Invoice Collector connects to Gmail and Google Drive only after a user explicitly authorizes access with Google OAuth.
This page explains the exact Google scopes requested by the app and why they are needed.
Scope: https://www.googleapis.com/auth/gmail.readonly
Why it is needed:
The app does not use Gmail access to:
drive.file scope)Scope: https://www.googleapis.com/auth/drive.file
Why it is needed:
Invoice Collector folder at the root of the user's Google Drive on first upload.YEAR/MM subfolders inside that folder to organize uploads.What drive.file means for the user:
Invoice Collector folder and its contents), or files the user explicitly opens with the app.drive.file as a non-sensitive scope, so it does not require a CASA Tier 2 security assessment.Where files are stored: everything the app writes to Drive lives under My Drive / Invoice Collector / YYYY / MM / <invoice>. Users can rename, move, or delete that folder from Google Drive at any time; the app will create a new one on the next upload if needed.
Scope: https://www.googleapis.com/auth/userinfo.email
Why it is needed:
Invoice Collector folder at the root of the user's Drive; the user can rename, move, or delete that folder at any time from Google Drive.For the Google OAuth verification reviewer, the exact scope classifications used by this app are:
https://www.googleapis.com/auth/gmail.readonly — Restricted. Justification: read invoice/receipt emails and attachments matching user-defined collection rules. Read-only; the app never sends, deletes, modifies, or forwards email.https://www.googleapis.com/auth/drive.file — Non-sensitive. Justification: the app creates one Invoice Collector folder in the user's Drive and writes only files it creates itself into that subtree. It cannot see or list other Drive files.https://www.googleapis.com/auth/userinfo.email — Non-sensitive. Justification: identify the connected Google account so the app can persist the link to the correct Invoice Collector user record.Because the Gmail scope is restricted, verification includes a CASA Tier 2 security assessment. The drive.file scope does not require a security assessment on its own.
Questions about Google access, privacy, or account connections can be sent to nir.ashkenazi88@gmail.com.
Related pages: