define what application canor can't access from user data through 'scopes'