AI Email Assistant Privacy Report 2026: Training, Retention, and Access

The major email AI products reviewed here say third-party model providers do not train on customer email content, but the guarantees are not identical. Google says Gemini in Gmail does not use personal emails to train foundational models and does not retain Gmail data; Microsoft says Microsoft 365 Copilot conversations are not used to train its generative models; Shortwave says email is not used for third-party LLM training; Superhuman says its AI subprocessors cannot train on customer data, while its broader privacy policy gives users controls over whether Superhuman may use user content to train its own models. Product boundary, account type, retention, and first-party versus subprocessor training all matter.

This is a documentary policy review dated July 30, 2026. We did not test model memorization, inspect network calls, audit access controls, or evaluate enterprise contracts. Vendor promises are attributed, and contradictory-looking statements are presented rather than smoothed over.

Why “does it train on my email?” is too narrow

Training is one possible use. An assistant can truthfully say “not used for training” while still:

• retrieving full message bodies and attachments to answer a prompt;
• storing vectors, summaries, memories, or logs;
• letting human support review content after feedback;
• sending content to subprocessors for inference;
• using metadata and product activity for analytics;
• exposing more mail than intended through weak permissions or prompt injection.

A real review needs four separate questions:

1. What mailbox content can the product access?
2. Where is that content processed?
3. What is retained, by whom, and for how long?
4. Can first-party or third-party models learn from it?

Policy comparison

Product	Published training position	Published retention/access signal	Boundary to watch
Gemini in Gmail	Google says personal emails are not used to train foundational AI models	Google says Gemini in Gmail does not retain Gmail data	Sharing Workspace data into separate Gemini Apps/Search can invoke different terms
Microsoft 365 Copilot in Outlook	Microsoft says M365 Copilot conversations are not used to train generative AI models	Processes mailbox/Graph context under Microsoft 365 protections	Consumer Copilot and work/school M365 Copilot are not interchangeable policy surfaces
Superhuman Mail AI	Says AI subprocessors have zero-day retention and cannot use data for training	Product accesses emails/drafts; marketing says it logs custom instructions, not email data or AI responses	Broader privacy policy includes controls over Superhuman's own use of user content for AI training
Shortwave	Says email content is never used to train third-party AI models	Names Google Cloud, OpenAI, Anthropic, and Pinecone as subprocessors for its AI stack	“No third-party training” does not equal no content processing or no first-party derived data
Flick AI drafting	Email bodies do not live on Flick servers; draft thread is processed transiently for inference and not used for model training	Encrypted tokens and minimal metadata persist; draft body is request-scoped	This is Flick's first-party architecture claim, not an external audit

No row earns a universal “private” label. A product suitable for a personal mailbox may still violate an employer's policy, contractual confidentiality, or regulated-data rules.

Gemini in Gmail

Google's April 2026 explanation says it does not train foundational AI models on personal emails and that Gemini in Gmail does not retain the Gmail data it uses. Google also says prompts are handled privately.

The more detailed Workspace help documentation draws a product boundary:

• Gemini features inside Gmail and other Workspace apps use Workspace content to answer prompts.
• That content is not used to train or improve Gemini or other generative AI models.
• If a user deliberately shares Workspace data with separate Gemini Apps, Search Personal Intelligence, or screen actions, the receiving product's terms apply and the data may be used for model improvement.

This is why “Google” is not one privacy setting. Gemini in Gmail, the Gemini app, AI Mode in Search, and an enterprise Workspace account can have different terms. Evaluate the exact surface visible in the workflow.

Google launched AI Overviews, writing tools, and a test AI Inbox during 2026. The feature direction increases the amount of mailbox context a user may ask the system to synthesize, even if the training rule stays unchanged. Data minimization therefore still matters: do not ask a broad inbox question when one selected thread is sufficient.

Microsoft 365 Copilot in Outlook

Microsoft's Copilot privacy FAQ says conversations from Microsoft 365 Copilot remain read-only to the user and are not used to train Copilot's generative AI models.

Outlook's current Copilot features can summarize threads, draft responses, prioritize incoming messages, and act on mail through triage commands. Microsoft's Prioritize documentation says the system evaluates factors including people, job titles, and email content, then assigns priority and explains its decision.

The privacy promise must be read with the account boundary:

• Microsoft 365 Copilot with a work or school account sits inside enterprise data protection.
• Consumer Copilot and personal Microsoft 365 experiences can have different training choices and privacy terms.
• Copilot respects the access available to the signed-in user; over-broad SharePoint, mailbox, or Graph permissions can become over-broad AI context.

“No model training” reduces one risk. It does not fix excessive internal permissions. For organizations, access hygiene is an AI control.

Superhuman Mail AI

Superhuman's AI product page states that it has zero-day data-retention agreements with AI subprocessors, does not allow those subprocessors to use customer data for model training, logs custom instructions rather than email data, and does not log AI responses.

