Gimble Privacy Policy

2.1 Where It Comes From

• Your Google sign-in: your name, email address, and profile picture, which Gimble shows you as the person signed in. You sign in to Gimble only through Google; Gimble keeps no password of its own for you.
• Your Gmail, through the permissions you grant (Section 7.2), for each of up to five mailboxes you connect.
• You: what you type, choose, or say in a conversation with Gimble, and files you choose to add, such as a spreadsheet of contacts or a data export from another service.
• Your texts: if you text Gimble’s number, your phone number and the messages you and Gimble exchange.
• Your devices: with your permission, your phone’s contacts, and its camera to read a code you point it at (Section 3.1); and what the Gimble apps on your devices report to the Service.
• Your accounts’ websites: what a site showed, and the bills and documents it offered, when you asked one of your devices to act on it (Section 2.2).
• Other people: a person you ask for a mailing address gives it to you through Gimble, and a member of a household you share on Gimble may share an account with you.
• Outside sources: public breach records about companies; public pages and files that companies publish about themselves, such as their plans and prices, hospitals’ price files, and the files a website publishes to name its own apps; and, for the professional network, public professional profiles (Section 4).

2.2 Categories of Data and What Each Is For

• Your account and connections. Your name, email address, connected mailboxes, settings, and choices, and the Google access tokens for each mailbox, held in an encrypted secret store. Used to sign you in, to read the mailboxes you connected, and to keep your settings.
• Your account inventory. The companies your mail shows you hold an account with, how each is categorized, how much and how recently it writes to you, how you sign in to it, and whether it appears in a public data breach; and the subject line, sender, and date of each message a company sends you. Built from message headers, and from what an action on a site, a bill in your mail, or your own word shows about whether you hold the account. Corrections you make to your list — that something is or is not an account, its name, its category, or that two accounts are one — are kept as your own rules so the next scan keeps them, and are never shared with other users. Used to show you your accounts, their mail, and what needs attention.
• Facts and documents from your mail. With the read-only permission (Section 7.2), Gimble reads selected messages and attachments from the companies in your inventory and keeps the facts it extracts: loyalty programs and their balances; insurance policies and what their documents state about coverage, premiums, the people they name, and the vehicles they cover; subscriptions and what they charge; orders and what was in them; bills and loans; cards, with their last four digits and the figures their statements print, such as balances and limits; and travel bookings, with their references and seats. It also keeps the documents those facts came from — receipts, order confirmations, itineraries, statements, bills, and insurance documents from companies you hold an account with — as text, so it can read them again and show them to you. Before a document is kept, a full card, bank, loan, or routing number in it is cut to its last four digits, and Social Security numbers, codes, and passwords are removed. When Gimble’s reading of a kind of mail improves, it may read that past mail again in the same way. Used to show you these accounts and documents, to tell you what changed, and to act on them when you ask; and, where your cell phone bill shows Gimble’s own phone service would cost you less, to tell you so and keep your place on its waitlist if you join it. Apart from the household read below, Gimble reads the text of mail from a person, newsletters, and marketing in memory and does not keep it.
• Your household. The people in your family and home, you included: the names they are known by, what they are to you, and, where a source gives them, their dates of birth, email addresses, phone numbers, schools, and grades; your family’s other addresses and who lives where; your family’s cars, with their vehicle identification numbers; and which of your insurance policies name each of them. These come from what you tell Gimble, from your insurance documents, and from the household read: when you ask Gimble to read your mail closely, and again when you ask, it searches your sign-in mailbox for your family, company mail and mail between people alike, reads part of each message it finds in memory, and keeps only those facts, each with the identifier of the message it came from — never a message’s subject, text, or summary. Mail from health care providers, pharmacies, health plans, and fitness services is set aside before any AI reads it, and no household fact is about health. Dates of birth and full vehicle identification numbers are kept where the apps cannot read them, except that your Households page shows you your own household’s dates. Used to show you your household, to fill in what a task for you needs, such as an insurance estimate, and to tell your policies’ people and cars apart. When you ask Gimble to forget a person, a date, a car, an address, or a policy, it deletes it and keeps a scrambled fingerprint of it, never the thing itself, so a later reading does not bring it back.
• A household that shares. If you invite others into a household on Gimble, or join one, the household keeps who is in it and its invitations. Each member sees the others’ Gimble names and sign-in email addresses, and, for an account a member chooses to share, the company’s name, website, and category and who shared it — never its mail, figures, or password. An invitation’s link is sent by you, from your own phone or computer; Gimble keeps only a scrambled form of it.
• Facts read from your accounts’ websites. When you press an action — securing an account with a new password, retrieving an insurance policy, a program’s status, a plan, your credit standing, or your health bills, placing or lifting a credit freeze, or cancelling, resuming, or changing the plan of a subscription — one of your devices opens that site, signed in as you, and acts there. If a try fails before it finishes, Gimble may try again within limits, so one press can mean more than one visit. Gimble keeps what the site showed that the action was for, such as a policy’s schedule and the declarations page it was read from, a tier and balance, a plan and its price and the other plans offered, how the account signs in and whether the site offers passkeys or authenticator codes, or a credit score and the inquiries and accounts behind it, with each listed account’s month opened, balance, monthly payment, and standing. It tells you when a new credit reading shows something the last one did not. A subscription is resumed or subscribed again only at the price and with the payment method the site already holds; Gimble never enters card or bank details. Used to show you those facts and changes. Gimble pulls no credit report of its own, and credit figures are never used to decide creditworthiness or lending.
