Right at Hand

Right at Hand

Gmail permissions, explained

Last updated: 3 September 2026

Right at Hand is operated by UpWeb Pty Ltd in Australia.

This page lists every Google permission Right at Hand requests, what each one allows in ordinary language, exactly which product features rely on it, and how you take the access away again. It is generated from the same scope definitions the product uses at runtime.

The permissions we request

Right at Hand currently requests exactly one Google OAuth scope:

Read, send and organise your Gmail (gmail.modify)

https://www.googleapis.com/auth/gmail.modify

This is the single Gmail permission Right at Hand requests. It lets the product read the mailbox you connect, send email you have approved, and manage everyday mailbox state such as labels, archive, read/unread, star, spam and trash. It deliberately excludes the broader Gmail permission that allows immediate, permanent deletion of mail.

We do not request access to any other Google service — no Drive, no Calendar, no Contacts — and we do not request the broader Gmail permission that allows immediate, permanent deletion of mail.

What this permission allows

  • Reading messages, threads, headers, labels and attachments in the connected mailbox
  • Creating, updating and deleting drafts
  • Sending email from the connected address
  • Changing message and thread state: labels, archive, read/unread, star, spam, and moving to or out of Trash
  • Receiving change notifications so the workspace stays in sync

The product features that need it

Each of these is a live feature in the current product:

  • Syncing your inbox into the workspace (full sync plus incremental updates via Gmail change notifications)
  • Showing complete conversations, including attachments you open or that you ask the AI to consider
  • Search across your mail from the workspace
  • Mailbox actions you take in the product: archive, star, mark read/unread, report spam, move to Trash and restore from Trash
  • Listing, creating, renaming and deleting Gmail labels, and filing threads into them
  • Saving AI-assisted replies as Gmail drafts and sending them when you approve
  • Scheduled sending and follow-up checks that look for replies to messages you sent
  • Verifying that a send actually completed if the connection drops mid-send

What it does not allow

  • Immediate, permanent deletion of messages or threads that bypasses Trash (that requires the broader https://mail.google.com/ scope, which Right at Hand does not request)
  • Your Google account password
  • Access to other Google services such as Drive, Calendar or Contacts
  • Access to any mailbox other than the one you explicitly connect
  • Changing your Gmail settings, filters or forwarding rules

To be explicit: permanent-delete access is not requested. When you delete mail through Right at Hand it moves to Gmail's Trash, exactly as it would in Gmail itself, and Gmail's own Trash rules then apply.

Why a narrower permission is not enough

Gmail's permission model offers separate read-only, send-only and label scopes, but no combination of those covers what the workspace does as one product: reading and syncing conversations, saving and updating drafts, sending replies you approve, and everyday mailbox management such as archiving, marking read or unread, starring, reporting spam and moving mail to or out of Trash.

The gmail.modify scope is the narrowest single Gmail permission that covers reading, sending and organising together while still excluding permanent deletion. Requesting the smaller scopes as well would not reduce access — it would only add consent-screen entries the product already covers. This is our own design reasoning; it does not imply any endorsement by Google.

How your Google credential is stored and used

  • The OAuth exchange happens entirely server-side; tokens never pass through or live in your browser.
  • The long-lived refresh token is stored encrypted in a dedicated secrets vault on our backend, separate from ordinary application tables.
  • Short-lived access tokens are obtained from Google when an operation needs one and are used in server memory only.
  • Log sanitisation strips token material before anything is written to logs.
  • The permissions actually granted are recorded per mailbox; if a future feature ever needed more, you would be sent back through Google's consent screen — nothing can widen silently.

Taking access away

You can remove Right at Hand's access at any time, from either side:

  • Inside Right at Hand: Settings → Email accounts → Disconnect. This asks Google to revoke the credential, deletes our stored copy of it and stops syncing.
  • Inside your Google Account: remove Right at Hand under third-party access at myaccount.google.com/connections. Access stops even if you never open Right at Hand again.

Revoking access stops all future reading and sending immediately. Content that was already synced into your workspace remains there until you delete it or ask us to — see Data deletion for exactly how that works.

Google Limited Use disclosure

Right at Hand’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can read Google's policy here: Google API Services User Data Policy.