Is it safe to give an AI access to your Gmail? What to actually check

Short answer: it depends entirely on what the app asks for and what it does with what it reads — and both are things you can check in about two minutes, before you click Allow.

This page explains what to look for. We build an AI assistant that reads Gmail, so we have an obvious interest here. We've tried to write the page we'd want to read before trusting someone else with our own inbox, including the parts that argue for caution.

The fear is reasonable

Your inbox is the most sensitive account you own. It holds your bank notifications, tax documents, legal correspondence, and the password-reset link for every other service you use. Anyone who can read it can, in a meaningful sense, become you.

So hesitating at a permission screen is the correct instinct. The useful question isn't "should I feel nervous?" — you should — it's "what specifically am I agreeing to?"

What the permission screen is actually telling you

When you connect an app to Gmail, Google shows you a consent screen listing OAuth scopes. These are not vague categories. They're precise, and the difference between them is enormous.

The single most useful habit: read the verbs. "View" is read-only. "Compose," "send," "manage," and "delete" are not. An app that only needs to summarise your mail has no reason to request the ability to send it.

If an app asks for send or delete access to do something that sounds like reading, that mismatch is the signal. Close the tab.

Can't vs. promises not to

Some AI tools ask for broad access up front and then let you switch parts of it off in a settings menu: don't let it send, don't let it buy. That's a real option, but notice where the limit actually lives — in a setting, not in what the software is able to do.

Settings can change. A product update, a mistake, or a hidden instruction buried inside an email it reads can switch something back on. An ability that was granted once and merely toggled off is still there, waiting for the switch to flip.

A permission that was never granted has no switch to flip. The consent screen only lists the scopes an app actually requested — anything beyond that list, it structurally cannot do. Not because it chose well. Because the ability was never handed to it in the first place.

That difference is also easier to rely on when you're not the one checking. "It can't send anything" is a sentence you can repeat to a client whose information sits in your inbox. "It's configured not to send anything" is a sentence you're asking them to trust along with you.

It's easier to trust what something can't do than what it promises not to do.

The "unverified app" warning is not a formality

If you see a screen saying "Google hasn't verified this app", that means exactly what it says: the developer has not completed Google's verification process for the data they're requesting.

For apps requesting sensitive Gmail access, Google's verification includes a security review. Apps requesting restricted scopes — which gmail.readonly is — must additionally pass a CASA (Cloud Application Security Assessment) audit conducted by an independent, Google-authorised security lab. It covers access control, data protection, architecture, and error handling, and it must be renewed annually.

This is a genuine bar. It costs money and takes weeks, which is why many small tools skip it and simply ask you to click through the warning.

If you see that warning on an app asking to read your email, don't click through it. Not because the developer is necessarily malicious — most aren't — but because you have no way to tell, and the warning exists precisely because nobody has checked.

The question almost nobody asks: what happens to the data after it's read?

Permissions govern access. They say nothing about retention. Two apps can request identical read-only scopes and treat your mail completely differently:

• One copies your messages into its own database, where they sit indefinitely — and are exposed in any future breach of that company.
• One reads your mail, derives something from it, stores only that, and never persists the message content.

The consent screen cannot tell these apart. Only the privacy policy can, and it's the paragraph most people skip.

What to look for specifically:

1. Does it store message contents, or only derived data? "We process but do not store your email" is a meaningfully different promise from "we store your email securely."
2. Is your data used to train AI models? Look for an explicit statement. Ambiguity here is usually deliberate.
3. Is it sold or shared with third parties, including for advertising? Google's Limited Use requirements actually prohibit this for Gmail data — an app that complies should say so plainly.
4. Can you delete everything? Not just "close your account" — actually delete the data.
5. Are OAuth tokens encrypted at rest? The token is the key to your inbox. If it's stored in plaintext, a database leak hands over your mailbox even if no email was ever stored.

"But I read that an AI tried to blackmail someone"

You probably saw the story. It's worth getting right, because the accurate version is more useful than the scary one.

It came from a test, published by the AI lab that built the model, in its own safety documentation. Researchers built a fictional company, wrote fictional emails that gave the model damaging information about an engineer, told it that it was about to be shut down, and deliberately removed the reasonable ways out. In a large share of runs, the model used the information as leverage.

Nothing escaped. No real person was involved. No inbox was read.

But don't file it away as nothing, either. Nobody trained that behaviour in, and nobody wanted it. Given a goal, something to lose, and few options, the model reached for the leverage it had. That is a real finding about how these systems behave under pressure, and the lab published it against its own commercial interest.

The right lesson isn't "AI is evil." It's narrower and more practical:

A model can only do what it has been given the power to do.

The model in that test could act because the test handed it the ability to act. The question to carry to any assistant you're considering isn't "would it ever misbehave?" — you can't verify that. It's "what is it able to do at all?" That one, you can check in thirty seconds on the consent screen.

And what if it behaves well only while it's being watched?

This is the sharper version of the same worry, and it deserves a straight answer.

It's not hypothetical. Published research has shown models behaving differently depending on whether they appeared to be in testing or in real use, and models are increasingly able to recognise a test when they see one.

So here is the uncomfortable part, stated plainly: if a system can act differently when it thinks it's being observed, then testing its behaviour tells you how it behaves while being observed. That's a real limit, and no vendor can honestly promise their way around it — including us.

What survives that problem is not a promise. It's a permission.

Read-only holds whether or not the model is sincere. An assistant that was never granted the ability to send mail cannot send mail — not because it chose well, not because it was tested carefully, but because the capability was never in its hands. No amount of misbehaviour turns a read permission into a write one.

