Please tell me about how to implement privacy policy site for my Google Apps Script project (mail from Google Apps Developers)

Question

I have three questions, tell me please.

【As a premise】

I have a Google Apps Script project to do these.

• Tweet automatically on my Twitter bot
• Send mail from the my Gmail address
• Read and write files on my Google Drive

I received an email with the following content from Google Apps Developers ([email protected]).

Hi Google API Developer,

We sent this email because you are listed as a contact on the following Google Cloud Project (s) using OAuth 2.0 to access Google APIs:

project-id-xxxxxxxxxxxxxxxxxxx (unique ID 1) project-id-yyyyyyyyyyyyyyyyyyy (unique ID 2)

In October 2018, we announced that in in January 2019, new Gmail API policies for restricted scopes will go into effect. We want to let you know that, starting today, you can submit your app (s) that use restricted scopes for verification. Please review the full policy and OAuth FAQ for more information including the secure handling requirement.

What you need to do If you want to use one of the restricted scopes, for verification through Google API Console (on the left side menu click Credentials, then click OAuth consent screen) between January 16th and February 15th, 2019 for the above above. Owners and editors of the project will be submitted for verification and developers with internal apps for users in the same G Suite domain do not need to do this.

If you do not take action If you do not submit for verification by February 15th, 2019, we'll disable account access for new users on February 22nd, 2019.

If you do not submit for verification by March 31st, 2019, we'll revoke existing consumer grants.

Thanks, Google Cloud Platform / API Trust & Safety

---

Follow the instructions in this mail, open Google Cloud Platform, open the [Credentials] > [OAuth Agreement] screen and press [Send for Confirmation], the following error message appears. "[Application home page] link and [Application privacy policy] are required."

---

【Question 1】

Currently, I do not have a site corresponding to [application home page] and [application privacy policy]. Does it mean that the project of Google Apps Script stops unless I create it?

【Question 2】

If I must create it, how can I create it? Are there any services that can make this possible on Google Drive?

【Question 3】

If I can created a site, how do I associate it with Google Apps Script?

---

I'm afraid that these might be basic, but could you tell me about these questions.

Answer 1

The issue is whether your users will see a warning message or not when they authorize the permissions. You can publish and use an Apps Script project whether it's approved or verified by Google or not. Your project won't stop working if you don't have a publicly displayed Privacy Policy, or have the project verified by Google. And if the project is just for your own private use, then it's probably more work and more of an inconvenience to go through the verification process. So, whether you want to go through the verification process or not, probably depends on whether you have external users or not. It's pointless to post a Privacy Policy for a project that only you use.

If your project is a publicly published add-on, you wouldn't want your users to see a warning message that your add-on is unsafe. That's an example, of why a developer would go through the verification process, create a website, and publish a Privacy Policy and Terms of Service.

If you do want to post a Privacy Policy to the public, then the easiest way to do that is with a Google Site. It's free, and you can get a Google Site up and working relatively easy.

If you have external users, you may want to have a site with a domain name. You can purchase a domain name from Google Domains for $12 a year. Then if you have a G Suite account, you can associate the domain name with your Google Site. Of course you can use any domain name seller or hosting site to post your Privacy Policy and Terms of Service.

The association between your project and your Privacy Policy is done in the Google Cloud Platform.

Every Apps Script project has a project ID and is listed in the Google Cloud Platform. You can go directly to the Google Cloud Platform, and then select a project:

https://console.cloud.google.com/home

Or you can open up your project in the Apps Script code editor, and click the "Resources" menu, and then click the "Cloud Platform project" menu item, and then click the blue link to go directly to your project. I suggest always going through the code editor because there are some settings that don't get displayed correctly unless you go through the code editor.

Verify your Website

• Create your website
• Open the Search Console: https://www.google.com/webmasters/tools/home?hl=en
• There is a "New" and an Old search console
• Add a new "Property" (Website URL) to the search console
• This verifies and proves to Google that you own the website
• Your website must be verified in order to add it to the Cloud Platform project

Add your website to the Domain Verification

• In the upper left hand menu, open the navigation menu.
• Hover over "APIs and Services" and then click "Credentials"
• Click the "Domain Verification" tab

Associate your Privacy Policy with the Project

• From the "APIs and Services" section, click the "OAuth Consent Screen" tab
• There is a field for "Authorized Domains". Enter your Website URL here.
• Enter links to your Home page, Privacy Policy link, and Terms of Service (TOS) link.
• Fill out any other required fields
• Click "Save"
• Make sure that there is no error message stating that something is wrong

You can avoid getting the emails that you are using sensitive scopes by manually setting a different email scope in your appsscript.json manifest file. You need to click the "View" menu in the Apps Script code editor, and then click "Show manifest file." If you only want to send emails, then change all your GMailApp service class names to MailApp, and put the following scope into your appsscript.json manifest file.

"https://www.googleapis.com/auth/gmail.send"

Example Manifest - appsscript.json

{
  "timeZone": "Etc/GMT",
  "oauthScopes": [
    "https://www.googleapis.com/auth/gmail.send",
  ],

  "exceptionLogging": "STACKDRIVER"
}

You must make sure that you've added all the needed scopes to your manifest file, and you can get the existing scopes used from: Files -> Project Properties -> Scopes.

Make sure to remove any existing email scopes, and replace them with "https://www.googleapis.com/auth/gmail.send"

The scope "https://www.googleapis.com/auth/gmail.send" does not require special verification from Google because it restricts your access to just sending an email, as opposed to reading, composing, deleting emails or making email settings.