Inbox Zero
An open-source AI email assistant that connects to Gmail or Outlook and works alongside the client you already use. It labels incoming mail automatically, drafts replies in your own voice, blocks cold outreach and unsubscribes from newsletters in bulk.
What is Inbox Zero?
Inbox Zero is an AI assistant that attaches to a mailbox you already own rather than replacing it. It connects over OAuth to Gmail, Google Workspace, Microsoft Outlook, Microsoft 365 or Exchange, and from there works alongside whatever client you normally open. The vendor is blunt on the point: it is not an email client, and you keep using Google or Outlook exactly as before.
Four jobs sit at the centre. The assistant labels every incoming message, using a default set of categories, Newsletter, To Reply, Marketing, Calendar, Notification, Cold Email, Team and Urgent, which you can keep or replace with your own. It writes a reply draft for each message that calls for one, built from your past correspondence and your calendar so that both the wording and the availability it quotes are yours. It surfaces the newsletters you never open so you can unsubscribe and archive them in one pass. And it blocks cold outreach before it competes for attention. Around those four sit email analytics on volume, senders and response times, meeting briefings assembled ahead of a call, calendar availability and booking links, and automatic filing of attachments into Google Drive or OneDrive.
Configuration is deliberately unremarkable: rules are written in plain English rather than assembled in a technical builder. Access is spread wide, with a web app, iOS and Android apps, a Mac and Windows desktop app, the Inbox Zero Tabs Chrome extension, and assistant chat inside Slack and Telegram, with Microsoft Teams announced. Developers get a version 1 API covering statistics and automation rules, published with an OpenAPI specification, plus an npm command-line wrapper aimed at coding agents.
What sets the product apart commercially is that the code is public. The repository sits on GitHub, the project reached the top of GitHub Trending and Product Hunt, and the whole thing can be self-hosted. The hosted service carries SOC 2 Type 2 and CASA Tier 2, has been verified by a designated third-party auditor for Google, publishes a dated list of its eighteen subprocessors, and forbids its AI providers from training on customer data. It is published by Inbox Zero Inc., a very small Delaware company, and claims more than 20,000 professional users.
What it does
- Label and sort every incoming email automatically
- Write a reply draft in your own voice for each message that needs one
- Unsubscribe from newsletters you never open and archive them in bulk
- Block cold outreach before it reaches the inbox
- Report on inbox volume, top senders and response times
- Prepare a briefing ahead of a meeting from your calendar and email history
- File email attachments automatically into Google Drive or OneDrive
When to use Inbox Zero / When not to
A quick filter to help you decide if Inbox Zero is the right fit.
When to use Inbox Zero
- Founders and executives who receive far more email in a day than they can reasonably handle by hand
- Small business owners and solo operators with no assistant to triage the inbox for them
- Client-facing professionals in law firms, accounting practices, real estate and property management, where email is the main channel
- Customer support and e-commerce teams that need consistent triage and organisation-wide email analytics
- Technically minded users who want to read the code, contribute to it, or self-host the assistant on their own infrastructure
When not to use Inbox Zero
- Anyone whose mailbox is not on Gmail, Google Workspace, Outlook, Microsoft 365 or Exchange: no other provider is supported, and generic IMAP is not an option
- People looking to replace their email client, since Inbox Zero deliberately sits on top of one rather than standing in for it
- Users who need a permanently free tier, as the hosted service offers only a seven-day trial and asks for a payment card up front
- Teams that need the interface in a language other than English
- Anyone whose main requirement is a built-in meeting notetaker, which the vendor openly states it does not provide
How to use Inbox Zero
A typical end-to-end flow, from setup to results.
