Three steps to a smaller footprint
-
01
Log in with Gmail, metadata only
Sign in with Google. Tombstone connects with the gmail.metadata scope, so it only ever sees message metadata: sender, subject, and date. Never the body, never attachments.
-
02
Map every account
A background scan turns inbox history into a clean ledger of the services that hold your data. Run a fast Quick scan of recent mail or a thorough Deep scan of your whole inbox, follow live progress, and stop anytime: whatever's found so far is kept.
-
03
Review and retire
Breached and dormant accounts are flagged with the evidence. You decide what stays and what goes.
What Tombstone does
Account discovery
Finds every service emailing you with a fast Quick scan or a full Deep scan. Merges sister domains and filters out noise like banks and mail infrastructure.
Breach intelligence
Cross-references your accounts against LeakCheck and HaveIBeenPwned to show exactly which data classes were exposed.
Dormant detection
Accounts silent for over six months are flagged as dormant: forgotten signups that still hold your personal data.
Risk scoring
Each breach is scored from 1 to 10 by what was actually compromised. Passwords and SSNs weigh more than usernames.
Deletion letters
AI-drafted requests citing CCPA Section 1798.105 or GDPR Article 17. Always a draft first, never sent without your approval.
Consent-first agents
Every irreversible action requires an explicit, recorded yes from you. The audit trail is append-only.