Paperweight scans your inbox to inventory the accounts you forgot you had

The premise, and why the inbox is the right place to look

Paperweight's own summary of the problem is the clearest statement of the idea: your inbox knows where your data lives.

Every account you create, every service you sign up for, every online purchase is connected to your email address. Most people have 100 or more accounts they have forgotten about, creating security risks and privacy exposure.

The approach follows from that premise. If every account leaves a trace in your inbox, then the inbox is a complete index of your digital footprint, and reading it is cheaper and more thorough than trying to remember what you signed up for.

The product description is that Paperweight scans your inbox to map your digital footprint, then helps you take back control and delete your data. The tagline is that it is local-first and open source, with your data staying on your computer.

The quick start makes the effort involved clear. You download the latest release for your platform, connect your email, scan your inbox in about two minutes, then review your footprint and use Pro to unsubscribe and delete emails.

Two minutes is a meaningful claim and it comes from the fact that the app only needs to read message metadata and a slice of each message rather than synchronising everything. The project is TypeScript and Electron, MIT licensed, with the site at paperweight.email, and the release history shows v1.0.0 from 2026-09-30 after v0.8.0 and v0.7.1.

What the free tier gives you and what it does not

The licensing section of the README is unusually explicit, and it determines what the tool can actually do for you.

The framing is that you can discover, inspect and curate your digital footprint for free, and that you upgrade to Pro to execute cleanup and support open-source development.

The Free tier covers one email account, full-history sync, account and mailing-list discovery, breach and personal-data overviews, and local curation.

The two paid options are different in kind. The Cleanup Pass is full Pro access for 30 days of focused cleanup, described as one payment with no renewal and community support on GitHub. Paperweight Pro is the ongoing version, maintaining your privacy all year with email support included.

Both paid plans enable unsubscribe, trash, spam and bulk cleanup actions, privacy requests and follow-ups, multiple email accounts, and MCP access. Card and manual crypto payments are available for both.

That split is the honest shape of the product. Discovery is the part that works entirely on your machine and needs no permission from anyone else, so it is free. Deletion requires sending requests to third parties and sometimes clicking things, which is where the operational cost and the legal correspondence live, and that is what the paid tier covers.

MCP access is worth a second look. The package.json has an mcp script that runs the app with PAPERWEIGHT_MCP set, which suggests the footprint data can be exposed to an agent rather than only read by a person.

Which providers it can read

The email provider support is broader than the marketing suggests, and the list is worth reading before you commit.

Custom IMAP is supported, along with Google and Gmail, Microsoft, Apple, and Proton Mail via Bridge.

There is also a list of IMAP presets for Proton, Yahoo Mail, Fastmail, Yandex, Zoho, Mailbox.org, Posteo and GMX.

The custom IMAP route is the escape hatch that makes the provider list less important than it looks, since it covers any provider with a standard IMAP endpoint. The presets are conveniences for the common configuration of each host.

The features list is short and each item maps to a concrete capability. Marketing and bulk unsubscribe finds an unsubscribe from marketing and bulk mailing lists in minutes. Account inventory discovers which vendors and services have your data. Breach alerts tell you when companies you use get breached, via haveibeenpwned.com. GDPR deletion support generates data deletion requests to reduce exposure. Password tools give a secure password generator and a strength indicator.

And there is an account request feature, which allows users to request accounts via a web form, so Paperweight is not only a scanner for what exists but a place where new accounts can be requested.

The privacy claim is specific rather than absolute. The feature list says local-first with your emails and settings staying on your machine, and privacy-respecting with no data sent to external servers, and open development with the source code available for audit.

Building it from source, and the OAuth credentials problem

The development section contains one piece of information that will save you an afternoon if you skip it.

Released binaries ship with OAuth credentials configured. Building from source needs your own.

yarn
cp .env.example .env   # then fill in the three IDs below
yarn dev

OAuth values are baked in at build time, through electron.vite.config.ts. Empty .env values compile to empty strings and auth fails at runtime.

That last sentence is the trap. The failure is not a build error, it is an authentication failure at runtime, because the build succeeds with empty strings and the OAuth flow only breaks when you try to use it. The three variables are all in .env.example, which is a short file with GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and MICROSOFT_CLIENT_ID.

The provider setup steps are given per provider. For Google you create OAuth 2.0 credentials of application type Desktop app, enable the Gmail API, add the scope https://www.googleapis.com/auth/gmail.modify on the consent screen, and add yourself as a test user while the app is in testing mode.