- Sign up and start the seven-day trial, which requires a payment card but charges nothing until it ends
- Connect your Google or Microsoft mailbox through OAuth, a step the vendor advertises as two clicks
- Let the smart categories install themselves, then keep them or define your own
- Review the pre-written drafts waiting on the messages that need a reply, and send once you agree with them
- Write your automation rules in plain English rather than in a rule builder
- Test each new rule against recent messages and check Assistant then History before relying on it
- Grant calendar and Drive permissions only when you turn on the features that need them
- Confirm high-impact actions when prompted, meaning sending, or automations that can communicate outside your mailbox
- Run a bulk unsubscribe pass on the newsletters you never open, preferring labels and archiving to deletion while you are still testing
- Extend the setup if useful: Slack, Telegram, mobile, desktop, the Chrome extension, or the version 1 API and its npm CLI
Pros & Cons
Pros
- Sits on top of the mailbox you already have, so there is no migration and no new client to learn
- Open source and self-hostable, which is unusual in this market and lets you audit exactly what the code does
- Documented security posture: SOC 2 Type 2, CASA Tier 2, third-party Google verification and a public trust centre listing 37 monitored controls
- A dated, named list of eighteen subprocessors is published, and message bodies are not stored permanently
- No model training on customer data, imposed contractually on the AI providers, which operate under a zero-retention arrangement
- Automation rules are written in plain English instead of assembled in a technical builder
- Accommodating commercial terms: seven-day trial on every plan, prorated plan changes, refund on request within 14 days, and up to 20% off annually
Cons
- No permanent free plan on the hosted service, and a payment card is required before the trial starts
- Limited to Gmail and Google Workspace on one side, Outlook, Microsoft 365 and Exchange on the other, with no generic IMAP
- English-only interface
- Context integrations are in Early Access and require at least the Plus plan, while the Microsoft Teams integration is still announced as coming soon
- No built-in meeting notetaker, a gap the vendor acknowledges in its own comparison
- Support runs through a single email address, with no form, no chat and no support knowledge base
- The terms of service still carry a 2023 date while the privacy policy was refreshed in 2026, and the company reports a single employee
Pricing & Plans
There is no permanent free plan on the hosted service. The lowest paid entry point is the Starter plan at USD 20.00 per user per month, and every plan opens with a seven-day free trial that requires a payment card, with no charge until the trial ends. Annual billing is advertised at up to 20% off. The open-source build can be self-hosted at no licence cost, the user bearing their own infrastructure and AI provider fees.
- automatic sorting and labelling
- drafts in your voice
- cold email blocking
- bulk unsubscribe and archive
- email analytics
- pre-meeting briefings and a limited knowledge base
- everything in Starter
- plus two email accounts per user
- Slack integration
- app integrations
- email digests
- automatic attachment filing and an unlimited knowledge base
- everything in Plus
- plus team-wide analytics
- priority support and a dedicated onboarding manager
- SSO
- SCIM
- on-premise deployment and a dedicated account manager
- the open-source code base deployed on your own infrastructure
Data, GDPR & hosting
A consolidated view of how Inbox Zero handles your data.
GDPR overview
GDPR is addressed explicitly, although the site never writes the words "GDPR compliant". The privacy policy dated 4 May 2026 assigns roles under the regulation, controller for account data and processor for mailbox content, states the legal bases relied on, and lists the rights of access, rectification, erasure, objection, restriction and portability with a one-month response commitment. Transfers outside the EEA rest either on Standard Contractual Clauses approved by the European Commission or on the providers' membership of the EU-US Data Privacy Framework. A dated, named list of subprocessors is published and a data processing agreement is referenced as an available contractual framework. Two gaps deserve mention: no Article 27 EU representative is designated, and no data protection officer is named.
Who owns the data?
Inbox Zero splits its role in two. For account data, meaning identity, authentication tokens and usage patterns, it acts as data controller. For everything inside the mailbox, meaning message content, sender and recipient details and calendar data, it acts as data processor on your behalf, which leaves you or your employer as the controller. Email content is analysed to deliver the features you switch on but is not kept beyond what those features require: message bodies and subject lines are not stored permanently, whereas sender addresses, summaries of your history and rule metadata are. Because the code is open source, self-hosting keeps the whole chain on infrastructure you control.
Reuse rights
The policy is written from the vendor's side and grants the end user no special right to reuse data held by Inbox Zero. What it grants instead is control: access, correction, erasure, restriction, portability and the right to object, with a stated one-month response time. Mailbox content remains yours. Inbox Zero processes it on your instructions as a processor, sends the parts needed to third-party AI providers so that labels and drafts can be generated, and contractually forbids those providers from training on it. Aggregated, de-identified data may be used and shared by the vendor for its own business purposes, provided it cannot identify you. Self-hosting the open-source build removes the vendor from the loop altogether.
