How Grind uses Google user data
Grind’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Updated 22 August 2026
What Grind is
Grind is a desktop application for music producers, running on macOS. It indexes the beat files already on the producer’s own machine and keeps track of which beats were sent to which artist, manager or label, and what happened next.
Connecting a Google account is optional. Grind organises the library, records submissions and tracks placements with no Google account connected at all.
The permissions Grind asks for when you connect Gmail
https://www.googleapis.com/auth/gmail.send | Send an email that you composed and you triggered. This scope is send-only: it cannot read, list, label, archive or delete a single message. Google classes it as sensitive rather than restricted. |
|---|---|
https://www.googleapis.com/auth/userinfo.email | Read the address of the connected account, so Grind can show you which mailbox is linked and set the correct From header. |
openid | Required for the userinfo endpoint to answer at all. It grants no access to anything else. |
Grind deliberately does not request profile. A name and a picture are not needed to send mail.
It also deliberately does not use SMTP, which would require the full https://mail.google.com/ scope. Using the Gmail API instead is what keeps the request to a send-only permission.
The one restricted permission, and why it is asked for separately
Grind can tell you when an address bounced. That needs gmail.readonly, which Google classes as restricted.
It is never bundled into the first consent. Connecting Gmail asks for sending only. Bounce reporting is a second, explicit consent that you start yourself from Settings, using Google’s incremental authorization so the new grant carries the existing one rather than replacing it.
It is optional and refusable. Sending never depends on it: Grind records whether it was granted and every feature that would read asks first and explains why it cannot, rather than failing. Declining costs you bounce reporting and nothing else.
https://www.googleapis.com/auth/gmail.readonly | Detect that a message you sent bounced, so the site does not tell you to follow up with an address that does not exist. Nothing else reads your mailbox. |
|---|
Limited Use
Grind’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely:
- Google user data is used only to provide the features described above: sending the email you wrote, showing which mailbox is connected, and reporting a bounce.
- It is not transferred to any third party, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice.
- It is never used for advertising, ad targeting, personalisation or any form of profiling.
- It is never sold.
- No human at Grind reads your Gmail data. The only exceptions Google permits are: with your explicit consent for a specific problem, where necessary for security such as investigating abuse, to comply with applicable law, or on data that has been aggregated and anonymised for internal operations.
- No Google user data is used to develop, improve or train any generalised machine learning or artificial intelligence model.
Where the data goes
- Your beats never touch Google. They are read from the folders on your own machine. When you send a beat pack, the audio goes to your own connected Dropbox and the email carries a link.
- Message content is not stored. Grind records that a submission happened, to whom and when. It does not keep a copy of your mailbox.
- The refresh token stays on your machine, held in the operating system’s encrypted storage (macOS Keychain, through Electron’s
safeStorage). If that encryption is unavailable, Grind refuses to connect rather than writing the token to disk in the clear. - The token never reaches the interface. It stays in the application’s main process; the part of the app that draws screens can only ask whether an account is connected and under what address.
Revoking access and deleting the data
- Disconnect from Grind’s Settings. The stored credential is cleared immediately.
- Or revoke Grind from your Google account permissions. Grind detects the revocation on its next token refresh and reports the account as disconnected.
- Deleting your Grind account removes the account record. See the privacy policy for what is held and for how long.
Contact
Questions about this disclosure, or about a specific request: contact@grindapp.io. Security reports are welcome at the same address.