[TheRealPomax]

But the responsible thing to do here is to _throw all that data away_, and force everyone to explicitly grant gitter access to their account again.

With only as many rights as necessary, of course. No app needs full account access, all the time. Make the various parts differently authenticated layers.