You can avoid getting the emails that you are using sensitive scopes by manually setting a different email scope in your appsscript.json manifest file. You need to click the "View" menu in the Apps Script code editor, and then click "Show manifest file." If you only want to send emails, then change all your GMailApp service class names to MailApp, and put the following scope into your appsscript.json manifest file.

"https://www.googleapis.com/auth/gmail.send"

Example Manifest - appsscript.json

{
  "timeZone": "Etc/GMT",
  "oauthScopes": [
    "https://www.googleapis.com/auth/gmail.send",
  ],

  "exceptionLogging": "STACKDRIVER"
}

You must make sure that you've added all the needed scopes to your manifest file, and you can get the existing scopes used from: Files -> Project Properties -> Scopes.

Make sure to remove any existing email scopes, and replace them with "https://www.googleapis.com/auth/gmail.send"

The scope "https://www.googleapis.com/auth/gmail.send" does not require special verification from Google because it restricts your access to just sending an email, as opposed to reading, composing, deleting emails or making email settings.

The issue is whether your users will see a warning message or not when they authorize the permissions. You can publish and use an Apps Script project whether it's approved or verified by Google or not. Your project won't stop working if you don't have a publicly displayed Privacy Policy, or have the project verified by Google. And if the project is just for your own private use, then it's probably more work and more of an inconvenience to go through the verification process. So, whether you want to go through the verification process or not, probably depends on whether you have external users or not. It's pointless to post a Privacy Policy for a project that only you use.

If you do want to post a Privacy Policy to the public, then the easiest way to do that is with a Google Site. It's free, and you can get a Google Site up and working relatively easy.

The association between your project and your Privacy Policy is done in the Google Cloud Platform.

Every Apps Script project has a project ID and is listed in the Google Cloud Platform. You can go directly to the Google Cloud Platform, and then select a project:

https://console.cloud.google.com/home

Or you can open up your project in the Apps Script code editor, and click the "Resources" menu, and then click the "Cloud Platform project" menu item, and then click the blue link to go directly to your project. I suggest always going through the code editor because there are some settings that don't get displayed correctly unless you go through the code editor.

Verify your Website

• Create your website
• Open the Search Console: https://www.google.com/webmasters/tools/home?hl=en
• There is a "New" and an Old search console
• Add a new "Property" (Website URL) to the search console
• This verifies and proves to Google that you own the website
• Your website must be verified in order to add it to the Cloud Platform project

Add your website to the Domain Verification

• In the upper left hand menu, open the navigation menu.
• Hover over "APIs and Services" and then click "Credentials"
• Click the "Domain Verification" tab

Associate your Privacy Policy with the Project

• From the "APIs and Services" section, click the "OAuth Consent Screen" tab
• There is a field for "Authorized Domains". Enter your Website URL here.
• Enter links to your Home page, Privacy Policy link, and Terms of Service (TOS) link.
• Fill out any other required fields
• Click "Save"
• Make sure that there is no error message stating that something is wrong

The issue is whether your users will see a warning message or not when they authorize the permissions. You can publish and use an Apps Script project whether it's approved or verified by Google or not. Your project won't stop working if you don't have a publicly displayed Privacy Policy, or have the project verified by Google. And if the project is just for your own private use, then it's probably more work and more of an inconvenience to go through the verification process. So, whether you want to go through the verification process or not, probably depends on whether you have external users or not. It's pointless to post a Privacy Policy for a project that only you use.

If your project is a publicly published add-on, you wouldn't want your users to see a warning message that your add-on is unsafe. That's an example, of why a developer would go through the verification process, create a website, and publish a Privacy Policy and Terms of Service.

If you do want to post a Privacy Policy to the public, then the easiest way to do that is with a Google Site. It's free, and you can get a Google Site up and working relatively easy.

If you have external users, you may want to have a site with a domain name. You can purchase a domain name from Google Domains for $12 a year. Then if you have a G Suite account, you can associate the domain name with your Google Site. Of course you can use any domain name seller or hosting site to post your Privacy Policy and Terms of Service.

The association between your project and your Privacy Policy is done in the Google Cloud Platform.

Every Apps Script project has a project ID and is listed in the Google Cloud Platform. You can go directly to the Google Cloud Platform, and then select a project:

https://console.cloud.google.com/home

Or you can open up your project in the Apps Script code editor, and click the "Resources" menu, and then click the "Cloud Platform project" menu item, and then click the blue link to go directly to your project. I suggest always going through the code editor because there are some settings that don't get displayed correctly unless you go through the code editor.

Verify your Website

• Create your website
• Open the Search Console: https://www.google.com/webmasters/tools/home?hl=en
• There is a "New" and an Old search console
• Add a new "Property" (Website URL) to the search console
• This verifies and proves to Google that you own the website
• Your website must be verified in order to add it to the Cloud Platform project

Add your website to the Domain Verification

• In the upper left hand menu, open the navigation menu.
• Hover over "APIs and Services" and then click "Credentials"
• Click the "Domain Verification" tab

Associate your Privacy Policy with the Project

• From the "APIs and Services" section, click the "OAuth Consent Screen" tab
• There is a field for "Authorized Domains". Enter your Website URL here.
• Enter links to your Home page, Privacy Policy link, and Terms of Service (TOS) link.
• Fill out any other required fields
• Click "Save"
• Make sure that there is no error message stating that something is wrong