Is it safe to connect your Gmail to an app?

When an app asks to connect to your Gmail, it sends you to Google’s own sign-in page. You sign in to Google, not to the app, so the app never sees your password. Google then shows the app’s name and a list of what it is asking to do with your account, and you press Continue or Cancel.

• Check the address bar says accounts.google.com before you type your password.
• Read the whole list. Some screens let you tick or untick each permission.
• Cancel if the list asks for more than the job needs. An app that only sends doesn’t need to read.

Google writes each Gmail permission in a fixed sentence, and that sentence is what you see on the screen. From the narrowest to the widest:

“Send email on your behalf”

The app can send email from your address. It can’t read your inbox, your drafts or your sent mail.

“View your email message metadata such as labels and headers, but not the email body”

The app can see who wrote to whom, when, the subjects and your labels for every email, without the text inside.

“Manage drafts and send emails”

The app can write, change and send drafts in your account.

“View your email messages and settings”

The app can read every email you have, sent and received, and your Gmail settings.

“Read, compose, and send emails from your Gmail account”

The app can read everything, write and send, and change your mail, such as labels and what is marked read.

“Read, compose, send, and permanently delete all your email from Gmail”

Full access: everything above, plus deleting your mail for good.

Google reviews apps that ask for sensitive Gmail permissions before they can be offered to everyone. An app that hasn’t been reviewed shows a “Google hasn’t verified this app” warning first. That doesn’t mean it is harmful, only that Google hasn’t checked it yet.

Google treats the permissions that read, change or draft your mail as “restricted”. An app that uses them and handles your mail on its own servers must also pass an independent security assessment, at least every 12 months. Send-only access isn’t on Google’s restricted list: an app with it never sees your mail.

• Does it need this much? A tool that sends emails needs send access; a tool that sorts your inbox needs read access. Match the permission to the job.
• Who makes it? Look for a real website, a privacy policy that says what is kept and for how long, and a way to contact them.
• Has Google verified it? An app that asks for a Gmail permission without showing the “Google hasn’t verified this app” warning has been through Google’s review.
• Can you leave easily? You can always remove access from your Google Account, but a good app also has its own Disconnect button and deletes your data when you ask.

1. 1

   Open your linked apps

   Go to myaccount.google.com/linkedapps, signed in to the Google account you connected.
2. 2

   Pick the app

   Each app shows the kind of access it has: Sign in with Google, a linked account, or access to your Google Account.
3. 3

   Remove its access

   Choose Remove access and confirm. From then on the app can’t reach your Google Account.
4. 4

   Ask the app to delete your data

   Removing access doesn’t delete what the app already keeps. Use its own delete option, or write to it.

The same reading applies when an AI assistant, a CRM or any other tool asks to connect to your Gmail. What it asks for depends on what it offers: an assistant that searches, summarises or answers your mail needs to read it, so it will ask for one of the reading permissions above. That may be worth it to you, but give it knowing it can see everything in your inbox, and remove it when you stop using that feature.

A job tool that only sends your applications needs only “Send email on your behalf”. See how Jobreach sends from your Gmail, and how many job emails to send a day.