MergelineWhy does a mail merge add-on ask to read, compose and send all my email?
Updated October 29, 2026
Because to send, track replies and stop follow-ups, many tools ask for broad Gmail access through Google’s permission screen. YAMM asks to “Read, compose, and send emails from your Gmail account”; GMass’s FAQ says the screen shows it can read and manage your email. Google classes those scopes as restricted. Narrower options exist: gmail.send only lets a tool send, not read.
What the scopes mean
| Google scope | What it allows | Google’s class |
|---|---|---|
| gmail.send | Send email on your behalf | Sensitive |
| gmail.compose | Manage drafts and send email | Restricted |
| gmail.readonly | Read all your email | Restricted |
| mail.google.com | Full access, including IMAP and SMTP | Restricted |
From Google’s Gmail API scope list.
Why it worries people
A Reddit post from a developer building a privacy-focused add-on says it plainly: “most of them ask for a lot of permissions on user’s Google account data.” Restricted access is allowed, but Google says apps that store that data on servers must go through a security assessment.
How Mergeline asks for less
- By default it sends through your open Gmail tab, the same way you would, so there is no Google permission screen at all.
- If you choose Google sign-in instead, it asks for gmail.send. It asks to read mail only if you turn on reply detection through Google’s API.
- Either way, nothing goes to a Mergeline server.
See what tools store for the data side.
Before you click Allow
- Read every line on Google’s permission screen.
- Ask whether the tool really needs to read your mail, or only send.
- Check its privacy page for what it stores and for how long.
- Look for its security or assessment details if it asks for restricted access.
You can remove an app’s access later from your Google Account’s security settings, so review that list from time to time.
Why Google is strict here
Gmail holds password resets, bank notices and private conversations. That is why Google puts read access in its strictest class and asks for an extra check when that data is stored on servers.
Read the full guide: How to mail merge in Gmail
Related answers
Sources
- Google: Gmail API scopes
- YAMM: permissions needed
- GMass FAQ
- r/SideProject: privacy focused Workspace add-on
Facts checked October 29, 2026. Google and other vendors change their limits and prices, so check the source before you rely on a number.
Mergeline does this from your own Gmail. Free for 60 emails a day with merge tags and no branding. Pro is $12 a month or $99 a year for follow-ups, scheduling and attachments.