• Your health bills and care. When you press Retrieve on a care provider or a health plan, your device signs in to its patient or member portal and reads: itemized bills, statements, and payment receipts, kept as documents like those from your mail, and each charge, payment, or adjustment on them, with its date, procedure code, description, and amount, the visit’s type, department, and provider, the patient’s first name, and the insurer’s name; upcoming appointments and past visits; the plan’s deductibles and out-of-pocket figures, what it charges by kind of care, and your claims, with their amounts and the plan’s reason for a denial or reduction. Gimble never keeps a diagnosis or diagnosis code, a test result, a note, a date of birth, an address, or a member, group, claim, or account number, though the name of a department, an ordered test, or a claim’s reason can say what care someone received. Gimble also reads the price files hospitals must publish, which name no one. Used to show you what your care cost and what upcoming care may cost, worked out by Gimble’s own arithmetic, and to answer your questions about it. After your first Retrieve on a care provider, Gimble keeps it current: your Mac reads its appointments, bills, and plan again on their own schedules while it is awake (an AI service that keeps nothing suggests how often, from when each last changed and when your visits are), and sooner when the provider emails you about one of them, which Gimble tells from the email’s subject, read by an AI service that keeps nothing; Gimble keeps when each was read and whether it changed, never more of what was read. You can turn this off in the chat. Only you can see it.
• What you tell Gimble. Details you give about your cards, how you travel, trips you are planning, your household, and your accounts; your conversations with Gimble, kept with the page you asked on and what each answer showed or changed; and what Gimble remembers about you: short facts in your own words, kept from what you tell any conversation or add in Settings, which every conversation reads. What you say in a conversation, a date of birth or a vehicle identification number included, is kept in that conversation as you said it, and a fact about your household is also kept in your household. Used to answer you and to remember what you said. Kept until you change or delete it. Settings shows every remembered line; deleting one stops every conversation from reading it, while the conversation you said it in keeps your own words until you delete that conversation.
• Records of actions. Each action you asked for, where it ran, how many times Gimble tried it, and how it ended, in a closed vocabulary rather than anything the site showed; which of your devices can run actions; and, for each site, the steps and page layout your runs learned there so the next run needs the AI less. Used to run, report on, and improve your actions. A step-by-step record of each run, what it did on each page and how it ended, is kept unless you turn it off in Settings, so you can see what happened and so we can fix runs that fail. Passwords, codes and identifiers are removed from it before it leaves your device or the cloud machine that ran it, and it holds no pictures of the pages: those stay on your Mac, and only if you turn that on there (Section 3.4). When we look across runs to fix them, we see which site each ran on and how it ended, not what a page said.
• Your professional network. If you turn it on (it is off by default), the people you correspond with, built from the senders, recipients, and dates of your mail: their names and addresses, how often and how recently you write, where they work, and connections you import from another service. Used to answer who you know and how. Gimble may look up a contact’s public professional profile by their email address (Section 4); what such a profile says may be shown to any Gimble user who knows the same person. Gimble may also look up your own profile, by an address you proved is yours, to show which of your people you worked or studied with; that answer is kept for you alone. Nothing inferred from one person’s mail is shown to another.
• Addresses. The list of people you send cards to, from your typing, your mail’s correspondents, your phone’s contacts, or a spreadsheet; the mailing addresses people give you through Gimble, which only they can enter as their own and only the people they share with can see; an address a spreadsheet you import holds for someone, which only you see, and which is shown to that person if you send them an invitation, so they can confirm or correct it; invitations; groups whose members swap addresses, with who is in each and whether they share, where a member who shares sees the address of every other member who shares, and can stop sharing with any one of them; and where an address sits on a map. When you ask someone for their address and they have a Gimble account under that email, Gimble tells them in the app. Used to collect and keep up to date the addresses you are given. Some of this is about people who do not use Gimble; nobody is contacted because they were imported.
• Postcards and payments. The photo, words, and recipient of a card you send, with your return address when you have one on file, and a ledger of the credits you bought; and, if you subscribe to Gimble Pro, the subscription’s status and the end of the period paid for. Used to print, mail, and pay for cards, and to provide what you pay for. Your card number and billing address are typed on the payment processor’s page and never reach Gimble.
• How the Service is used. Product events (which features were used, and with what permissions), the cost of each AI call recorded under your user ID without its content, your phone’s push token, the protection level your devices last found for each account (no password, a password, or a passkey) and whether a passkey is saved for it, and, to limit sign-in attempts, a keyed scramble of the network address a sign-in attempt came from. Used to run, secure, measure, and pay for the Service.
• Facts about companies, shared across users. Which company a sending domain belongs to and how it is filed; how a company’s website works for an action, whether it issues logins, signs people in by a code, or offers passkeys or authenticator codes; which Android apps are a website’s own; and prices that differ from a service’s published plans. Each is recorded from public sources or only once several people’s scans, runs, or choices agree, and holds nothing that says who any of them are or what any one of them pays. Once a month, Gimble’s server also checks each website in people’s account lists, by its domain alone, to learn whether it exists, where it sends visitors, and which apps it names as its own. Used to make Gimble work better for everyone at that company.
• Your text conversation. If you text Gimble, your phone number, every message you send and Gimble sends, whether you asked Gimble to stop texting you, how far you are through setting up, and your time zone when you say it or your browser shows it while you connect Gmail. The messages are answered by an AI provider (Section 4.1) and carried by a messaging provider (Section 4). Used to answer you, to connect your Gmail from a one-time link, to tell you what Gimble found, and to check in, never at night where you are and never after you ask it to stop.

