This question needs to be answered. It is NOT ok for apps like this to request blanket access to manage our contacts with no explanation. Edit: Thanks for the explanation.
Part of the challenge is that, during the auth dialog, there's no way for us to explain why we're asking for permissions. This is true across every oAuth identity provider I've done integrations with - they don't give you a way to explain why you ask for something like "Manage Contacts".
For that reason, when we ask you to connect to Github, directly below the button we link to a page about security (right now only visible to logged in users, sorry about that):
We should probably do the same whenever we ask for access to your Google Account. Really appreciate the feedback.