Data retention & training
Hosting summary
No datacentre location is named. What the privacy policy does say is that personal data may be transferred to and processed in the United States, or in other countries where the vendor's service providers operate, and that those providers may be based in the US or elsewhere outside the EEA. The named infrastructure subprocessors point the same way: Vercel for application hosting, Neon for the database, Upstash, Cloudflare for network and security, and Amazon Web Services. Transfers out of the EEA rely either on Standard Contractual Clauses approved by the European Commission or on the providers' membership of the EU-US Data Privacy Framework. The domain's resolved IP address is an anycast node on Amazon's network, which describes the delivery path rather than where data comes to rest. Self-hosting the open-source build is the only way to choose the region yourself.
Things to keep in mind
Risks and trade-offs to weigh before adopting Inbox Zero.
- The assistant needs read and write access to your mailbox: it can read messages, send on your behalf, and reorganise labels and folders
- Rules run automatically once enabled and a rule can match a message you never intended, so test each one on recent mail and read its history before relying on it
- Drafts can omit context or rest on an unsupported assumption, something the vendor states plainly; every draft still deserves a human read before it goes out
- Message content leaves for third-party AI providers, among them OpenAI, Anthropic, Google Vertex AI, AWS Bedrock and Groq, routed through OpenRouter where configured
- The sensitive-data policy that redacts or blocks credentials and card numbers is a setting to switch on, not a default protection
- Leaning on pre-written drafts can quietly erode the habit of composing a difficult reply yourself; the tool is at its best on routine mail, not on the message that matters most
- Deleting your Inbox Zero account is a separate act from revoking Google or Microsoft access, and skipping the second leaves the authorisation alive
Setup & Integrations
Technical difficulty
Low for the hosted service. You connect a Google or Microsoft mailbox over OAuth, a step the vendor advertises as two clicks, the smart categories configure themselves, and rules are written in plain English rather than in a builder; one customer reports a working bulk unsubscribe within three minutes. Self-hosting is a different exercise altogether: a Vercel deployment, a Neon database, Upstash, Google OAuth credentials and environment variables such as API_KEY_SALT, generated with openssl. Using the API means creating a key in the settings and choosing its scopes and expiry.
Deployment
Apps stores
Integrations
Supported languages
Behind Inbox Zero
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Inbox Zero.
Frequently asked questions
Which mailboxes does Inbox Zero work with?
Does it replace my email client?
Is there a free plan?
Are my emails used to train AI models?
Is my email content stored?
Which security certifications does the hosted service hold?
Is there an API?
Are there apps beyond the web?
How do I get help, and can I get a refund?
Are there any discounts?
Should you pick Inbox Zero?
Inbox Zero occupies a clear and defensible position: it is a layer, not a replacement. You keep Gmail or Outlook, and the assistant takes over the routine work around them, sorting, drafting, unsubscribing and blocking. For anyone whose day is eaten by volume rather than by difficulty, that is exactly the right dividing line, and the plain-English rule configuration keeps the setup within reach of non-technical users.
What genuinely distinguishes it is the open-source code base. In a market of closed products, being able to read what the software does with your mailbox, contribute to it, or run it on your own infrastructure is a real argument, and it is reinforced by a documented security posture: SOC 2 Type 2, CASA Tier 2, a public trust centre, a dated list of eighteen named subprocessors, and a contractual ban on AI providers training on customer data.
The reservations are equally concrete. There is no permanent free plan on the hosted service and a card is required before the trial starts. Only Google and Microsoft mailboxes are supported. The interface exists in English alone. Support is a single email address. The publisher is a very small Delaware company reporting one employee, its terms of service still carry a 2023 date against a 2026 privacy policy, and no EU representative is designated despite European users.
Before connecting a mailbox, weigh what the access actually covers: reading, sending, and reorganising labels on your behalf, with message content travelling to third-party AI providers. Test rules on recent mail, read the history before trusting them, and remember that the sensitive-data filter is a setting rather than a default. At USD 20 per user per month, the trade-off is a fair one for an inbox that has stopped being manageable by hand.
- Choosing a selection results in a full page refresh.
- Opens in a new window.