Gmail restricted scope: is the CASA assessment required when mail is processed on-device and only a derived subscription list reaches our server?

Google Workspace Developers Q&A
,
1

Hi,

I’m building Subik, a consumer mobile app (iOS + Android) that finds a user’s paid subscriptions by reading receipts in their Gmail. It needs gmail.readonly (restricted). Before we lock the architecture, I’m trying to understand when the security assessment (CASA) applies — Google’s own pages seem to say different things:

  • The Gmail API scopes page (footnote under the scope tables): “If you store restricted scope data on servers (or transmit), then you must go through a security assessment.”
  • Restricted scope verification: “Every app that requests access to Google users’ restricted data and has the ability to access data from or through a third-party server must go through a security assessment.” (Restricted scope verification  |  App verification to use Google Authorization APIs  |  Google for Developers)
  • Help Center article 13465431 “Security assessment”: “applications requesting access to restricted scopes must undergo an annual security assessment” — no qualifier at all.

Two architectures we’re weighing:

Variant A — hybrid

  • The OAuth token is exchanged and stored only on the device (PKCE, secure storage). Our servers never hold a refresh/access token and never call the Gmail API.
  • Mail is fetched and parsed on the device. No message content, headers, or Gmail message IDs are transmitted to or stored on our servers.
  • The app writes only the resulting subscription list to our backend: merchant name, amount, currency, billing cadence, charge dates — the same fields a user could type in manually.

Variant B — fully on-device

  • Same as A, but the subscription list is stored only on the device. Our server holds only the user’s account, purchases, and push tokens — nothing derived from Gmail.

Questions:

  1. Is Variant B exempt from the security assessment (verification only), per the “no server storage or transmission” wording?
  2. Does a derived, structured list (Variant A) count as “restricted scope data stored on servers”, or only raw mail content / headers / tokens?
  3. Is there any way to get this classified before building and submitting for verification?

A very similar unanswered question from Aug 31: Does a client-only Android app with no server need the CASA security assessment for drive.readonly?

Thanks!