Google API disclosure

GInbox is a built-in desktop email client. Users compose, send, read, and process Gmail through a user interface on Windows and Apple Silicon macOS. That is an approved Gmail API use case under the Google Workspace user data and developer policy.

GInbox is not a one-time export tool, a mobile keyboard, a bulk mailer, or a web service that stores other people's mail. After you allow access, mail is synced to SQLite on your computer. The developer does not receive a copy.

1. You click Add Gmail account in GInbox.
2. GInbox binds 127.0.0.1 on a random port and opens Google's OAuth page in the system browser (Authorization Code plus PKCE, access_type=offline).
3. After you approve, Google redirects to that localhost address with a code. GInbox exchanges the code for access and refresh tokens.
4. Tokens are stored in the OS credential store. Profile email, name, and avatar URL are stored with the local account row so the sidebar can show who is connected.
5. Background sync calls the Gmail API with refreshed access tokens. Initial sync covers Inbox, Sent, Starred, and Drafts. Later sync uses the history cursor.

GInbox requests only the scopes below. They are requested together at Add Gmail account because the core product is a mailbox, not a single optional extra.

• Gmail modify
  https://www.googleapis.com/auth/gmail.modify
  Read messages, change labels, send mail, manage drafts, move mail to trash, and keep the local mailbox in sync. This is the Gmail scope for a full desktop client. GInbox does not request the broader mail.google.com scope that allows permanent delete that skips trash.
• Email address
  https://www.googleapis.com/auth/userinfo.email
  Show the connected account address in the sidebar and keep accounts distinct.
• Profile
  https://www.googleapis.com/auth/userinfo.profile
  Show the account display name and avatar next to the mailbox.

Why not gmail.readonly. A client that can only read cannot star, archive, label, send, or trash. Those actions are the product.

Why not gmail.compose or gmail.send alone. Those scopes cannot read the inbox or apply labels. GInbox would not be a mail client.

Why not mail.google.com. That scope allows immediately and permanently deleting messages, bypassing trash. GInbox moves mail to trash instead, so gmail.modify is enough.

The use of information received from Google Workspace APIs and Google Workspace scopes will adhere to the Google API Services User Data Policy and the Google Workspace user data and developer policy, including the Limited Use requirements.

• Use is limited to the mailbox features visible in GInbox: read, search, file, compose, send, drafts, attachments, notifications.
• GInbox does not transfer Google user data to third parties for ads, data brokerage, or resale.
• GInbox does not use Google user data to serve ads or to determine credit-worthiness.
• GInbox does not use Google user data to create, train, or improve a machine learning or artificial intelligence model.
• Humans do not read user mail unless the user pastes it into a support email, or as required for security or law.

Restricted Gmail data is stored on the end-user device (SQLite plus an attachment cache). OAuth tokens are stored in the OS credential store. GInbox does not store Gmail data on a developer-operated server and does not access it through a third-party mail backend.

The public website is hosted on Vercel and does not receive Gmail content.

Remove the account in GInbox, delete the app data folder if you want the local files gone, and revoke the grant at Google Account permissions. Full steps are in the privacy policy.

Developer contact for this OAuth project: gaa.cost@gmail.com.