Google access · Your choices
What Luma asks for, and why.
Luma Mail is an independent desktop email client. Google consent happens in your browser; your password stays with Google. The installed app connects directly to Google's APIs, with no Luma mail-processing server. Gmail access provides ordinary email functionality. Contacts, Gmail settings and Drive are optional additions offered together at sign-in.
These are the four OAuth scopes used by the current application. A fresh account can decline optional access and keep Gmail usable. Previously granted permissions may appear in Google's existing-access section. Enabling or disabling a local feature is different from revoking Google's authorization.
Required for mail
Gmail messages and actions
https://www.googleapis.com/auth/gmail.modify
Features: paged inbox and folder views, Gmail search, opened message bodies and attachments, composing and sending, reply/forward, online drafts, labels, read/unread, stars, importance, archive, recoverable Trash and restore.
Why a narrower permission cannot provide this: read-only access cannot send or change messages; send-only access cannot read or organize them; draft/compose access does not provide a complete inbox with read/star/archive/Trash actions. Luma uses gmail.modify rather than the full https://mail.google.com/ scope and does not implement immediate permanent deletion.
Controls: disable an account in Settings to stop its background use, or Remove account to disconnect it. Revoke Luma through Google Account connections to withdraw authorization. Mail and online drafts remain in Gmail.
Optional
Gmail sender filters and online signatures
https://www.googleapis.com/auth/gmail.settings.basic
Features: Block sender creates a sender-specific Gmail filter that sends future matching mail to Trash, including while Luma is closed. Unblock removes only an unchanged filter owned by Luma. The online signature editor reads and updates the selected primary sending address's Gmail signature, which affects Gmail web as well as Luma.
Why needed: ordinary message modification does not authorize creating Gmail filters or writing a sending address's signature. Google provides no separate filter-write-only or signature-write-only OAuth scope. Luma does not request gmail.settings.sharing for forwarding or delegation.
Controls: skip Gmail sender controls at initial sign-in. Manage Luma's rules through Settings → Blocked senders → Unblock, or Gmail's Filters settings. A per-message Include signature choice controls insertion into outgoing Luma mail; the online signature can be edited in Luma or Gmail. Remove the account and revoke its Google connection to stop further settings access. Disconnecting does not undo existing server-side filters or signatures; remove unwanted rules or restore the signature first.
Optional · read only
Saved-contact profile pictures
https://www.googleapis.com/auth/contacts.readonly
Feature: show an available photo for a visible sender whose exact email address matches a saved Google Contact. The People API request uses people.searchContacts with readMask=emailAddresses,photos. It does not mirror the address book or edit, create or delete contacts.
Why needed: Gmail's message API does not expose sender contact pictures. Read-only Contacts is the narrowest supported scope for matching private saved-contact email addresses to their photos; public profile-only access cannot provide those matches. This does not expose every private profile picture that Gmail itself can display. Unmatched senders use initials.
Controls: decline Contacts at sign-in or turn off Contact photos for that account in Settings. Disabling releases the app's bounded photo memory and stops further contact-picture requests. It does not revoke the existing Google grant; use Google Account connections to revoke authorization. Recent-recipient suggestions are a separate optional list of successful sends made in Luma, not a Contacts sync.
Optional · app-limited files
Drive links and hosted signature pictures
https://www.googleapis.com/auth/drive.file
Features: upload selected large attachments to Drive and insert a filename link. Sending can grant read-only access to the recipients you confirm. An explicitly confirmed local signature-picture upload creates an optimized app-owned Drive copy with public, unlisted read-only link access so recipients can display it. Anyone with that link can access that copy. When Drive and contact photos are enabled, a limited Drive about/user request may also supply the connected account's own address/photo; it cannot retrieve arbitrary senders' photos.
Why this scope: drive.file limits access to files created or explicitly authorized for the app, instead of requesting broad full-Drive access. The current preview focuses on app-created uploads; existing-file selection and interruption/sharing recovery remain documented release work.
Controls: decline Drive at sign-in or turn off Drive links in Settings. Ordinary attachments within the email size limit still work. Cancelling an upload stops that operation. Turning off Drive or disconnecting does not delete existing files or undo sharing; manage those copies and permissions in Drive. Revoke Luma's Google connection to withdraw authorization.
Storage and privacy
Optional original-body caching defaults to 100 MiB, supports a zero-cache mode, expiry and clear controls, and does not create a whole-mailbox mirror. Drafts stay in Gmail. Received image pixels, contact photos and attachment previews use bounded memory. Essential settings, OS-stored credentials, optional bounded recent recipients, runtime metadata and deliberate downloads have separate retention rules. See the complete privacy policy.
Google review is still in progress. This page documents behavior and permission use; it does not claim Google approval or a completed 1.0 acceptance audit.