Google Sign-in Tokens Live On Even After App Deletion

When users sign in to an app using their Google account, they may not realize that this action grants access to the service on Google's servers. This token lives on for six months or until it is revoked, and a new password only revokes tokens carrying mail scopes.

This means that even after deleting the app, users still have unrevoked access to their data. According to Google's developer documentation, a refresh token stops working when the user revokes access, changes the password (if the token contains Gmail scopes), or when an administrator restricts a service.

However, simply uninstalling the app does not revoke access; it only removes the app from the device. The token remains on Google's servers until it is manually revoked by the user.