On September 19, 2023, Google promised that content from Gmail, Docs and Drive connected to its chatbot "is not seen by human reviewers." On October 16, 2026, Google added a note underneath that sentence saying the same data can now face human review "in limited circumstances." I read both pages myself — the promise is still there, and so is the caveat.
I fetched Google's Gemini Connected Apps help page (support.google.com/gemini/answer/16836988) directly and read it end to end, then pulled up the September 2023 Bard post it descends from. Everything below is quoted from Google's own pages, except for one section — the independent researcher's reproduction — which I label as his claim, not Google's.
From Google's September 19, 2023 post launching Bard Extensions: "We're committed to protecting your personal information. If you choose to use the Workspace extensions, your content from Gmail, Docs and Drive is not seen by human reviewers, used by Bard to show you ads or used to train the Bard model."
Three guarantees in one sentence: no human eyes, no ads, no training. The sentence is still live on the post today. What changed is what sits directly underneath it, added October 16, 2026:
"(Update, October 16, 2026: You can view the latest about how some new features work here. If users choose to enable these new features, data from Workspace Apps will be processed to personalize other Google experiences, and depending on a user's settings, that same subset of data can be used to train generative AI models. It can also be subject to human review in limited circumstances.)"
Google didn't delete the promise. It narrowed it with a dated footnote, and the narrowing is doing all the work: the original guarantee now describes the original Workspace extensions, while the newer Personal Intelligence features — the ones that connect Gmail, Drive, Photos, Calendar and Wallet to Gemini for personalization — fall under the help page's rules instead.
The Connected Apps help page, "About personalization with Connected Apps," is blunt in a way privacy pages rarely are. Four quotes, verbatim:
On who reads it:
"a subset of Connected Apps data processed by Gemini is reviewed by human reviewers (including trained service providers) to debug our services, help keep them safe, and improve them."
On what they can see:
"Interactions, summaries, excerpts and inferences from your relevant emails and files. In some cases, for example, where the email or file is brief or particularly relevant to respond to the prompt, the summary may just be the email or file."
Read that again: the "summary" a reviewer sees can be the email. Not a redacted extract of it. The whole thing, when it's short or relevant enough.
On what you should do about it:
"Important: Please don't connect your apps to Gemini Apps if they contain confidential information that you wouldn't want a reviewer to see."
On deleting your data after the fact:
"You can delete your Gemini Apps activity to prevent it from being used for future product improvement, unless it has already been reviewed by trained reviewers."
Deletion stops future use. It does not claw back anything a reviewer already saw.
There are two limits in Google's favor, and they're worth stating precisely. First, Google says it does not train generative AI models "directly on your Gmail inbox, Drive, Contacts, Calendar or other Workspace apps." What it trains on is the layer above: "summaries, excerpts, generated media, and inferences" drawn from them, when your Keep Activity setting is on. The distinction matters — your inbox isn't the training set, but the digest of your inbox can be. Second, before contractors review anything, Google says it disconnects the interaction from your account and reduces personal information in the data, "unless it's to address abuse or harm."
The story broke because of a GitHub write-up, not a Google announcement. Researcher thisisme6598 published gemini_files on November 9, 2026, documenting what he says is Gemini's retrieval behavior on a personal account: mention a trip, a bill, or a name in casual conversation — no @drive or @Gmail tag — and Gemini sometimes pulls the matching email or file into the session anyway. He describes four outcomes, from zero retrieval to the full unredacted text of a document landing in context, and says the result is probabilistic: run the same prompt twice and you can get different outcomes.
I did not reproduce his test — I don't have a personal Gemini account with Connected Apps to probe, and his own write-up is explicit that a single run proves nothing either way. Treat the background-retrieval claim as his finding, not Google's admission. What Google has admitted, on its own help page, is the part that makes his finding matter: once that content is in a Gemini session, a subset of it is reviewable by humans, and a short email can be the excerpt itself.
One more boundary from the researcher's own November 10 clarification: this applies to consumer (@gmail.com) accounts. Workspace business, enterprise and education accounts operate under separate data-processing terms that exclude human review and external training by default. If your employer pays for Google Workspace, this story is not about you. If you connected your personal Gmail to Gemini, it is.
Three settings, in order:
The honest summary of the week: Google kept its 2023 sentence and changed what it means. The promise was "no human reviewers." The current policy is "human reviewers, on a subset, of summaries and excerpts that can be the whole file." That's not a contradiction on paper — the footnote does the legal work. But if you connected Gmail to Gemini in 2023 because of that sentence, the deal you agreed to is not the deal you're on now, and nobody emailed you to say so.
Sources: Google, "About personalization with Connected Apps" (Gemini Apps Help, support.google.com/gemini/answer/16836988, fetched November 11, 2026); Google, "Google Bard September update: App extensions and new features" (blog.google, September 19, 2023, with October 16, 2026 update note); thisisme6598/gemini_files (GitHub, November 9, 2026). I could not test the background-retrieval claim hands-on; it is attributed to the researcher above.