I didn't give it out to anybody else that Google. Google I trust implicitly because they host the server, so the email is already read by them before reaching the interface. Thunderbird stores email locally doesn't need to push it out. I wouldn't give Facebook ever access to my email account.

Why should I give Darwin access AS A WEBSITE when it's not clear to me that they NEED to run their SERVER? If the interaction is done through JS entirely and the whole thing runs in the browser between me and Google, they can easily pack it as an extension.