Google Access Explanation

1. Gmail read-only access

Scope: https://www.googleapis.com/auth/gmail.readonly

Why it is needed:

• Search for emails that match user-defined invoice and receipt rules.
• Read matching messages and metadata.
• Download attachments such as PDF invoices and receipts.
• Generate a PDF copy of receipt emails when no attachment exists.

The app does not use Gmail access to:

• Send email.
• Delete email.
• Change inbox settings or forwarding rules.

2. Google Drive access (non-sensitive drive.file scope)

Scope: https://www.googleapis.com/auth/drive.file

Why it is needed:

• Create a single Invoice Collector folder at the root of the user's Google Drive on first upload.
• Create YEAR/MM subfolders inside that folder to organize uploads.
• Upload processed invoices, receipts, and captured photos into that app-owned folder tree.
• Detect duplicates by name inside the app-owned folder tree before saving another copy.
• Read links for files the app has created so the user can open them from the app.

What drive.file means for the user:

• The app can only see and modify files it has created itself (the Invoice Collector folder and its contents), or files the user explicitly opens with the app.
• The app cannot list, read, or touch any other files in the user's Drive.
• Google classifies drive.file as a non-sensitive scope, so it does not require a CASA Tier 2 security assessment.

3. Google Drive read access (restricted drive.readonly scope)

Scope: https://www.googleapis.com/auth/drive.readonly

Why it is needed:

• Power the "Send to Rivhit" feature: read and download every file in a month's Invoice Collector/YYYY/MM folder so the app can email the full month's set to the user's accountant.
• Include documents the user placed in that folder manually from elsewhere, which the write-only drive.file scope cannot see.

What drive.readonly means for the user:

• The app can read files in the user's Drive but never modifies, moves, or deletes anything outside its own Invoice Collector subtree.
• Google classifies drive.readonly as a restricted scope; it is used here only while the app remains in Testing publishing status.

4. Google account email address

Scope: https://www.googleapis.com/auth/userinfo.email

Why it is needed:

• Identify which Google account was connected.
• Associate the authorized Gmail account with the correct Invoice Collector user record.
• Support re-authentication of the same connected account later.