2.3 Limits We Keep

• Outside your vault, Gimble never extracts or keeps a full card, bank, or loan account number.
• Gimble never keeps the subject or text of mail between you and other people. The subject line of a person’s message is held only while a scan runs, the professional network records who wrote to whom and when, and the household read keeps only the family facts listed above, never mail.
• Gimble never sells your data, or shares it with anyone for advertising.
• Our service logs never contain the content of your mail.
• Gimble never filters personal mail, and never deletes or trashes any message: muting and cleanup move a company’s mail out of your inbox under a label, and you can undo it.

3.1 Your Vault

Your passwords, passkeys, authenticator codes, and other private values are kept in a vault in the Gimble app on your Mac, your iPhone, and your Android phone, encrypted on the device, and travel between your devices only inside that encryption. Gimble’s cloud service, the web app, and the providers in Section 4 never receive them in a form they can read, except a sign-in you approve for a task (Section 3.5), and there is no server-side way to give Gimble a password for another service. The key that opens each device’s copy is made on that device and kept in its Keychain, or on Android in its hardware-backed Keystore, behind its fingerprint or face, Touch ID, Face ID, or its password, passcode, or screen lock; it is never sent to Gimble, synced through iCloud Keychain, or carried to another device by a backup or a device transfer. When a payment card’s number is saved in your vault for one of your cards in Gimble, Gimble’s service keeps only identifiers showing which saved card is that card’s, and which ones you said are not, never any of the number, its expiry, or its security code.

Passwords can come into your vault from another password manager: a file you choose, or passwords that macOS moves to Gimble at your request, read on the device. To add an authenticator code, your phone reads the setup code a website shows with its camera, from a photo you choose, or from text you paste; on the Mac, when you press Add verification code in Chrome, the extension takes a picture of the tab you are on to find it. Pictures are read on the device and not kept. Your phone shows a current code only after Face ID, your fingerprint or face, or your screen lock.

