[Rian Stockbower (rianjs)]

📖 Description

OpenCLICollective.google-readwrite version 2.0.13. This submission now:

• Links PrivacyUrl to the Open CLI Collective policy covering Google account data, local state, retention/deletion, and revocation.
• Labels the package as unofficial in ShortDescription and Description, with an explicit statement that it is not affiliated with, sponsored by, or endorsed by Google.

winget validate and local Windows install validation were unavailable on this macOS host. Upstream manifest validation is running on this PR.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue (if applicable)
  • Resolves #[Issue Number]

📦 Manifest Checklist

• Checked that there aren't other open pull requests for the same manifest update/change
• This PR only modifies one (1) manifest
• Validated manifest locally with winget validate --manifest <path> (validation guide)
• Tested manifest locally with winget install --manifest <path>
• Manifest conforms to the 1.12 schema

Note: <path> is the directory containing the manifest.

Microsoft Reviewers: Open in CodeFlow

[microsoft-github-policy-service]

 

[microsoft-github-policy-service]

The check-in policies require a moderator to approve PRs from the community.

Our moderators are community volunteers, please be patient and allow them sufficient time to review your submission.

Template: msftbot/requiresApproval/moderator

[Demitrius Nelon (denelon)]

Rian Stockbower (@rianjs)

This product requests broad OAuth access to personal and authenticated Google account data, including Gmail messages, calendars, contacts, Drive files, account identity, OAuth credentials and tokens, and locally persisted profile/cache information. Under the Windows Package Manager repository Personal Information policy, the product needs a public, product-applicable privacy policy, and each manifest intended to remain open needs a PrivacyUrl linking to it.

Please publish a privacy policy that accurately explains the relevant data practices, including:

• what Google account data and credentials the product accesses;
• what is transmitted to Google APIs or any other processor;
• what profile, token, identity, scope, and Drive-cache information is stored locally;
• retention and deletion behavior, including account/profile removal;
• security protections and how users can revoke access.

Because this is a third-party project using the protected Google name in its repository, package name, and registry aliases, please also add a prominent statement explaining that it is unofficial and is not affiliated with or endorsed by Google, and make the submitted metadata clearly reflect that relationship.

There are currently four open submissions for this package, through version 2.0.13. Please apply these corrections to the newest submission first and update or close the older submissions as appropriate.

Drafted with GitHub Copilot assistance.

Template: moderator/triage/authorNudge

[Rian Stockbower (rianjs)]

Verification assessment — WinGet PR 440393

P0 — PrivacyUrl passes URL validation while failing the required product-policy check

PrivacyUrl returns HTTP 200, but its public content is only the generic Open CLI Collective policy. It contains no google, gro, grw, OAuth, token, cache, retention, deletion, or revocation disclosure, and says projects do not intentionally store personal information. That conflicts with the approved plan and the moderator request for a public, product-applicable policy covering grw's Google data and local credential/cache behavior. Schema, URL, domain, and policy checks therefore can all pass while this requirement remains unmet.

Required gate before treating the PR as ready: fetch the submitted PrivacyUrl without authentication and assert a grw section covering accessed data/scopes, transmissions, local storage, retention/deletion, security, and Google revocation. Publish that policy before rerunning review.

P1 — Install behavior is not yet verified end to end

The archive preflight is good: both declared SHA-256 values match, each ZIP contains grw.exe, and the executable architectures match x64 and arm64. But no local Windows winget validate or winget install --manifest evidence exists (the PR checklist remains unchecked), and WinGet checks 08 Installation Validation and 09 Installer Metadata Validation were pending at assessment time. A valid ZIP and hash do not prove extraction, portable alias registration, or invocation through grw.

Required gate: wait for both checks to pass, then on Windows run winget validate --manifest <version-folder>, install the local manifest, and invoke grw --version (or the package's harmless version command) to prove the portable alias works.

[Rian Stockbower (rianjs)]

Demitrius Nelon (@denelon) Thanks for the guidance. The shared policy is now public at https://github.com/open-cli-collective/.github/blob/main/privacy-policy.md after merge of open-cli-collective/.github#50. It covers the Google account data and scopes, OAuth/API transmissions, local profiles/tokens/identity and Drive cache, retention/deletion, and Google revocation steps.

The corrected 2.0.13 read-write locale manifest in this PR now includes that PrivacyUrl and prominent Unofficial plus no-affiliation wording in the submitted metadata. The separate metadata-only PR #442664 applies the same PrivacyUrl and unofficial attribution to the published 2.0.13 read-only manifest, with its description accurately covering Gmail organization and Calendar, Contacts, and Drive reads.

I could not run winget validate or a local Windows install on this macOS host; the upstream validation jobs are running on the PR.

[microsoft-github-policy-service]

The check-in policies require a moderator to approve PRs from the community.

Our moderators are community volunteers, please be patient and allow them sufficient time to review your submission.

Template: msftbot/requiresApproval/moderator