What Disponed asks for when you sign in with Google

Steps

1. Click 'Sign in with Google'

   Start from the Disponed homepage or app. You are redirected to Google's own sign-in page, not a page controlled by Disponed.

2. Enter your Google credentials on Google's page

   You type your email and password directly into Google's official login form. Disponed never sees or receives your password.

3. Review the consent screen

   Google shows a list of permissions Disponed is requesting: full Gmail access and Gmail settings access.

4. Approve or cancel

   Click Allow to grant access and return to Disponed, or click Cancel to stop. Canceling does not create a Disponed account or give it any access.

5. Disponed scans your mailbox

   Once connected, Disponed counts how many emails can be cleared and how much storage can be freed. Nothing is deleted at this stage.

6. Revoke access anytime

   You're never locked in — revoke access anytime from your Google account, or disconnect directly inside Disponed (see below for exact steps).

The permissions Disponed requests, and why

Google's consent screen groups Disponed's request into a few plain-language items. Here is what each one actually maps to and why Disponed needs it.

Why the Gmail scope looks broader than expected

The full Gmail scope (https://mail.google.com/) sounds like it grants everything, and technically it does grant broad API access. Google does not offer a narrower scope that still supports permanent delete, so this is the only scope that covers both Trash and permanent deletion.

What matters is what Disponed's own code actually does with that access. Reading metadata is enough to do everything Disponed needs: tally counts, spot attachments, and match senders against your whitelist. There's no step in that process that requires opening a message body, so the code never does.

• Only metadata is read or stored — the subject line and body text are never fetched, in any form.
• Deleted mail goes to Gmail Trash by default, recoverable for 30 days, exactly like a normal Gmail deletion.
• Permanent deletion only happens if you explicitly opt into it, and it is irreversible.

Disponed never sees your Google password

Google's OAuth 2.0 sign-in flow means your password is typed only into Google's own login page, never into any form owned by Disponed.

After you approve access, Google gives Disponed a token, not your password, that authorizes the specific permissions you saw on the consent screen. Disponed cannot see, request, or store your Google password at any point.

How to review or revoke Disponed's access

You are always in control of the connection and can end it at any time, from either Google's side or Disponed's side.

• Go to myaccount.google.com/permissions to see every app connected to your Google account, including Disponed.
• Click Disponed in that list to see the exact permissions granted, and click Remove access to revoke them instantly.
• You can also disconnect Disponed from within the app itself, without leaving the Disponed interface.
• Revoking access stops all future access immediately. It does not undo cleanups you already ran.

FAQ

What permissions does Disponed ask for on Google sign-in?

Disponed's Google consent screen requests two things: full Gmail access (to move mail to Trash or permanently delete it) and Gmail settings access (to create archive filters when you use Stop Ads).

Does Disponed see my Google password?

No. Google's OAuth sign-in means you type your password only into Google's own login page. Disponed receives an access token from Google, never your password, and cannot see or store it.

Why does Disponed need full Gmail access instead of a limited scope?

Disponed offers optional permanent deletion, and Google does not provide a narrower Gmail scope that supports permanent delete, only the broader https://mail.google.com/ scope does. The narrower gmail.modify scope only allows moving mail to Trash, not permanently deleting it.

Does Disponed read the content of my emails?

No. Disponed's code only reads message metadata, sender, labels, size, and thread id, to build counts of how many emails can be cleared. It does not fetch, store, or display the actual content (body) of your emails.

How do I revoke Disponed's access to my Google account?

Go to myaccount.google.com/permissions, find Disponed in the list of connected apps, and click Remove access. You can also disconnect Disponed from inside the Disponed app itself.

What is the Gmail settings permission used for?

The gmail.settings.basic scope is only used when you turn on the Stop Ads add-on. It lets Disponed create archive filters so future mail from senders you unsubscribed from is automatically archived instead of hitting your inbox.