After you install Email Notifications, the Google Forms add-on will require certain permission to access services associated with your Google account. The app only requests permissions that are absolutely necessary for the core functionality of the app.
The source code of the Google Forms add-on has been completely audited by security vendors appointed by Google and the app has been found 100% compliant with the Google API policies. If your organization requires a copy of the audit certificate, we'll be happy to provide.
The add-on sends email notifications directly from your Gmail account. The add-on does not read, delete or manage your email, it only requires Gmail access to send email on your behalf.
The add-on lets you send emails on behalf of any email account that is added as an alias to your Gmail account. It requires access to basic email settings to know about the various email aliases that are connected to your Gmail account.
The add-on needs permission to your Google Forms to send notifications when a form response is received. It also requires forms access to read the form fields and the response data for sending email messages.
The add-on connects to the licensing server to verify your license and enable premium features for paid users. It also connects to IFTTT service to help you send mobile notifications when a new form is submitted.
The core function of the Google Forms add-on is to send emails. Thus it requires permissions to send emails on your behalf.
The add-on sets up a form submit trigger that sends an email when a new form is submitted. This will happen in the background even while are you are signed out of your Google account.
All the app settings and configuration are stored inside your Google account using the PropertiesService of Google Apps Script. You can create new rules and modify existing rules from the sidebar that opens up inside Google Forms editor.