When you fill a password or passkey in another app or in a browser, your device releases only the one you chose, to the app or site that asked, after you approve. When you copy a password from Chrome, your Mac places it on that Mac’s clipboard alone, marked as a password, and clears it after 90 seconds. Your devices keep an index of each saved sign-in’s website and username on the device so they can offer them; the index holds no password or key.

On Android, to offer the right sign-ins in an app, Gimble reads, for the one app asking to be filled, its name, its signing certificate, and the websites it declares as its own; for this Android lets Gimble see the apps you can open from your home screen, but Gimble reads only the app on screen and makes no list of your apps. It may fetch the website’s public file naming its own apps to check them against each other. Your phone remembers which app goes with which website. A link you choose yourself — the website, the app’s package name, and its certificate’s fingerprint — is sent to Gimble and kept as yours; once at least three people with an account at a website have chosen the same app for it, Gimble records that app as the website’s own, a fact naming no one.

If you sign in to a site in Chrome while Gimble on your Mac is locked and choose Save for later, your Mac seals the password so only your own devices can open it, and Gimble’s service holds it, with the website and username readable, until you choose Save or Don’t save on one of your devices.

3.2 Your Social Security Number

If you give Gimble your Social Security number, it is held in your vault and nowhere else. Gimble’s service never holds it, in full or in part, in any table, log, run report, or crash report. It is typed by your own Mac into the one box that asks for it, on the site of an action you started, and you may decline: the whole number only for a credit freeze or thaw, and its last four digits alone for a site that asks for them to confirm it is you. It is never sent to an AI provider: anything a run would send that still holds it is not sent at all. You may also keep the numbers of others in your household in your vault; those are never used by an action, and Gimble’s service keeps only an identifier showing that one is kept for that person.

3.3 Sync Between Your Devices and the Recovery Key

Your devices keep their vaults in step through Gimble’s sync service, which holds each saved item only as ciphertext encrypted under a key it never has, and the list of your devices (the names you gave them, their public keys, and copies of the vault key that only those devices can unwrap). It can see the shape of the activity — which devices are on your vault, when one was added or removed, and how many changes each made — but never an item’s contents or a key. When it accepts a change to your devices or your vault, you are told on your phone and, for most changes, by email.

A recovery key lets you back in when none of your devices is left. Gimble offers one once your vault holds a sign-in; you can save it to your phone’s or Mac’s password store, print it, or decline. Gimble’s service never receives it. A vault deleted from a device, or set aside because you lost every device and the recovery key, is kept as ciphertext for fifteen days so the recovery key or one of your devices can bring it back, and is then destroyed; one that nothing could bring back is destroyed at once. The sync service keeps a record that the vault existed and was destroyed, without its contents, so that restoring a backup cannot bring it back.

3.4 Other Data Kept on Your Devices

On the Mac, actions run in a browser inside a virtual machine whose cookies and sign-ins stay on the Mac, readable only by Gimble’s own helper. If you turn on “Keep run records” (off by default), the Mac keeps each run’s steps and masked pictures of its pages for 30 days; they are not sent to Gimble. The Mac app also makes a random number once and sends it to Gimble, so that signing in again on the same Mac shows it once in your devices; nothing about the Mac itself goes into it. On the phone, your Gimble sign-in is kept in the Keychain or the Android Keystore, and a page an action opens keeps its cookies on the phone. No Google token is ever on your phone. Deleting your Gimble account does not reach data on your devices: signing out of Gimble on a Mac deletes its virtual machine and run records, and your vault is managed in the app on each device.

3.5 When a Sign-In Leaves Your Devices

Some tasks need a saved sign-in where your vault is not open: your Mac while it is locked, or Gimble’s confidential cloud when none of your devices can run the task. Only when you approve on your phone, with Face ID or your fingerprint, face, or screen lock, does your phone release the one sign-in for that task’s website, sealed so that only the machine running the task can open it. Gimble’s service carries it but cannot open it. Your Mac holds it in memory for that one run and never writes it down.