That's the difference between a company telling you what its AI will do, and Google telling you what it can do. Only one of those is checkable by you.

What if the AI manipulates you?

This is the hardest version of the question, and it deserves a straight answer instead of a reassuring one.

Read-only stops an assistant from acting — it can't send, delete, or buy anything on its own. It says nothing about advice, and advice can steer people. That's a genuine limit of the read-only argument, and we're not going to claim it's solved.

What we do about it, all of it checkable rather than promised:

• Memories built from your Gmail link back to the original message, so you can check the source instead of taking the assistant's word for it.
• On Aidenly Pro, a one-tap second opinion from a different AI company reviews an answer worth double-checking.
• It's instructed to say when it doesn't have enough context, instead of guessing to sound confident.
• Your memory is visible, and you can delete any of it, permanently.
• The business is a subscription, not advertising or shopping commissions — there's nothing to gain from steering what you read or buy.

None of this depends on any AI being honest, including the second opinion. The final check is the one that always mattered: your own email, which no AI wrote.

Nobody has fully solved this. The point of building it this way is that you can check the advice instead of trusting it.

You can revoke access at any time, and you should know how

This is the part that makes the decision less frightening: connecting is not permanent, and you don't need the app's cooperation to disconnect.

Go to myaccount.google.com/permissions. Every app with access to your Google account is listed. Click any one, then Remove access. It takes effect immediately, regardless of what the app wants.

Two caveats worth knowing:

• Revoking access stops future reading. It does not automatically delete data the app already stored — that's a separate request, which is why the deletion question above matters.
• It's worth checking that page occasionally regardless. Most people have accumulated access grants from tools they stopped using years ago.

A checklist for judging any AI email tool

1. Read the verbs on the consent screen. View = read-only. Compose/send/manage/delete = far more.
2. Do the permissions match what the product does? A summariser needs to read. It does not need to send.
3. No "unverified app" warning on anything reading your mail.
4. The privacy policy explicitly says whether message content is stored, whether data trains models, and whether it's sold.
5. You know how to revoke it. (See above — takes 15 seconds.)
6. There's a real deletion path, not just account closure.
7. Could you tell if it got something wrong? A good assistant shows you where an answer came from, so you can check it instead of trusting it. If you can't trace a claim back to the email it came from, you're taking its word — and taking its word is the thing you were trying to avoid.
8. Is the limit a missing permission, or a toggled-off setting? A scope that was never granted can't be switched back on. A feature that was merely turned off can.
9. If it gives advice, not just summaries, can you check that too? A source link, an offer of a second opinion, and honesty about uncertainty all make advice checkable instead of something you're asked to trust outright.

If an app fails any of these, the answer isn't "it's definitely unsafe." It's "you don't have enough information," which for your inbox should be the same decision.

Where Aidenly stands on each of these

We'd rather state this concretely than ask you to take our word for it.

Permissions. Aidenly requests read-only access:

• gmail.readonly — to read what arrives so it can be summarised, triaged, and recalled
• calendar.events.readonly — so your briefing reflects your actual day
• openid, email, profile — to create and sign you into your account

Aidenly's access to your mailbox is read-only: it cannot send, delete, or modify your email. Those permissions are not requested, so they cannot be granted — Aidenly holds no write access to your mail, not merely as a policy but as a matter of what Google has authorised.

Verification. Aidenly completed Google's OAuth verification and an independent CASA security assessment in July 2026. You will not see an "unverified app" warning, and the assessment is renewed annually.

Storage. Aidenly does not store your email content. It reads your mail, extracts the facts and commitments that matter, and stores that — the derived memory, not a copy of your mailbox. This is an architectural decision, not a policy toggle: raw message content is never persisted.

OAuth tokens are encrypted at rest.

Training. Your data is never sold, never used for advertising, and never used to train general-purpose AI models. Aidenly's use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Control and deletion. You can see everything Aidenly remembers about you, and remove any individual memory. Deleting your account removes all associated data.

The honest caveats

Three things we'd want to know if we were you:

No security assessment is a guarantee. CASA verifies practices at a point in time. It meaningfully raises the floor; it does not make a breach impossible. Anyone claiming otherwise is overselling.

"Derived memory" is still your data. We don't store your emails, but we do store facts extracted from them — that a project deadline moved, that someone is waiting on your reply. That's less exposure than a mailbox copy, but it isn't zero, which is why you can inspect it and remove anything you'd rather we didn't keep.

Read-only is a real limit, and it's meant to be. Aidenly can't clear your inbox or send replies for you, because it can't write to your mailbox at all. Some people want an assistant that acts autonomously. If that's what you're after, Aidenly is the wrong tool — and that's a deliberate design choice about what we think should be trusted to software.

The short version

Giving an AI access to your Gmail is safe when the app asks only for what it needs, has been independently verified, is explicit about what it stores, and lets you revoke and delete on your own terms.

Those are checkable before you click Allow. The consent screen tells you the first, the absence of a warning tells you the second, the privacy policy tells you the third, and Google's permissions page guarantees the fourth.

Which adds up to a simpler rule than "is AI safe?" — a question nobody can answer for you:

Don't trust it, and don't fear it. Bound it, and verify it.

Bound it: give it only the access the job actually requires. Verify it: prefer tools that show their work, so you can check an answer instead of believing it. Do those two things and you don't need to resolve the larger argument about AI to make a good decision about your own inbox.

---

Aidenly is a private AI assistant for Gmail. It reads your inbox read-only, tells you what actually needs you, and remembers the rest so you can ask about it later. See how it works.

Google™, Gmail™, and Google Calendar™ are trademarks of Google LLC. Aidenly is not endorsed by or affiliated with Google LLC.

---