Every account you ever created is still out there somewhere: the forum you joined once, the shop you ordered from in 2019, the app you tried for a weekend and never opened again. Each one holds some piece of your data, and each one is a door you forgot you left open. Paperweight exists to find those doors and help you close them. It is a local-first, open source app that scans your inbox to map your digital footprint, then helps you unsubscribe, clean up, and request deletion, while keeping your personal data on your own machine.
Key Takeaways
Paperweight scans your inbox to build an inventory of the accounts and services that hold your data.
It is local-first: your emails and settings stay on your computer, and no data is sent to external servers.
It finds bulk unsubscribe links, flags breaches through Have I Been Pwned, and generates GDPR deletion requests.
It works with Gmail, Microsoft, Apple, Proton Mail via Bridge, and custom IMAP accounts.
Discovery and curation are free; cleanup actions such as unsubscribe and bulk deletion need a paid plan.
Your inbox already knows where your data lives
Paperweight starts from a simple observation, stated plainly in its README: your inbox knows where your data lives. Every sign-up confirmation, order receipt, and password reset is a receipt for an account, and most people have more than 100 accounts they have forgotten about. That is the project's own estimate, and it rings true for anyone who has searched their inbox for the word "welcome" and scrolled for a very long time.
The project lives at wslyvh/paperweight on GitHub, it is licensed under MIT, and it has gathered 547 GitHub stars, with 47 forks and 27 releases since its creation in January 2026. It is a desktop app, built with Electron, and the quick start is short: download the latest release for your platform, connect your email, scan your inbox in about 2 minutes, then review your footprint.
Watch the 30-second repo signal: Watch the 30-second repo signal.
What Paperweight finds
A scan produces an account inventory: the vendors and services that have your data, surfaced from the mail they sent you. From there, Paperweight groups what it finds into a few practical jobs.
Marketing and bulk unsubscribe. It finds unsubscribe links in marketing and bulk mailing lists, so you can stop the noise in minutes instead of hunting through each newsletter by hand.
Account discovery. It lists which services hold your data, including the ones you stopped using years ago, so the forgotten accounts stop being invisible.
Breach alerts. It checks the companies you use against breach data via Have I Been Pwned, so you learn when a service you actually use gets breached.
GDPR deletion support. It generates data deletion requests to reduce your exposure, turning "I should delete that account" into a request you can actually send.
Local curation. You review, sort, and curate the footprint yourself before anything is deleted, which matters when a scan turns up an account you still need.
That last point is the difference between a cleanup tool and a panic button. Paperweight is built for review first, action second.
Local-first is the whole point
Most tools that promise to clean up your digital life ask you to hand over your inbox to their cloud first, which is a strange trade: you give a new company full access to your mail so it can tell you which old companies have your data. Paperweight refuses that trade. Its README repeats the promise in several ways: local-first, your data stays on your computer, privacy-respecting by default, and no data sent to external servers.
That design also makes the project auditable in a way a closed service is not. The source is open, the development happens in public, and anyone can inspect how the analysis engine classifies mail. The engine sorts messages into purchases, updates, and promotions, and finds unsubscribe links using per-language phrase lexicons, with English and Dutch curated so far and other languages open to single-file contributions from native speakers.
There is one nuance worth stating precisely: breach checking uses the Have I Been Pwned breach list, checked locally, so your email address itself is never sent to a third party in the process, according to the project's own guide. The point of the design is that your emails themselves are not shipped to a server for analysis, not that the app never touches the internet at all. An independent review by ItsFOSS in September 2026 reached the same conclusion after tracking the app's network traffic: it only talked to the email providers' servers and the servers of services being modified.
Which email accounts it supports
Paperweight connects to the providers most people actually use, plus the escape hatch for everyone else.
Aspect | Detail |
|---|---|
Google and Gmail | Supported with OAuth |
Microsoft | Supported with OAuth |
Apple | Supported |
Proton Mail | Supported via Proton Bridge |
Any other provider | Supported with custom IMAP, including presets for Proton, Yahoo Mail, Fastmail, Yandex, Zoho, Mailbox.org, Posteo, and GMX |
If you build from source rather than using a release binary, note one setup detail from the README: released binaries ship with OAuth credentials configured, while building from source needs your own Google and Microsoft OAuth credentials in a local environment file. Most users will simply download a release and skip that step.
Free, Cleanup Pass, and Pro: what you actually pay for
Paperweight splits its features deliberately. Discovery is free, execution costs money, and the project says so up front.