In the confidential cloud, the task runs in a machine on Google Cloud whose memory is encrypted by its processor, and your phone checks what that machine is running before it releases anything. The machine holds the sign-in and the website’s pages while the task runs, and is deleted when it ends. Gimble’s staff cannot read what it holds. If a task there sets a new password, the machine makes it and seals a copy that only your own devices can open, which Gimble’s service holds, with the website and username readable, until one of your devices saves it to your vault. If you schedule tasks on your phone, one approval lets the cloud run them until the date you chose, at most ninety days off: Gimble’s service then holds those accounts’ sign-ins and website sessions between runs, sealed so that only Gimble’s measured cloud code can open them, until the schedule ends or you revoke it from any device. Your Social Security number and dates of birth are never released this way.

While a task you approved runs in the confidential cloud, you can watch its page on your phone, and if the task needs you, for example to pass a website’s check or type something only you know, it waits up to five minutes for you there. The pictures of the page, and what you tap or type, travel sealed between that machine and your phone: Gimble’s service carries them but cannot open them, and keeps only the latest picture until the next replaces it, the view closes, or the task ends.

4.1 AI Providers

What Gimble sends an AI provider first passes through redaction that removes secrets such as passwords and codes, and Gimble keeps no copy of what it sends. A question to Gimble’s chat sends your question as you wrote it, up to ten earlier turns of the same conversation, the page and card you asked it on, what Gimble remembers about you, and what the areas your question touches hold, such as your trips, cards, insurance policies, household (never a date of birth Gimble keeps), subscriptions, or health visits, claims, and plan figures; a question about your network sends the question and what Gimble remembers about you, and the answer is worked out from your own data. When you ask about a hospital that is not yours, its name and town go to the AI provider’s web search to find its website. A text you send Gimble is answered by sending Anthropic the conversation’s recent messages and how far you are through setting up; the one-time Gmail link is never among them. Reading a kept document or a health bill again sends it to the same provider as the first reading did. For actions on websites, TypeSafe decides the routine steps of a run on a site Gimble has run on before, and Anthropic the steps it hands up; a first run on a site is decided by Anthropic alone, with a picture of each page in which every typed box is painted over; and when a run goes in circles, Anthropic is sent its step log and pictures of its last pages to find a way out. Text sent to Anthropic is deleted by Anthropic within thirty days and is never used to train its models, under Anthropic’s standard commercial API terms. TypeSafe’s published terms commit it not to train its models on what it receives and state no retention period, so this policy promises none. Confidential AI processes what it receives inside confidential virtual machines and, under its published policy, does not retain it or train on it, keeping only usage records for billing and security; its processing takes place in the United States and El Salvador.

4.2 Other Outbound Requests

Company logos are fetched by Gimble’s server from logo.dev and DuckDuckGo by domain only, so your browser and apps do not contact them. Gimble’s server also reads companies’ own websites by domain alone, with nothing about you: once a month, the home page and app file of each website in people’s account lists and the price files of each hospital, and a hospital’s files when you ask about it. When your Android phone checks a website’s app file, the request carries nothing about you but your network address. Your browser loads your Google profile picture from Google. Downloads and updates of the Mac app and the Chrome extension come from GitHub’s storage, and store installs of the extension from Google, with nothing Gimble knows about you attached. The Mac’s virtual machine fetches its operating system from Debian and its browser from Google, with nothing about you. When Gimble’s service fails, a description of the error with every identifier and value removed is filed in Gimble’s own code repository on GitHub, where an AI provider may read it to find the cause.

6.1 Seeing What We Hold

Each account’s page in Gimble shows what Gimble holds about it: what was read from your mail, including its newest subject lines, and from its website. Settings lists the documents Gimble keeps, each of which you can open, every line Gimble remembers about you, and the records of your actions. Your conversations, trips, household, health bills and care, what you told Gimble about your cards and travel, your network, and your Addresses list are each shown where you use them. For anything else, write to privacy@gimble.app.

6.2 Removing and Disconnecting

• Delete a kept document or all of them, edit or delete a remembered line, remove a website reading from an account, delete a conversation or a trip, change or forget what you told Gimble, ask the chat to forget a person, date, car, address, or policy in your household, undo a correction to your account list, delete what your runs learned for a site, leave a shared household or stop sharing an account, or remove a person from your network.
• Forget a company’s mail: from the company’s page, delete what Gimble read from that company’s mail — its subject lines, facts, orders, and documents, and the insurance policies its mail made — and stop Gimble reading its mail until you ask it to remember again. What its website showed and what you said stay. Some Addresses items can be removed today only by deleting your account; someone without an account can ask us at privacy@gimble.app.
• Disconnect one mailbox: Gimble revokes that mailbox’s access at Google (unless another Gimble account connected the same mailbox), deletes its tokens, and deletes what was read from it. Your other mailboxes are untouched.
• Disconnect Gmail: Gimble revokes access to every mailbox and deletes everything read from your mail and the accounts it found, with what their websites showed. Your Gimble account, what you told Gimble yourself, your household, and the companies whose mail you asked Gimble to forget remain.
• Stop Gimble’s texts: tell it so, in any words. It won’t text you first again, and still answers if you write to it.
• Turn off the professional network: Gimble deletes everything it holds for you there, including its conversations, except the public profile facts Section 5 names.

