> "Before a non-Google app is able to access your data, we show a permissions screen that clearly shows the types of data the app can access and how it can use that data," Ms Frey said.

This sounds like the OAuth-based permission screen that Google has used for years. If so, the article is very poorly written. It’s not that hundreds of apps can access someone’s email, it’s that any apps the user has explicitly granted fine-grained access to can access their email.

The permission screen is very clear. It says “view and manage email” if the app requests that: https://developers.google.com/apps-script/guides/services/au...