How we use Google user data
Last updated: August 2, 2026 · The full version of the Limited Use disclosure summarized in the privacy policy.
Limited Use affirmation
Tombstone's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Every permission we request
This is the complete list. Tombstone asks for nothing else.
| Scope | Why we need it |
|---|---|
gmail.metadata |
The whole product. Discovering which companies have accounts tied to your address requires seeing who has emailed you, which lives in message headers. This is the narrowest read scope Google offers that can do it: it exposes headers and labels and cannot return message bodies or attachments at all. A narrower scope cannot enumerate senders. |
openid |
Confirms who you are at sign-in so your data is scoped to your account and nobody else's. |
userinfo.email |
Your email address, used as your account identifier and to match breach records against you. |
userinfo.profile |
Your display name, shown in the navigation bar and on your profile page. |
We do not request permission to send, draft, modify, or delete mail, and we do not request your contacts, calendar, or Drive. Deletion letters are sent by you, from your own Gmail, through a compose window we open for you.
What the code actually does
These are enforced properties of the codebase, not intentions:
- A single module is allowed to talk to the Gmail API. Nothing else in the app can reach it.
- Message fetches are made with
format="metadata"and a header allowlist of From, Subject, and Date. The full-message format is never requested, so a body is never returned in the first place. - Headers are processed in memory and discarded. What gets written to the database is the derived summary: the company, its domain, when it first and last emailed you, and how many messages it sent.
- Your OAuth token is encrypted with a versioned key before it is stored, and is never written to disk in plain text.
Limited Use, item by item
- Only to provide the feature. Google data is used solely to build your own account inventory and the deletion drafts you ask for.
- No transfer except as needed to provide that feature, for security purposes, or where the law requires it. Our full provider list is on the subprocessors page.
- No advertising. Google user data is never used to serve ads, and never sold, rented, or shared with brokers.
- No humans reading it. Nobody at Tombstone reads your Google data, except with your explicit permission to resolve a support or security issue, or where required by law.
- No AI training. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data, raw or aggregated or derived, is never used, transferred, or sold to create, train, or improve generalized or foundational AI or machine-learning models. The only things our AI providers receive about a company found in your mail are its name, its domain, and the dates it emailed you, and both providers are used under commercial terms that prohibit training on API inputs. The full breakdown is under AI processing in the privacy policy, and every provider is named on the subprocessors page.
Retention and deletion
Logging out revokes Tombstone's token with Google directly, not just your local session. Deleting your account removes your user record and everything attached to it. Full instructions, including how to revoke access from Google's own settings page, are on the data deletion page.
Questions
Write to support@tombstonepro.com, or security@tombstonepro.com for anything about how the data is protected.