Permissions
Last updated 1 September 2026
Core5 asks for a permission only when a feature you can see depends on it, and this page says which feature. If a line here does not justify itself, the permission should not exist.
Push notifications
To tell your iPhone that mail has arrived while Core5 is closed, the app stores a device token — an opaque identifier Apple issues for your phone — in your own row of our database. The notification we send with it is empty: it only wakes the app, which then asks Google for your mail directly and notifies you on the device. No subject, sender or content ever passes through our server. Deleting your account deletes the token.
Core5 asks for these when you connect a Google account. You can connect several, and each one chooses which modules it feeds — a work account that only fills the calendar never has its mail read.
| Permission | What it allows | Why Core5 needs it |
|---|---|---|
Google Calendarcalendar | Read and write your events | Drawing your week, and letting you create, move, delete and colour events from Core5. Without writing, the calendar would be a picture of your diary rather than your diary. |
Gmailgmail.modify | Read, send, and change labels | Showing your inbox, sending your replies, and archiving, flagging or marking read — which in Gmail's model are label changes. Core5 never deletes permanently: it moves to your bin, where you have thirty days to change your mind. |
Your Google profileuserinfo.profile · email | Your name and email address | Naming the account in the app and labelling which of your addresses a message arrived at. It is also how Core5 shows your own name correctly instead of guessing it from your address. |
Your mail is never copied to our servers. Messages travel between your device and Google directly, and are cached on your device so the app works offline. When a mail arrives, our server is told only that a mailbox changed — never who wrote or what about; your phone then asks Google itself and writes the notification locally.
Your Google permission is held in two places. On your devices, in the system keychain protected by the hardware. And on our server, encrypted with a key that lives outside the database, so that one thing can happen without any of your devices being switched on: keeping your instant mail alerts alive. You can revoke it at any moment — from Core5, by disconnecting the account, or from your Google account page.
Core5's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Taking it back
Disconnect the account in Settings → Account, and the tokens are destroyed on the spot. You can also revoke Core5 from Google's own side at myaccount.google.com/permissions.
The optional connections
None of these are needed to use Core5, and none are on unless you turn them on.
Slack
Send a task or a summary to a channel, and turn any Slack message into a Core5 task with a right-click. Core5 reads nothing else in your workspace.
Notion
File work into a Notion page or database when a rule you wrote says so.
HubSpot
Read contacts, companies and deals so an open email can tell you who is writing to you. Read-only.
Claude
Connect Core5 as an MCP connector and ask Claude about your own work. It sees exactly what you see — the request carries your session, and the database applies your permissions, not ours.
Why every one of these keeps a token on the server. All of them have to act while the app is closed: a rule that files a task has to run whether or not your Mac is awake, and a mail alert has to reach your phone without any device of yours being switched on — Apple will not wake a sleeping app, and Google will not call a phone. So their tokens are stored encrypted on our servers, with the key kept outside the database.
Google's is treated as the strictest of them, because its key opens your whole mailbox. Its row can be read by no person and no client — not even by you from inside the app — and the server uses it for exactly one automated job: keeping your mail alerts alive. It never reads a message. What reaches your phone carries no sender and no subject; your phone asks Google itself.
What Core5 never asks for
- Your contacts. The addresses Core5 suggests are learned from your own mail, on your device.
- Your location, except the place you type into an event yourself.
- Your camera, microphone or photos, unless you attach a file.
- Anything at all for advertising or analytics. There is none of either.