Skip to content
The world does revolve around you.

Apple Mail FDA vs Google OAuth#

This page explains why Ostler reads your Gmail content via Apple Mail and macOS Full Disk Access, instead of via Google's Gmail OAuth API. The decision matters because it changes who, structurally, can see your email when Ostler processes it.

The headline

When Ostler reads your Gmail through Apple Mail, no request from Ostler ever touches Google's servers. Google is not part of the loop. There is no OAuth token to leak, no API quota to throttle, no third-party data processor to disclose, and no audit obligation to a platform that is not the one you trust.

The two paths#

Most desktop AI products that integrate with Gmail use the same approach: OAuth into your Google account, fetch messages from Google's API, process them. This works, and it is well-understood. It is also a path where Google sees every read and your AI vendor becomes a Google data partner.

Ostler takes the other path. If you have already added your Gmail account to Apple Mail on your Mac, your messages are already on your Mac, in Apple's local Mail store. Ostler reads from that local store, with your permission via macOS Full Disk Access (FDA).

Side by side#

Google OAuth path Apple Mail FDA path (what Ostler does)
Who sees the request Google, as the API provider Nobody outside your Mac
Token to revoke Yes – an OAuth token tied to your Google account No token exists
API quota Yes – limits and throttling None – local file access
Vendor needs Google API approval Yes (CASA assessment, scopes review, sometimes annual) No
You appear in Google's logs as an AI-app user Yes No
If the vendor changes hands The new owner inherits the OAuth client Nothing to inherit
If the vendor is breached Tokens may leak; Google access possible No tokens to leak
Works offline No Yes (Mail's local store)
Requires Apple Mail to be configured No Yes
Permission to grant OAuth consent screen macOS Full Disk Access prompt

Why this is the right call for a privacy-first product#

1. Direction of trust#

When Ostler reads your Gmail via OAuth, you have to trust two parties: Google (the email provider) and Ostler (the consumer of the OAuth scope). When Ostler reads via Apple Mail, you trust Apple (which already has your mail because you put it there) and Ostler (which reads it locally). Google is simply not in the loop.

If your reason for choosing a local-first AI is to take a third party out of the trust chain, the OAuth path puts that third party right back in.

2. Nothing for an attacker to steal#

OAuth tokens are bearer credentials. An attacker who steals one can pose as Ostler reading your Gmail. There is no equivalent risk in the FDA path – there is no token to steal, because the access is mediated by macOS at the file-system level, with the FDA grant scoped to the Ostler binary on your Mac.

3. No vendor-side data partnership#

The Google API path requires Creative Machines to maintain a Google Cloud project, a CASA security assessment, OAuth scopes that Google reviews and approves, and ongoing compliance with Google's API Services User Data Policy. We do not have any of those things, because we do not need them. Ostler does not connect to Google's servers on your behalf. Creative Machines is not a Google data processor.

4. No quota, no throttling, no API breakage#

The FDA path is local I/O, bounded by your disk speed. The OAuth path is bounded by Google's quotas, retry logic, and changing API surface. Local AI products that depend on the OAuth path break when Google changes the rules. The FDA path is structurally insulated from that.

5. Air-gap friendly#

If you choose to disconnect your Mac from the internet, mail you have already synced through Apple Mail is still on your machine. The OAuth path stops working the moment Google is unreachable. The FDA path keeps working.

What the FDA path costs you#

The trade-offs of this approach, stated honestly:

Apple Mail must be set up

For Ostler to read Gmail via this path, you need to add your Gmail account to Apple Mail (System Settings > Internet Accounts > Add Google account, then enable Mail), let it sync, and grant Ostler Full Disk Access at the macOS level. If you do not use Apple Mail, you would need to set it up.

This is real friction. We think it is a friction worth taking on, because the alternative – an OAuth integration – fundamentally changes who sees your email. The structural trade-off is one-time setup vs every-message-routes-via-Google.

FDA is a broad permission

macOS Full Disk Access lets Ostler read files under the protected prefixes on your system, including Mail, Messages, Notes, Photos, and browser databases. It is broader than most app permissions because macOS does not offer finer granularity per app.

We compensate at the software level: per-source opt-in at install (and changeable any time in Settings), date-range limits on each extractor, locked-content exclusion, and per-record deletion in the app. You can also revoke FDA at any time in System Settings > Privacy & Security > Full Disk Access.

What we do use Google OAuth for#

To be precise: there is one place where Ostler can talk to a Google API, and only at the user's option.

  • Calendar metadata, when you opt in. If you want Ostler to read events from Google Calendar, you can either (a) add Google Calendar to Apple's Calendar.app and let Ostler read the local Calendar store (preferred, same logic as Mail), or (b) authorise Ostler with a calendar-only OAuth scope to read events directly. Path (a) is the default and recommended; path (b) exists for users who do not run Apple Calendar.

We never use OAuth for Gmail content. The FDA path is the only path Ostler offers for Gmail.

A note on Apple's role#

When you add Gmail to Apple Mail, Apple Mail authenticates with Google on your behalf using either OAuth (Apple's OAuth client, not Ostler's) or IMAP. The messages then live in Apple's local Mail store on your Mac. Apple's privacy policy applies to that handling.

When Ostler reads from the Mail store, it is reading from Apple's local copy on your machine. Creative Machines does not authenticate with Google, does not hold an OAuth client, and does not appear in Google's audit log of API consumers.

If you do not want Ostler to see Gmail messages, do not add Gmail to Apple Mail – or untick Apple Mail in Ostler's source picker.

The general principle: prefer FDA over OAuth where an Apple-side source exists#

This decision generalises. For every integration where an Apple-side data source exists – Mail, Calendar, Reminders, Notes, Contacts, Photos metadata, iMessage – Ostler's default is to read from the local store via FDA, not to add a remote API client.

The reasons compound:

  1. We avoid becoming a data processor for the upstream service.
  2. We avoid the operational and legal cost of maintaining an API client (CASA, scopes, quotas, partner agreements).
  3. The user does not appear in the upstream service's logs as an AI-app user.
  4. The integration keeps working offline.
  5. There is no token surface for an attacker to compromise.
  6. Removing a source is one untick, not a token revocation across two services.

The cost is a one-time setup step, paid once, in exchange for a structurally better trust posture, kept forever.

We will reverse this preference for a specific source only if there is a hard blocker – for example, a data type that Apple does not surface locally and the upstream service does not export. That is not the case for Mail, Calendar, or any of the major sources Ostler supports today.

What this looks like in practice#

When you install Ostler:

  1. The installer offers a list of sources you can enable. Apple Mail is among them.
  2. If you tick Apple Mail, the installer guides you through granting Full Disk Access to Ostler at the macOS level. macOS shows its own permission prompt; you accept or decline there.
  3. After FDA is granted, Ostler reads your local Mail store and imports messages from the configured window (default: the past 365 days).
  4. At no point does Ostler ask for your Google password, your Google account, or your consent to talk to Google on your behalf, because none of those are part of the path.
  5. If you ever revoke FDA in System Settings, Ostler stops being able to read new mail.

The whole arrangement holds without Creative Machines holding an OAuth token, an API key, or any credential tied to your Google account. We hold nothing. There is nothing for us to lose.

Cross-references#