For Microsoft you register an app with supported account types Personal plus work and school, add Mobile and desktop applications with redirect URI http://localhost, and request Microsoft Graph delegated permissions for User.Read, Mail.ReadWrite, Mail.Send, offline_access, openid and profile. Only MICROSOFT_CLIENT_ID is needed, with no secret, because the flow uses PKCE.

IMAP accounts need no OAuth environment variables at all.

How the analysis works, and the lexicons

The contributing section explains how the analysis engine actually works, and it is a better description of the tool than the feature list.

Paperweight's analysis engine classifies mail, into categories such as purchases, updates and promotions, and finds unsubscribe links using per-language phrase lexicons. English and Dutch are curated. Other languages need native speakers.

That last sentence is the practical limit on the tool, and the README is direct about it: adding or improving a language is a single-file data contribution, with no engine knowledge required, and the rules live in analysis/src/data/lexicons/README.md.

So the classification is phrase-based rather than model-based. A lexicon of phrases in a language identifies the mails that say this is a purchase or this is an account update, and a separate set finds the unsubscribe links. That is a simpler and more auditable design than a classifier, and it has an obvious failure mode: a lexicon that does not cover your provider's phrasing will under-detect, and a detection you cannot explain is harder to trust when you are about to act on it by unsubscribing or requesting deletion.

That is why the language coverage is worth checking before you act on the results. The repository root shows the workspace layout, with analysis/ as a separate package alongside src/ for the Electron app and website/ for the marketing site, plus data/, scripts/, test/, screenshots/ and build/.

The build tooling, and what it says about the project

The package.json scripts reveal a fair amount about how this project is put together.

The postinstall step runs yarn --cwd analysis install and then electron-rebuild -f -w better-sqlite3, which is the standard fix for a native Node module that has to be rebuilt against Electron's ABI rather than Node's.

The data preparation is the interesting part. There are separate scripts for building the companies database, the breaches database and the enforcement database, plus one for generating breach content, and each runs the build script under Electron with ELECTRON_RUN_AS_NODE=1 and tsx imported, so the same tooling runs inside and outside the Electron runtime. The prebuild step runs the companies and breaches builds before the main build, which means the data files are generated artefacts rather than committed content.

That is a substantial data pipeline, and it lines up with the features. The company database is what powers the account inventory, since a mail from a known vendor can be attributed to that vendor. The breaches database is what powers the haveibeenpwned alerts. The enforcement database is the piece to look at if you want to understand how a deletion request gets routed, since it is what maps a company to the mechanism by which you can ask them to delete your data.

The distribution scripts build for mac, linux and win, each running electron-rebuild for better-sqlite3 first, then the build, then electron-builder with publish never. There are separate typecheck scripts for the node and web tsconfigs, and a scripts:stats script that runs scripts/release-stats.ts.

The repository also carries both a pnpm-lock.yaml and a yarn.lock, a pnpm-workspace.yaml, jest.config.js and three tsconfig files splitting node, web and the shared base.

Where Paperweight is the wrong choice

Four cases argue against it.

The first is if you want the deletion for free. Discovery is free and complete, but the actions that actually remove data, unsubscribe, trash, spam cleanup, privacy requests and follow-ups, are all in the paid tiers. A user who wants to act on the results pays for the acting.

The second is if your mail is in a language the lexicons do not cover. The classification and the unsubscribe detection both depend on per-language phrase lexicons, and only English and Dutch are curated. In an unsupported language you get a partial map of your footprint, and a partial map is the dangerous kind, because it looks complete.

The third is a shared or work mailbox with a compliance role. This is a tool that deletes mail, trashes mail, sends deletion requests to third parties and can request multiple accounts. On a mailbox covered by a retention policy, or one where you are not the person authorised to unsubscribe, the bulk cleanup actions are a liability.

The alternative in the same direction is a data broker or a breach monitoring service, which map your footprint from external records rather than from your mail. The difference in approach is that those services know about accounts you never received a confirmation email for, and about breaches at companies you have already deleted from, while Paperweight's evidence is the mail you actually received, which makes it more accurate about what is still there and blind to what was removed. Paperweight is also local, so nothing about your footprint leaves the machine, at the price of you having to grant it access to a live mailbox.

Editorial conclusion

Paperweight fits someone who wants to know what they have signed up for and wants that knowledge to stay on their own machine, since the analysis and the mail data never leave the computer. It does not fit a user who expects the deletion itself to be free, because the free tier stops at discovery and the cleanup actions are paid. Download the latest release for your platform, connect one account and let the first sync finish, and check whether your language has a curated lexicon before trusting the classification, since English and Dutch are the two the project maintains.

Frequently asked questions

Official sources

1. License: MIT
2. Project website
3. README
4. Releases
5. wslyvh/paperweight on GitHub