By Brett Kaufman. 8 years using relationships to build sales pipelines, from political fundraising to a 7 figure business to running matchmaking for two communities. Over 1,000 introductions facilitated.

Short answer: a personal CRM can read your emails only if you grant it a Gmail permission, and Google spells out each permission on its own screen before you agree. A contacts permission alone does not open your inbox.

Here is the moment it comes up. It is 11pm in a hotel room after the second day of a conference. You have a stack of new names and a free trial open on your laptop. You tap Connect Google, and Google’s screen says the app wants to “View your email messages and settings.”

Your inbox has three NDAs, a CIM from a broker, and an LOI draft in it. You close the tab.

Good instinct. Here is how I would read that screen, what I would look for, and what FRONT OF MIND actually asks for.

How email and calendar sync works in any tool

When an app connects to your Google account, it does not get your password. It goes through OAuth, Google’s permission system. The app asks for specific scopes. Google shows you a plain English list of them. You approve or cancel. The app can then do what those scopes allow and nothing more.

The scopes that matter for email, with Google’s own descriptions from the Gmail API scope documentation:

• gmail.metadata: “View your email message metadata such as labels and headers, but not the email body.”
• gmail.readonly: “View your email messages and settings.”
• gmail.send: “Send email on your behalf.”
• gmail.modify: “Read, compose, and send emails from your Gmail account.”
• mail.google.com: “Read, compose, send, and permanently delete all your email from Gmail.”

Google classifies gmail.readonly, gmail.metadata, gmail.modify and full mail access as restricted, its most protected tier, and gmail.send as sensitive. The same page tells developers to “choose the most narrowly focused scope possible and avoid requesting scopes that your app doesn’t require.”

Calendar works the same way. In Google’s Calendar API scope list, calendar.events.readonly means “View events on all your calendars,” calendar.events means “View and edit events on all your calendars,” and the full calendar scope adds sharing and permanent deletion.

Contacts are separate again. Reading your contact list uses contacts.readonly, which Google’s People API documentation lists as one of the two scopes that can list your connections. It reaches names, emails, phone numbers and the other fields on your contact cards. It does not reach Gmail.

What I look for before I tap Allow

Read Google’s screen, not the app’s landing page. The landing page is copy. The permission screen is the contract.

Four questions cover most of it:

1. Does the feature you want need this scope? A contact import needs contacts. Noticing when a broker replies needs some kind of mail access. Sending from your own address needs gmail.send. If an app asks for full mail access to show you birthdays, walk.
2. Is it reading or acting? View scopes and send scopes are different permissions. Know which you are granting.
3. Is the access one time or standing? Some tools read once and let go. Others keep a refresh token so they can keep syncing in the background. Neither is wrong, but you should know which you have.
4. Can you take it back? Google’s page on managing linked apps shows you how: open your Google Account’s linked apps page, pick the app, choose See details, then Remove access. Google warns that removing access “may make some features unavailable.”

One honest caveat. A scope is the ceiling, not a description of behavior. gmail.readonly allows viewing messages. What a given tool actually does with that permission is up to its code and its policies. That is why I prefer the narrowest scope that does the job.

If your inbox holds deal documents, the safe default is a contacts only import first. Add email later if a feature earns it. I go deeper on the contact side in how to import and clean up your contact list.

What FRONT OF MIND actually asks for

There are two different Google connections in FRONT OF MIND. They ask for different things, so here is each one plainly.

Signing in with Google. Continue with Google asks for your basic profile and email address only. It creates or opens your account. It does not touch your contacts or your inbox.

Importing your contacts. This is how you get started. With Google, it asks to read your contacts (contacts.readonly) plus your email address, so the screen can tell you which Google account the contacts came from. With Outlook, it asks to read your profile and your contacts. You can also start from your iPhone instead. Either way, the import reads your contacts once, brings them in like a file, and then drops the access. For Google, the access is also revoked right after. There is no standing connection to your account and no inbox access in this step.

The optional Gmail and Calendar connection. Separately, the app has a Google connection for email and calendar features. It is not part of getting started, and you can use FRONT OF MIND without it. If you choose to connect it, Google’s screen will ask for:

• gmail.readonly, so the app can notice when someone in your contacts emails you back
• gmail.send, so a message you choose to send can go out from your own address
• calendar.events, so it can see and book meetings on your calendar
• contacts.readonly, to keep your Google contacts in sync
• your email address, to name the connection

This connection does keep access so it can keep syncing, and you can remove it anytime from your Google Account. When it checks for replies, the app looks for mail to or from people already in your contacts, and it keeps the sender, recipient, subject line, date and Gmail’s short preview line for each match. The scope Google shows you is broader than that, as every gmail.readonly scope is. Google’s permission screen shows the exact list before you agree, and that screen is always the final word.

Sending follows the same rule as everything else in the app: nothing sends without your tap.

Your contacts are encrypted. No one on our team looks at them. You can export and delete them anytime.

The short version

• A contacts permission reads contact cards. It cannot open your inbox.
• A Gmail permission is what lets any tool see your mail. Google names it on the screen.
• Prefer the narrowest scope that does the job, and know whether access is one time or standing.
• You can remove any app from your Google Account in a few clicks.

If you are weighing a homemade setup instead, the same permission questions apply. I cover them in using ChatGPT as a personal CRM.

Start with contacts only

FRONT OF MIND opens on your 10 minutes for today: the people worth a text right now, each with one line on why today, like a follow up that is due or a pipeline deal that has gone quiet for 7 days. Every draft is a text style message, 40 words max, and nothing goes out until you tap it.

You do not need to connect your inbox to see it work. Start free with your first 25 contacts and see who comes up first.

See how it works