We are developing a local Windows/Python application for one operator and would like to clarify whether its intended Gmail API usage complies with the Google Workspace User Data and Developer Policy before enabling access to real Gmail data.
Current behavior:
-
The operator manually starts the application.
-
It uses Desktop OAuth with PKCE and requests only
gmail.readonly. -
It retrieves a limited number of selected Upwork job-alert emails in RAW format.
-
It verifies DKIM signatures and processes MIME in memory.
-
It stores extracted job titles, descriptions, URLs, and deduplication metadata in a local SQLite database.
-
It does not persist full RAW messages or attachments.
-
The importer does not invoke external AI services or automatically send job applications.
-
The current SQLite records have no automatic expiry mechanism.
We understand that Google’s policy permits certain productivity, CRM, and email monitoring use cases, while excluding applications that export email on a one-time or manual basis.
Could you clarify:
-
Would this specific workflow qualify as permitted productivity/CRM functionality, or as prohibited manual email export?
-
Is storing extracted job descriptions and associated metadata in SQLite permitted?
-
What retention, caching, and backup restrictions would apply?
-
Would storing metadata only, without descriptions, materially change the policy classification?
-
Is there an official channel that can provide an authoritative policy determination for this use case before OAuth testing?
We are seeking guidance on the application’s actual behavior, not an exemption from the policy.
Thank you.