Short answers, including the unflattering ones.
It reads message headers — sender, subject, date, and the unsubscribe
headers — and never downloads a message body. Headers are fetched with IMAP
BODY.PEEK, so reading them doesn't mark your mail as read either.
Everything stays on your Mac; there is no server to send it to.
Into the macOS Keychain, stored so it can't ride a backup or Migration Assistant transfer to another machine. It's never written to disk in the clear and never logged. You give Nevermore an app-specific password, not your real account password, and you can revoke it from your mail provider at any time without changing anything else.
OAuth would mean registering a cloud project, putting a client secret in a downloadable app, and asking you to grant a scope on a consent screen. An app-specific password is narrower, revocable on its own, and requires no third party in the middle. It also means Nevermore works the same way with iCloud, Fastmail, Yahoo, and anything else that speaks IMAP.
No — and that's deliberate. "Trash" moves messages to your provider's Trash
folder, where they sit under that provider's retention (30 days on Gmail) and
you can restore them yourself. Nevermore never issues an IMAP
EXPUNGE, so it has no way to destroy mail permanently. Small
batches also undo in-app with ⌘Z.
Nevermore finds newsletters by the standard List-Unsubscribe
header. Nearly all legitimate bulk mail carries one — Gmail and Yahoo have
required it from bulk senders since 2024 — but a sender who only puts an
unsubscribe link in the body of the message is invisible to it.
Flagged and starred messages are also skipped on purpose, so your important mail is never in scope.
Because it can't know. Sending a one-click unsubscribe and getting HTTP 200 means the request was accepted, not that anyone acted on it — endpoints routinely return success and keep mailing. Nevermore only says "confirmed" when you saw a confirmation page yourself. Anything else would be claiming a result it can't prove.
They show up in Reappeared, with a count of what's arrived since you unsubscribed. From there you can finish the job by hand in the built-in browser, or trash and ignore them for good. Catching that is the reason the app is called Nevermore.
Anything that speaks IMAP. Gmail, iCloud, Yahoo, Fastmail, and AOL are detected from your address; custom domains pick their provider. Folders are discovered from the server rather than hard-coded, so unusual setups work too.
It reads the headers of your entire mail history once — a few minutes on a large mailbox. After that it only looks at what's new, which takes a couple of seconds. The app shows real progress while it works, and explains itself while you wait.
Yes. The first screen offers Try the Demo: a full sample mailbox with every button live and no credentials required. It runs on a backend containing no network code at all, so nothing in demo mode can reach a server.
Yes. Nevermore ships as a universal binary, so it runs natively on both Apple Silicon and Intel Macs running macOS 14 or later.
The source is published so you can read exactly what an app holding your mail credential does. That's not the same as open source: you may read, audit, build, and run it for personal use, and modify it privately, but not redistribute it, publish a fork, or use it commercially. See the licence.
None. There is no server, no account, no analytics, no crash reporting, and no update check that identifies you. The privacy policy is short because there's little to say.
Settings ▸ Advanced ▸ Export Diagnostics writes the app's own recent log entries to a file you can read before deciding whether to share it. Then open an issue on GitHub. Sender addresses appear in those logs; message contents and your password never do.