Where does your spam filter read your mail?
Every spam filter reads your mail somewhere. Four tiers: your provider’s cloud, a vendor’s cloud, a vendor cloud without third-party AI, or your own machine.
A spam filter cannot classify a message it has not read. There is no way around that. So the question that separates the products on the market is not whether your mail gets read, but where, and by whom. There are exactly four answers, and they form a ladder: from your provider’s servers down to your own machine.
Tier 1: your provider’s cloud
Your email provider filters spam on its own servers, as part of the service. Gmail, Outlook.com and iCloud all work this way. Your provider already stores your mail, so filtering adds no new reader. What you give up is control: the filter is tuned for billions of mailboxes at once, so its calls in the gray zone (cold outreach, promo mail, foreign-language spam) are made for the average user, not for you.
Tier 2: a vendor’s cloud
A third-party service connects to your mailbox over OAuth or IMAP and analyzes your mail on its servers. That adds a second company to the list of readers, and the careful vendors are precise about what they read. SaneBox says it analyzes only headers to decide what is important, and that message bodies fetched by optional features are never stored. Clean Email says it never downloads the bodies of your emails, and deletes indexed data 45 days after your last login without an active subscription. Both claims come from the vendors’ own security and privacy pages.
Tier 3: a vendor’s cloud, no third-party AI
The vendor’s servers still read your mail, but no outside AI company does. Leave Me Alone describes its spam blocker as private by design: “Your email content is never sent to outside AI companies. No OpenAI, no Anthropic, no third-party AI provider.” That is a real distinction, and worth having: it narrows who reads your mail. It does not change where your mail is read. The filtering still runs on the vendor’s servers, with access to your mailbox.
Tier 4: your own machine
The filter runs on your device, so your mail is read where it already lives. This tier removes the network entirely. SpamSieve has worked this way for two decades: C-Command states it does not need your mail account login and does not transmit your mail data anywhere. Klar does the same with a modern model: a multilingual transformer classifies every message on your Mac, inside Apple Mail. No account, no cloud, no telemetry. There is no server to trust because there is no server.
The ladder at a glance
| Tier | Who reads your mail | Examples |
|---|---|---|
| 1. Your provider’s cloud | Your email provider | Gmail, Outlook.com, iCloud |
| 2. A vendor’s cloud | Your provider, plus the filter vendor | SaneBox, Clean Email |
| 3. A vendor’s cloud, no third-party AI | Your provider, plus the vendor; no outside AI company | Leave Me Alone |
| 4. Your own machine | Nobody new; mail never leaves your device | SpamSieve, Klar |
Three questions to ask any spam filter
- What does it read: headers only, or full message bodies and attachments?
- Where does the processing run, and what is stored there, for how long?
- If you revoke its access to your mailbox today, does any of your mail remain on someone else’s servers?
For an on-device filter the answers are structural: everything is read on your machine, nothing is stored anywhere else, and there is no access to revoke. That is the tier Klar was built on. How each product on the market answers all three is summarized on our compare page, with sources.
Vendor claims quoted from their public pages, July 2026. Klar is not affiliated with any vendor named here.
