Is Google Takeout Safe to Use?

If you want a copy of your Google data, Google Takeout is generally safe when you use Google’s official export page and keep the archive private. Takeout copies selected data, including Gmail messages, photos, and Drive files, into an archive of files you can download or send to a storage provider. It does not delete the data from Google.

Once the archive leaves Google, it puts sensitive information in one place. Anyone with access to the file or its shared folder can see that information. For email-only copies, mailmd is a free, open source alternative that saves messages as readable, searchable Markdown files on your own computer.

What Takeout does and where the risks are #

Takeout is Google’s own data-export service, available at takeout.google.com. Google asks you to re-enter your password if you have not signed in recently. It may also require 2-Step Verification. Those checks help protect the export request, but they do not secure a file after it reaches your device or another storage provider.

An archive can contain several kinds of personal data together, including email, contacts, photos, and activity information. Store it somewhere only you can access, and avoid uploading it to an unfamiliar viewer. If a third-party viewer processes the archive on its servers, the viewer receives the archive’s data. If you choose Dropbox, OneDrive, or Box as the delivery destination, check the folder’s sharing settings first. Google says the destination should not be shared with others; it also says that after an archive reaches OneDrive or Box, the archive is subject to that provider’s terms and policies. For an enterprise Box account, the administrator can view the data even without a sharing link. These delivery and account-security details appear in Google’s Takeout instructions.

Google’s privacy policy says it treats content you create, upload, or receive while signed in, including email and documents, as personal information. Google also describes protections such as encryption for data moving between devices, services, and data centers in its Safety Center. Those statements describe Google’s practices, but they do not explain how a downloaded archive is protected on your computer. Google’s Takeout instructions do not say whether the archive is encrypted, so treat it as sensitive data instead of assuming it is password-protected.

For a safer download, use a device you control, keep the archive in a private folder, and avoid shared computers. Google recommends downloading and viewing exports on a desktop computer. Its sign-in page also offers Guest mode for signing in privately on a computer that is not yours, but a personal device gives you more control over where the downloaded files end up.

Takeout is useful for exporting, but not a complete backup #

A Takeout archive does not remove the original data from Google. If you want to free storage or remove content from your account, delete it separately after confirming that you have the copy you need.

The export shows your data at one point in time. Google says changes made between the request and archive creation might not appear, and items still being deleted are excluded. Once Google has deleted data from its storage systems, Google says it is unlikely to be recoverable. Treat Takeout as an export. Before relying on the archive as your only copy, check that it contains the files you expected.

Google’s instructions say archives expire in about seven days and each archive can be downloaded up to five times. Download the archive promptly. Check that all files or archive parts arrived, and keep a separate copy if the data matters. For recurring exports, Google offers scheduled archives, but scheduled exports do not make Takeout a continuously updated backup.

How mailmd compares for email #

Takeout exports many types of Google data. mailmd focuses on email: it copies messages into a folder of Markdown files, with one file per message, and works with Gmail and other IMAP mailboxes. For Gmail, it connects either through IMAP or the Gmail API. The API login requires an OAuth app in Google Cloud; Outlook.com connections use Microsoft Graph and require an OAuth app in Microsoft Entra.

mailmd reads mail only. It requests read access, opens mail folders as read-only, and does not mark messages as read, move or delete them, or send mail. The files remain on your computer, where you can search them with an editor, rg, or grep, or use index.jsonl with jq. Attachments are saved beside the message files. mailmd has no search engine of its own. It also cannot restore mail to a mailbox or free mailbox storage by itself.

Local files also need protection: anyone who can access your computer or its backups can access the saved messages. Login details are stored outside the archive and are readable only by your user, but they are not encrypted. If a coding agent reads the saved mail, it sends what it reads to its model provider.

Choose mailmd when you want a local, file-based copy of email that you can search and manage with ordinary tools. Choose Takeout when you want to export Google data beyond email or prefer Google’s archive format. To try mailmd, visit mailmd.dev or its open source repository.

$ curl -fsSL https://raw.githubusercontent.com/vincentsch/mailmd/main/install.sh | sh

Set up mailmd so you can read my email. Use https://github.com/vincentsch/mailmd: read its AGENTS.md and follow the steps. Connect my mailbox and run the first sync. Then show me where the files are.