Hi,
I’m a solo developer building an Android digital photo frame app. It turns a tablet into
a picture frame that shows the user’s own photos as a slideshow.
I would like to request the restricted scope
`https://www.googleapis.com/auth/drive.readonly\` so that a user can point the app at one
folder in their own Drive and have new photos appear on the frame automatically.
Architecture, stated precisely:
- Android app only. There is no backend of any kind — I operate no server at all.
- The app calls the Drive REST API directly from the device.
- Photo bytes are downloaded from Google straight to the device and displayed. They are
cached only in the app’s private cache directory on that same device.
- The OAuth access token is held in memory only. It is never written to disk and never
transmitted anywhere.
- No Drive data — file contents, metadata, or tokens — ever leaves the user’s device.
- No analytics SDK, no crash reporting, no advertising SDK.
My question is specifically about the security assessment, not about verification
itself. I understand the app needs OAuth verification regardless, and I’m prepared for that.
What the documentation says
The restricted scope verification page states:
> "Every app that requests access to Google users’ restricted data and has the ability to
> access data from or through a third-party server must go through a security assessment"
The Google Developers Blog post *Get smart about preparing your app for OAuth verification*
states:
> "Storing data in the cloud or on your own servers will require you to obtain a third-party
> security assessment (at your expense)"
and:
> "If your app is purely mobile, with no server-side component, you will still need a privacy
> policy, but it may be very simple and describe that your app only stores data on a user’s
> device."
Read literally, both suggest the annual third-party CASA assessment is triggered by
transmitting or storing restricted-scope data on a server, and that an app like mine would
not need one.
However, the OAuth verification FAQ says the assessment tier is calculated from, among other
things, *“the amount of users per type of data accessed”*, which suggests that user volume
alone can raise the tier.
My questions
1. For an Android-only app with no server, where restricted-scope data never leaves the
user’s device, is the annual third-party security assessment (CASA) required or not?
2. If it is not required at launch, can it later become required purely because the app
grows to a large number of users, with no change to its architecture?
3. Is there a way to confirm this before I build the feature? Submitting for verification
requires a working implementation of the restricted scope plus a demo video. I would
rather not build that and then discover a recurring annual cost I cannot sustain as an
individual developer.
Thank you very much.