We previously requested 5 permissions from you to integrate with Google Drive, two of which relate to being able to view all the images stored in your Drive. These image permissions have caused some privacy complaints (the other 3 cannot be avoided, anyway), so we've removed them. The permissions dialog now looks like this:
- View your basic profile info. This is provides your name, Google ID, gender, timezone, language, country, profile image and profile URL. We display your name and profile image on the client. We do not pass any of this information up to our servers, ever.
- View and manage Google Drive files that you have opened or created with this app. This means if you created the file with draw.io, draw.io has the permission to open it again. It also means if you open a draw.io diagram with the picker in the application, or open someone else's diagram in drive.google.com, the diagram opens and draw.io has access permissions to the file from now on. The scope of this permission is important because it means (unlike most other Drive linked applications) that we do not have access, read or write, to all the rest of your Drive files.
- Add itself to Google Drive. The permission is implicit to the whole permissions operation, it means add the application as one that is able to interact with your Drive using the above permissions, it's not a new permission in it's own right.
The removed images permission enabled us to display an images dialog that you could pick your images from Google Drive directly to drop into a diagram. Obviously, most of us have images that are personal to some extent and don't want a third-party application to be able to access, so this new setting makes sense privacy-wise.
We haven't removed the functionality completely, only removed the permissions scopes by default. If you want the functionality back for a session load this URL - drive.draw.io?photos=1. If you install draw.io after the permissions change (9th January 2015), and set the photos parameter, you'll be prompted again to add the new images permissions on the app before you can use it: