Don't do that, it will be disastrous for you.

Instead, send them a politely worded one-time announcement with an invitation to subscribe. Clearly mention that if they don't, this is the last mail they'll get from you, and keep that promise by deleting their address. You'll still get some pushback, but I think most people would find that acceptable.

> over the last decade

Be aware that under various regulations, you're potentially already at risk of accusation in terms of unwarranted data retention. If you haven't got a good reason to have kept those email addresses, something like the GDPR might not interpret that favourably. While the GDPR doesn't specify actual time limits, they are expected to be proportionate. Financial records are generally 7 years unless otherwise legally required, so for a decade, you would be saying that these email addresses are more critical/valid than that. That may be the case, I don't know your business, but be careful if you don't want some very awkward questions asked. Just the hassle of having to deal with complaints you might get (and various regulators would take notice of 1 million instances) is likely to be more than it's worth for most.

The suggestion downthread to send a very clear "we still have your address, would you like to opt in to this newsletter, otherwise we'll remove it" is not a bad one, but even then, some people will object to you still having it at all.

My reaction would be to report spam with a vengeance

So you’re retrospectively assuming consent? Gross.

Oh my God don't do that

What percentage of those million still use your app?

What percentage of those million remember the existence of your app?

Unless you're sure both of those are VERY high, you would be an absolute imbecile to spam them.