my behavior in response to an automatic legal update in my inbox. Often, I use a service in spite of a privacy policy or terms of service I might otherwise find objectionable because it represents the best tradeoffs available to me, was chosen by a counterparty where I don't have a choice in the matter (employer, client, service provider, customer, etc). In every imaginable situation the decision-making has already happened way upstream, and in the rare cases where it really is my decision, I care far more about the holistic picture of who I'm entering into an agreement with, rather than the actual text of the legal document in front of me - after all, there's no way to provably verify my counterparty won't unilaterally contravene their own legalese, so without trust there's nothing to go off anyway.  
\[2\] Unless it has some verifiable security guarantees like end-to-end encryption, but most services don't do this because it's super inconvenient and limits a lot of use cases.