Permissions & your data
This page answers the questions we get most often from IT and security reviewers: which Google permissions Mail Merge requests, whether it can read your Gmail, which files it can access, and what happens to your recipient lists on our servers.
The permissions shown during installation
Section titled “The permissions shown during installation”When you install Mail Merge from the Google Workspace Marketplace, Google shows the add-on’s permission list. These are the scopes the add-on requests, and what each one is for:
| Permission (OAuth scope) | Why Mail Merge needs it |
|---|---|
script.send_mail — Send email on your behalf | Sending the emails you compose. This scope can only send — it cannot read, search, or list anything in your mailbox. |
spreadsheets — See, edit, create, and delete your spreadsheets | Reading the recipient sheet you run the merge from, and writing the 📮 status column (Sent / Opened / Error…) back into it. |
drive.readonly — See and download your Drive files | Downloading the files you attach to a campaign, including per-row attachments referenced by a Drive URL in your sheet. Mail Merge never modifies or deletes Drive files. |
drive.file — Access files you open or create with this app | Per-file access used by the file picker. |
userinfo.email | Identifying your account (your email address is your Mail Merge account id). |
script.container.ui, gmail.addons.execute, script.scriptapp, script.external_request, script.locale | Standard Google Workspace add-on plumbing: showing the sidebar and dialog inside Sheets/Gmail, calling our backend, and displaying the UI in your language. |
Can it read Gmail messages, or only send?
Section titled “Can it read Gmail messages, or only send?”It cannot read your email. The add-on requests no Gmail read scope: sending goes through
script.send_mail, which is send-only. The optional Gmail connection described below adds
gmail.send (also send-only) and gmail.metadata, which Mail Merge uses solely for reply and
bounce detection on threads that your own campaigns started — it reads message metadata
(headers), never message bodies, and never touches threads unrelated to your campaigns. This use
has passed Google’s independent security verification (CASA) for restricted scopes.
All Drive/Sheets files, or only selected files?
Section titled “All Drive/Sheets files, or only selected files?”The spreadsheets scope is account-wide by nature — that is how Google’s Sheets add-on model
works, since the add-on has to read whichever spreadsheet you open it in and write delivery
statuses back into it. In practice Mail Merge only ever touches the spreadsheet you launch a
campaign from. Drive access is read-only (drive.readonly) and is used exclusively to
download the attachments you explicitly pick or reference in your sheet; the separate drive.file
scope is limited to files you select in the picker.
Contacts
Section titled “Contacts”Mail Merge requests no Google Contacts scope and never reads your contact list. Recipients come only from the spreadsheet you provide.
Offline access (acting on your behalf while you’re signed out)
Section titled “Offline access (acting on your behalf while you’re signed out)”Yes, for one specific reason: scheduled and throttled campaigns. When you connect your Gmail account, Google issues a refresh token that lets our backend send your scheduled emails and update the status column at the time you chose, even when the spreadsheet is closed. That token is stored encrypted, is used only for the purposes above, and is invalidated the moment you revoke Mail Merge’s access at myaccount.google.com/connections.
What happens to your recipient list
Section titled “What happens to your recipient list”What our servers receive
Section titled “What our servers receive”When you launch a campaign, the recipient rows needed to send it — email addresses, cc/bcc, and the merge-field values used to personalize each message — are sent to our backend (Google Cloud / Firebase, hosted in the United States), along with the message template and any attachments. This is what makes scheduling, throttling, daily-quota handling, and open/click tracking possible.
How long it is stored, and how it is deleted
Section titled “How long it is stored, and how it is deleted”- Campaign data (recipients, personalized content, attachments) is temporary. Each campaign document carries an expiry timestamp set to 7 days after the campaign’s expected end (for a throttled campaign spread over weeks, 7 days after the last email fires). Google Cloud Firestore’s TTL process then deletes the campaign automatically, typically within 24 hours of expiry, cascading to every per-recipient record and the uploaded attachments. Deletion is automatic — no action is needed on your side.
- Deleting a scheduled campaign deletes its data immediately (same cascade: recipient records and attachments included).
- Delivery/engagement statuses (Sent, Opened, Clicked, Error) are written back into your own spreadsheet — that copy is yours and lives only in your Google account.
- Unsubscribes are kept. When a recipient clicks the unsubscribe link, we store that address flagged as unsubscribed under your account so future campaigns automatically exclude it. Keeping this list is required for compliance with the recipient’s choice.
- Your account record (email, subscription/billing status, saved templates, quota counters) persists for as long as you have an account.
To have your account and all associated data deleted, contact us — we handle deletion requests promptly.