6.3 Deleting Your Account

You can delete your Gimble account at any time, on the web or in the phone app. Gimble revokes its Google access before deleting your tokens, then deletes what it holds about you on its servers, except the shared facts Section 5 says outlive one person. That includes your Addresses data, so the addresses you shared stop being visible to others at once. Deletion is immediate, with two exceptions that protect your vault. While the sync service still holds a live vault for your account, deletion is refused until the vault is deleted from one of your devices or with its recovery key, because once the account is gone nothing could reach it. While it holds only a vault kept for recovery (Section 3.3), Gimble deletes everything read from your mail and ends your sessions at once, and deletes your user record an hour after the last hold ends (a hold lasts at most fifteen days); the screen tells you the date, and signing in again before then keeps the account.

An account whose vault you can neither reach nor set aside, or whose vault someone else started while signed in as you, is deleted on request to privacy@gimble.app. The sync service then keeps that vault, which no one at Gimble can open, with no end, because a way for us to delete it would also be a way to destroy a person’s vault. Every deletion the privacy contact makes follows one procedure: a one-time code goes to your account’s own sign-in address and must come back in a reply you wrote; a notice then says when the account will be deleted, and Gimble waits fifteen days, during which a request to stop ends it.

6.4 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete the personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: Gimble does not sell your personal information. Gimble does not share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy@gimble.app. We will respond to verifiable requests within thirty days.

7.1 How We Use It

Gimble uses data from your Gmail only to provide and improve the features you use, as Section 2 describes. It does not use it for advertising, does not sell it or transfer it to data brokers, and does not use it to decide creditworthiness or for lending. It is transferred only to the providers in Section 4 that a feature needs, for security, or as the law requires.

Your Google user data is not used to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Gimble trains no such model, and the AI providers that receive it are bound by their terms not to train on it (Section 4.1).

No Gimble personnel read your Google user data, except:

• With your explicit consent;
• As necessary to investigate a security incident; or
• As required by applicable law or legal process.

7.2 Gmail Permissions

Gimble asks for the first two Gmail permissions when you sign in or connect a mailbox, and for the others only when a feature needs them. Google’s consent screen lets you untick read-only; Gimble then works from your headers alone and asks for it again only when you choose a feature that needs it.

• Email Metadata (gmail.metadata): asked when you sign in or connect a mailbox. Reads message headers (sender, recipients, date, subject line) to find which companies hold an account for you, and, if you turn it on, who you correspond with. No message body is readable under it.
• Gmail Read-Only (gmail.readonly): asked beside metadata; if you unticked it, asked again when you turn on the deeper read or press an action that signs in to or secures a website for you. Reads the text and PDF attachments of selected company messages, and, for the household read, part of the messages a search for your family finds (Section 2.2); while an action runs, or when you ask for a sign-in code, reads that website’s own newest email for its code or reset link. It cannot change your mailbox. If you decline it, an action still runs and you enter the code yourself.
• Gmail Settings (gmail.settings.basic) and Gmail Labels (gmail.labels): asked the first time you mute a company. Create the filter and label that move that company’s future mail out of your inbox.
• Gmail Modify (gmail.modify): asked when you choose a backlog sweep or inbox cleanup. Moves mail already in your inbox out of it, and back if you undo. It also covers the deeper read, so a person who holds it is not asked for read-only. Google describes it as allowing sending and drafting; Gimble uses it only to move mail.

Gimble does not request gmail.compose, gmail.send, or full mail access, and no part of it sends or drafts a message; where it helps you write to someone, it opens a compose window you send yourself. Two Google Contacts permissions appear on Gimble’s consent screen, but no part of the Service asks for them; the people on your Addresses list come from the sources in Section 2.2.