Act todayWhat happenedA public write-up claims Google reversed its 2023 promise and now says connected Gmail and Drive content can reach human reviewers, with Gemini sometimes pulling it in unprompted.
Who is affectedPeople who link Gmail, Google Docs or Drive to the consumer Gemini app, including small business owners who keep client or billing details there.
What to do- 1Open Gemini settings and check whether Connected Apps for Google Workspace is turned on.
- 2Turn it off if your email or files hold bills, account numbers or client data.
- 3Read Google's Gemini Apps help page on human review to see the current wording.
- 4Avoid typing private details into Gemini chats while the connection is on.
If Gemini is connected to your Gmail or Google Drive, a person working for Google may be able to see parts of your private emails and files. That is the claim in a public GitHub write-up that drew more than 100 points on Hacker News. The author says Google quietly changed a promise it made in 2023.
What changed
When Google launched Gemini's Workspace extensions in 2023, it said personal content from Gmail, Docs and Drive "is not seen by human reviewers." The write-up says Google edited that 2023 blog post on October 16 and updated a help page. It says the new wording confirms connected emails and files can go into human review.
As quoted by the author, Google now warns that reviewers "may just be the email or file." It also tells users not to connect apps that hold confidential information they would not want a reviewer to see.
What the testing found
The author says Gemini looked into email and files without being asked, with no special tag. Casual mentions of trips, bills or reservations were enough. Results changed from try to try. The author reports four outcomes:
- Nothing was pulled from Gmail or Drive.
- A general summary, such as a count of emails about a flight.
- A short quote, sometimes with account details or figures.
- The full text of the email or file.
In one test, the author asked if they were overpaying for internet. Gemini sometimes answered generally. Other times it quoted the provider's email, including name, address, account number and payment date.
Who should worry
The people most exposed are those who link Gmail, Docs or Drive to the consumer Gemini app. That includes small business owners whose inboxes hold client names, invoices or billing details. The author also argues Google's automatic tools for hiding personal details cannot fully clean up this kind of text. That is the author's view, not a confirmed finding. The alert box above lists the steps to take.
Who can relax
People who never connected Gmail or Drive to Gemini are not covered by this claim. Anyone whose connected accounts hold nothing sensitive has less to lose. Even so, the author notes that the connection can pull in material without being asked, so it is worth knowing whether it is on.
What happens next
This is one person's testing, not a Google announcement. It is not yet clear how often reviewers actually see connected content, or whether Google will respond to the write-up. The help page wording is the best thing to check, since Google controls what it says.
The takeawayIf Gemini is linked to your email or files, assume a human reviewer could see what it pulls in, and turn the link off if the contents are private.