Google Data Use

When you connect Gmail, you grant a narrow OAuth authorization. We request only these scopes:

• https://www.googleapis.com/auth/gmail.send — permission to send email on your behalf. Used solely to deliver recruiting outreach you have authorized.
• https://www.googleapis.com/auth/gmail.metadata — permission to read email metadata (never message content). Used solely to detect when a coach replies to recruiting outreach sent through LH Sport Performance, so follow-ups stop automatically. Metadata may include Gmail message IDs, thread IDs, labels, timestamps, and email headers such as From, To, Date, Message-ID, In-Reply-To, References, and Subject when technically necessary for reply matching. This scope cannot return message bodies, and we never request them.
• openid and userinfo.email — to identify which Google account is connected so we can show it to you and send from the correct address.

• We do not read, scan, index, download, or store the contents (bodies) of your emails — the metadata permission we use cannot return message content, and we never request permissions that can.
• We do not access attachments or store message previews (snippets).
• We do not use gmail.readonly, gmail.modify, gmail.compose, or full-mailbox (mail.google.com) access.
• We do not access your contacts, calendar, Drive, or other Google services.
• Email metadata is processed only for messages connected to recruiting conversations started through the platform; unrelated mail in your inbox is not recorded.

• Sending: the gmail.send permission is used only to send the recruiting outreach messages you have set up and authorized, from your connected account.
• Reply detection: the gmail.metadata permission is used only to recognize that a coach replied to an outreach conversation (via thread and message identifiers and routing headers), record that a response exists, and stop scheduled follow-ups to that coach. Follow-up suppression may depend on this stored reply-detection metadata.

Gmail-derived data is visible only to LH Sport Performance administrators and to the athlete or family the connection belongs to. It is never exposed to other athletes or clients.

• The OAuth refresh token is encrypted at rest using AES-256-GCM before it is stored.
• It is used only to obtain short-lived authorization for the two purposes above.
• Stored reply-detection records contain identifiers and routing headers only — never message content.
• Tokens and Gmail metadata are never shared with third parties.

• We do not sell Google user data.
• We do not use Google user data for advertising.
• We do not use Google user data to train generalized or advertising machine-learning models.
• We use Google user data only to provide the user-facing features you connected it for: sending your authorized outreach and detecting replies to it.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail metadata access is classified by Google as a restricted scope. LH Sport Performance is operating as an invitation-only private beta with designated test users while Google’s verification process for this scope is completed; it has not yet been verified or approved by Google, and we do not represent otherwise.

You can disconnect your Gmail account from within the application at any time, which stops all future sending and reply monitoring for that connection. You can also revoke access directly at your Google Account’s third-party access settings. You may also request deletion of stored Gmail metadata, subject to legitimate audit and legal retention obligations — see our Data Deletion page for what is deleted and when.

If anything here is unclear, contact us at support@lhsportsperformance.com and we will explain how your Google data is handled.