Waypoint is a personal file manager for Windows, made for its author’s own use. This page explains what Waypoint does with Google user data when its Mail tab is connected to a Gmail account.
What Waypoint asks for
Two Gmail permissions (Google calls them scopes), plus the user’s name, email address and picture so the app can show who is signed in:
https://www.googleapis.com/auth/gmail.modify: read mail, add or remove labels, archive, move mail to Gmail’s Bin (and back), keep drafts, and send mail. It does not allow permanently deleting mail, and Waypoint never does that.https://www.googleapis.com/auth/gmail.settings.basic: create and remove Gmail filters. Waypoint uses this only for its Mute and Block buttons and its auto-rules.
Waypoint uses these permissions only when the user asks for something in the app (for example pressing Send, Archive,
Mute or Block). It never sends, moves or changes mail on its own. Accounts connected before 15 October 2026 stay read-only
(gmail.readonly) until the user signs in once more and allows the new permission.
What it does with it
- It shows the user’s own mail, labels and attachments inside the Waypoint app on the user’s own PC.
- It changes the user’s mail only on the user’s explicit action: labelling, archiving, moving to the Bin, saving a draft, sending, or creating or removing a filter. A mail set to “send later” is held by the app on the user’s PC until its time.
- Attachments are saved or opened only when the user asks, on that same PC.
- It does not use the data for advertising, profiling, selling or training any model, and it does not combine it with other data.
Where the data goes
- Nowhere but the user’s PC. Mail travels directly between Google’s servers and the app. Waypoint has no server and no analytics.
- Nobody else sees it. No data is shared with, sent to or sold to anyone.
- The sign-in key (a refresh token) is stored in Windows Credential Manager on that PC. Mail is not stored permanently; temporary copies of opened attachments stay in the PC’s temporary folder, and a “send later” mail waits in the app’s data folder on that PC until it is sent.
- To show sender logos, the app may load a small icon from the sender’s own website; no mail content is sent with that request.
Removing access
- In Waypoint: Mail → Accounts → Sign out. Waypoint deletes the key and asks Google to cancel it.
- Anywhere: myaccount.google.com/connections → Waypoint → Delete all connections.
Google API Services User Data Policy
Waypoint’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Questions
Through GitHub: github.com/Shamilimanuel.