Aspect | Detail |
|---|---|
Free | One email account, full-history sync, account and mailing-list discovery, breach and personal-data overviews, and local curation |
Cleanup Pass | Full Pro access for 30 days of focused cleanup, $25, one payment with no renewal, community support on GitHub |
Paperweight Pro | The same full access maintained all year, $60 per year, with email support included |
Both paid plans unlock unsubscribe, trash, spam, and bulk cleanup actions, privacy requests and follow-ups, multiple email accounts, and MCP access. Card and manual crypto payments are available for both plans, according to the README, with full plans and pricing on the project's site at paperweight.email.
That split is worth understanding before you install it. If you only want to see the scale of your footprint, the free tier does that. If you want Paperweight to do the unsubscribing and deleting for you, that is the paid part, and the Cleanup Pass is clearly aimed at people who want one focused weekend of tidying rather than a yearly subscription.
How to use it without regretting it
Paperweight makes deletion easier, which is exactly why a little care at the start pays off.
Scan first, act later. Let the full-history sync finish and read the whole inventory before you unsubscribe or delete anything.
Protect the accounts that protect you. Your password manager, your bank, your primary email recovery address, and any account tied to two-factor authentication should stay, even if you rarely open them.
Unsubscribe before you delete. Clearing the mailing lists first reduces the noise, and it also confirms which senders actually honor unsubscribe requests.
Send deletion requests in batches. GDPR requests take follow-up, and Paperweight tracks those follow-ups, so work through them in groups rather than all at once.
Check breach alerts before you reuse a password. If a forgotten service was breached and you reused that password anywhere, change it where it still matters, starting with your email account itself.
None of this is complicated, but the order matters. A cleanup tool is only helpful if it does not delete the one account you needed to reset another.
What Paperweight does not do
Paperweight does not delete your data by magic, and it does not claim to. A deletion request is a request: the company on the other end still has to honor it, and some services make that slow or awkward by design. It also cannot reach accounts that never emailed you, or accounts created with an address you no longer control, so the inventory is only as complete as your inbox history. It is also a desktop app only, for macOS and Windows according to the project's own guide, with no mobile app and no browser extension, so there is no cross-device sync. And while discovery is free, the cleanup actions most people actually want, unsubscribe, trash, spam, and bulk actions, sit behind the paid plans, so the free version is a map, not yet a machine.
Those limits do not make the tool less useful. They make its promise honest: it shows you the footprint, it keeps that picture on your machine, and it gives you the requests and actions to shrink it.
Why it matters
Forgotten accounts are a quiet security problem. Each one is a password that may have been reused, a breach you never heard about, and a company holding data you no longer get any value from. The usual advice, "go delete your old accounts," fails because nobody can list their old accounts from memory. Paperweight solves the listing problem first, locally, and that is the hard part. Once you can see the footprint, shrinking it is just work, and work with a list is work you can actually finish.
If you have ever wondered how many companies hold your data, try the free scan and count. Then decide which of them still deserve to. For a related take on keeping your communications private, read Hush: The Zero-Trust Team Chat That Encrypts Everything With MLS.
Read this article in Indonesian: Baca artikel ini dalam Bahasa Indonesia.
FAQ
Is Paperweight free?
Discovery is free: one email account, full-history sync, account and mailing-list discovery, breach and personal-data overviews, and local curation. Cleanup actions such as unsubscribe, trash, spam, and bulk actions need the Cleanup Pass or Pro.
Does Paperweight send my emails to a server?
No. It is local-first: your emails and settings stay on your machine, and no data is sent to external servers for analysis. Breach checks consult Have I Been Pwned for breach status, but your mail itself is not shipped to a cloud service.
Which email providers does Paperweight support?
Google and Gmail, Microsoft, Apple, Proton Mail via Bridge, and any provider through custom IMAP, with presets for Proton, Yahoo Mail, Fastmail, Yandex, Zoho, Mailbox.org, Posteo, and GMX.
How long does a scan take?
According to the project's quick start, scanning your inbox takes about 2 minutes once your email is connected.
Can Paperweight force a company to delete my data?
No. It generates GDPR deletion requests and tracks follow-ups, but the company receiving the request still has to honor it. Some services are slower than others, which is why the follow-up tracking matters.
Is Paperweight open source?
Yes, under the MIT license. The source is public at wslyvh/paperweight on GitHub, and development happens in the open.