They used a legit google oauth but with broad rights. They did pull the contact and repeatedly spam them as personal emails. There were lawsuits.