OAuth Review Information
OAuth and Security Details
This page summarizes the public URLs, requested OAuth scopes, data lifecycle, and support contacts for SummaFlow's Google and Microsoft email integrations.
Public URLs for Provider Configuration
- Privacy policy: /privacy-policy
- Terms of service: /terms-and-conditions
- Support URL: /support
Requested OAuth Scopes
| Provider | Scopes | Use in SummaFlow |
|---|---|---|
| Google Gmail | https://www.googleapis.com/auth/gmail.readonly | Read authorized Gmail messages and settings needed to import inbox and sent email for project classification and summaries. |
| Microsoft Graph | offline_access, User.Read, Mail.Read | Read the signed-in user's profile and authorized mailbox messages, and keep syncing while the connection remains enabled. |
Data Lifecycle
- A user signs in to SummaFlow and starts the provider connection from the Email settings page.
- The provider consent screen grants SummaFlow the requested scopes, then returns an authorization code to the backend callback URL.
- The backend exchanges the code for provider tokens and stores those tokens with the user's connection settings.
- Sync jobs fetch inbox and sent messages within configured provider limits so content can be processed for project intelligence.
- Raw email body text and raw email HTML are processed for classification, project linking, AI summaries, and timeline entries, but are not retained in production storage.
- Users can disconnect a provider to clear tokens and stop future sync. Account, metadata, generated-summary, or deletion requests are handled through support.
Security and Use Commitments
- Provider data is used only to provide project intelligence, summaries, ledgers, sync status, and support.
- Raw email body text and raw email HTML are not retained in production storage.
- Connected-account data is not sold, rented, traded, or used for advertising.
- Human access is limited to support requested by the user, security investigation, legal compliance, or abuse prevention.
- OAuth tokens are cleared when a user disconnects the provider from SummaFlow.
- Deletion and privacy requests can be sent to sever@summaflow.com.