OAuth Scopes - Gmail

Tip

Clairify cannot change Gmail settings or permanently delete messages.

We request a small set of Google OAuth scopes to:

  1. Sign you in and create your Clairify account,
  2. Read your messages to summarize them,
  3. Apply lightweight user-initiated changes to your inbox, and
  4. Send messages you compose — Replies, reply all, forwards, and new emails


Table 1: Complete List of Requested Gmail Scopes
Purpose Scopes What it allows Example
Non-Sensitive
Sign-in & account association openid
userinfo.email
userinfo.profile		 Verify identity, link the correct Google account, and load basic profile details (name, avatar, email). Sign into the app, show your name/avatar, tie your account to the right inbox.
Manage label definitions gmail.labels Create, read, update, and delete user labels. Applying/removing labels on messages is done via gmail.modify. Create and maintain labels used by Clairify. Our labels are always prepended with 'Clairify', e.g., ClairifyArchive.
Restricted
Read mail for summarization gmail.modify Read messages and attachments. Generate summaries for new messages and newsletters.
Apply user-initiated mailbox changes gmail.modify Add/remove labels on messages/threads; toggle UNREAD; archive (remove INBOX); move to Trash. Swipe right to mark as read; tap Archive to file; apply the corresponding label, e.g., ClairifyRead.
Send mail on your action gmail.modify Send messages you compose — New emails, replies, reply all, and forwards. Sending is always initiated by you. Reply, reply all, or forward a message from a card; compose a new email within Clairify.
Read mail gmail.readonly View email messages and certain settings without modifying mailbox state. Redundant when gmail.modify is granted.

Permission Philosophy

  • Least privilege — We request only the scopes needed for the features above. Table 1 is the single source of truth for scope purposes and examples.
  • User-initiated changes only — Any mailbox modification or outbound message happens in response to your actions in the app, e.g., mark as read, archive, labeling, or sending a reply you composed. Clairify never sends on its own.
  • Content boundaries — Only email messages and their attachments are accessed, and for no purpose other than to generate summaries and to send the messages you compose.
  1. Choose your Google account.
  2. Review and grant the scopes listed in Table 1.
  3. You’re redirected back to Clairify and a token is issued.
  4. Access tokens are used by the app; refresh happens in the background.

Token Lifecycle & Revocation

Access tokens are short-lived; refresh tokens keep sessions active until you revoke access or sign out. Either option immediately terminates our access to your inbox and its watch notifications.

To revoke access:

  • Individual: Google Account | > Security > Third-party access, or
  • Workspace Admin: Google Admin Console > Security > Access & Data Control > API Control > Manage App Access.

Security & Access Transparency

  • Credentials & secrets - OAuth tokens are encrypted at rest.
  • Access controls - We enforce role-based, least-privilege access to production systems and customer data (emails, summaries, labels/metadata), cryptographic secrets/tokens, and operational tooling (databases, storage, Pub/Sub, logs, admin consoles).
  • Accountability - All privileged access—including use of administrative tooling for technical support and debugging—is logged and auditable.

Scope Change Policy

Any addition or elevation of scopes requires renewed user consent. Per Google, any time we add a sensitive or restricted scope, we must submit for verification before using that scope in production.

Additional Resources