Its current privacy policy is broader. It says Superhuman receives user content including emails, drafts, documents, files, calendars, and other enabled content. It also says users can control whether Superhuman may use user content to train its AI models.

Those statements can both be true:

• Subprocessor training: the external model provider is contractually prohibited from training.
• First-party training: Superhuman may offer a separate user-controlled path for improving its own models.

A simplistic comparison would quote the first and omit the second. The correct diligence questions are which control defaults apply to a given account, whether an organization administrator can enforce them, and whether “training” includes fine-tuning, evaluation, retrieval improvement, or human-reviewed feedback.

Superhuman's help center also notes that when a user connects an external AI tool through its MCP server, returned email and calendar data goes to that external provider. Built-in AI protections do not automatically follow data into a user-chosen external tool.

Shortwave

Shortwave's security documentation says email content is never used to train third-party AI models and names Google Cloud, OpenAI, Anthropic, and Pinecone among the infrastructure used to process and retrieve information.

The specificity helps: readers can see that no-training does not mean no third-party processing. An AI assistant needs inference and retrieval systems to answer questions about mail. The privacy task is to constrain those processors contractually and technically.

Shortwave's privacy policy covers service providers, analytics, account data, and user choices. As with every vendor here, an enterprise buyer should request the current subprocessor list, retention schedule, security report, deletion process, and data-processing terms rather than treating a public help page as a complete contract.

Flick's AI drafting path

Flick is primarily a finite email-triage client, not an autonomous inbox agent. Email bodies do not live on Flick's servers. The service persists encrypted authorization tokens and minimal sync/mutation metadata. When a user requests an AI reply, the selected thread can pass through Flick's server and model gateway in request scope so a draft can be generated; that body is not stored as a mailbox archive or used for training.

This is a narrower path than an assistant that continuously indexes an entire mailbox, but it is not zero processing. The user should read, edit, and approve every draft before sending. Flick's AI assistant safety checklist explains why limited scope and human confirmation matter more than a magical “AI-safe” badge.

Prompt injection changes the threat model

Email is untrusted input. A message can contain instructions designed for the assistant rather than the recipient. The 2025 EchoLeak vulnerability in Microsoft 365 Copilot, catalogued as CVE-2025-32711, demonstrated how a malicious email could participate in a zero-click data-exfiltration chain.

The lesson is not that one vendor is uniquely unsafe. It is that an AI system able to read messages and call tools crosses a new boundary:

• content is both data and potential instruction;
• summaries can conceal malicious text while still obeying it;
• tool access can turn a wrong interpretation into an external action;
• a human confirmation screen is a security control, not only UX friction.

For high-impact actions—send, delete, forward, change permissions, purchase, or disclose data—the assistant should show the source and require confirmation.

This action boundary is part of the broader AI email triage design problem: summarizing a queue, drafting a reply, and autonomously sending it are three different risk classes.

How to choose an AI email assistant

Use this order:

1. Define the job. Thread summarization requires less access than “search my entire work history and act for me.”
2. Choose the account boundary. Work and personal editions can have different protections.
3. Inspect access. Read the OAuth scopes and enterprise permissions.
4. Separate inference, retention, and training. Ask about each explicitly.
5. Check subprocessors. Identify model, vector store, logging, and feedback systems.
6. Keep sending human-controlled. Drafting is reversible; autonomous sending is not.
7. Plan exit. Know how to revoke, export, delete, and remove stored memory or embeddings.

Our best AI email assistant comparison evaluates workflow fit; this report is the privacy layer to put underneath it.

Methodology and limitations

We reviewed vendor product, privacy, security, and help pages current on July 30, 2026, plus the NIST vulnerability record. We did not test accounts, default settings, data deletion, model outputs, or enterprise contracts. Policies can vary by region and plan and can change after publication. Flick authored the report and is included as a disclosed first-party architecture statement.

FAQ

Do AI email assistants train on my messages?

The products reviewed here publish no-training commitments, but the scope differs. Ask separately about the assistant vendor's own models, external model subprocessors, feedback, evaluation logs, and any data shared into adjacent products.

Is Gemini in Gmail private?

Google says personal Gmail messages are not used to train its foundational models and that Gemini in Gmail does not retain Gmail data. Deliberately sharing Workspace data into a separate Gemini or Search surface can invoke different terms.

Is Microsoft Copilot reading every email?

Features such as Prioritize process incoming mailbox content when enabled. Microsoft says Microsoft 365 Copilot data is not used to train its generative models. The exact access and protections depend on the account and organizational permissions.

What is the safest AI email configuration?

Use the narrowest feature on the least-sensitive account, disable first-party training where a control exists, avoid external connectors you do not need, require confirmation for actions, and revoke access when the tool is no longer used.