A GitHub repository titled "Documentation of Gemini File Leaking Behavior" documents that consumer Gemini Apps, once Connected Apps is enabled, can pull personal Drive and Gmail content into a chat session through background tool calls without an @Drive or @Gmail tag, and that the retrieved text can end up in human review[3]. The Hacker News thread carrying the repository, "Google Gemini routes personal Drive files and emails to human annotators", stood at 461 points and 111 comments with a front-page tag as of the November 10, 2026 fetch[1][2]. HotRadar listed it sixth on its Hacker News board at 08:00:01 Beijing time that day.
Everything verifiable in this episode sits on the consumer surface of Google's product line. The repository documents retrieval behavior for consumer Gemini Apps tied to a personal Google account; the enterprise Workspace half appears only as commenters' paraphrases of Google contracts[4][5] and as Google admin pages whose current wording has yet to be quoted here directly. For companies, the takeaway is concrete: the data terms that apply depend on which Gemini surface staff conversations happen on, and that difference is now something to check. Nothing on this record establishes exposure of Workspace tenant data.
The repository documents probabilistic retrieval on consumer Gemini Apps
The repo's author opens with a 2023 Google blog post, quoting it as promising that personal content from Gmail, Docs, and Drive "is not seen by human reviewers"[3][6]. That post is live at blog.google under the title "Our responsible approach to building guardrails for generative AI"[6]. The author then writes that Help Answer 16836988 and an October 16 edit to the 2023 post state that connected Drive and email content is routed into human review pipelines, quoting Google's language as warnings that what reviewers see "may just be the email or file" and that users should not "connect your apps to Gemini Apps if they contain confidential information that you wouldn't want a reviewer to see"[3][7]. The Help page is live at support.google.com under the title "About personalization with Connected Apps - Gemini Apps Help"[7]; its current wording appears in this article only through the repo author's transcription.
The author's own tests produce four outcomes, presented in the repository as a probabilistic pipeline: no retrieval at all; a metadata-level summary; a partial unredacted quotation of two to four sentences; or the complete text of a document or email entering the session context. Ambient mentions of trips, bills, or reservations trigger these lookups without @Drive or @Gmail tags, according to the author[3]. The documented reproduction path is specific: Connected Apps active in consumer Gemini settings, the Flash model at "High Thinking" or better, a casual mention of a topic that exists in Drive or Gmail, then a request that Gemini print the exact text and metadata its retrieval tool returned[3]. The author's worked example uses an internet-provider bill; repeated trials produced all four outcomes, from a generic answer to a metadata summary naming a $122 payment dated September 4, to a verbatim quotation carrying the name, address, account number, and confirmation number, to a full text dump of the email including headers[3]. The author adds that Google's own automatic scrubbers "cannot sufficiently deidentify narrative data", citing Google's sensitive-data-protection documentation for that limitation[3]. In the same thread, the author gives the consequence in one phrase: content the model pulls in becomes "eligible for human review"[8].
Commenters agree the behavior is consumer-only; Workspace rests on contract claims
The thread's most direct scope correction comes from bri3d: "This gist is specifically about the consumer version of Gemini used in Gemini Apps"[4]. The same comment carries the enterprise-side claim: "There are explicit data retention contracts for Workspace (including Gemini transcription) and Google claim this data is never used for training or human review"[4]. That commenter's verdict on the enterprise angle, "so this is fairly baseless", sits next to the complaint that the product decision "confuses their enterprise customers into thinking Really Bad Stuff like this is happening"[4]. m4rtink, in a separate branch, draws the same line and points at Google's own enterprise document: "Workspace Gemini (and Workspace Intelligence, the RAG thing for enterprise/Workspace) still claims not to be subject to human review", with a link to the "Generative AI in Google Workspace Privacy Hub"[5][9]. The same commenter names the business consequence: the episode "will almost surely make their paying enterprise customers leery"[5].
The two comments agree on scope and disagree with the repository on severity. The disagreement leaves one real difference: bri3d notes that consumer Gemini "always sends stuff to the training pipeline", so connected-app content retrieved into a consumer transcript enters a pipeline with different terms from a Workspace tenant's[4]. The Workspace wording, in both comments, is a paraphrase of Google's contracts rather than quoted Google text[4][5].
On the consumer surface, two thread comments show how murky the permission step is in practice. One commenter reports a full-screen connected-apps prompt that reappears after every refusal, with the yes option's scope unclear, whether it covers the entire drive and mailbox or works per file[13]; another checked every Google account and legacy G Suite setting after reading the thread, found the connection enabled, and disabled it[1]. Neither comment pins down what the yes grants; the documents that would pin it down are Google's own.
Which data terms to read, and in which document
Google keeps the consumer/enterprise boundary in named documents rather than in one settings screen, and six of them were live on November 10, 2026. What follows pairs each document with the question to check it for:
- The Generative AI in Google Workspace Privacy Hub[9]: whether human review or model training touches Workspace tenant data under the enterprise contract. Commenters cite this page for the no-human-review claim[5].
- The Google Workspace with Gemini FAQ for Business[10]: check whether it takes up retention periods, training use of Workspace data, and which Gemini features the terms apply to. In the navigation captured for this story it sits under "Frequently asked questions", not under "Privacy & compliance", so treat it as a question to put to the page.
- Control Gemini App access to Workspace services[11] and Turn the Gemini App on or off[12]: the two admin controls whose titles say they decide whether the consumer app can reach Workspace data at all. Their state in a company's own console is the practical switch.
- Manage Gemini in Workspace conversation history settings[14]: how long Workspace Gemini conversations are kept; check the page itself for anything it says about training use of that history.
- Help Answer 16836988, About personalization with Connected Apps[7]: the routing wording for consumer users, the page the repository says now carries the human-review language[3].
The audit is one console session plus the page reads above: confirm what the two controls are set to, then compare any human-review, retention, or training language you find in the three Workspace pages against the consumer routing language the repository attributes to Help Answer 16836988[3]. What it settles is the question this story raises for any company running both surfaces: whether the terms Google asserts for Workspace are as separate from the consumer app's terms as the commenters above say they are[4][5].
Where the evidence ends, and what would change it
As of November 10, 2026, the evidence splits three ways. Verified: the story and its scale (461 points, 111 comments, a front-page tag)[1][2], the repository and its full text[3], and the existence of the six Google pages named above[7][9][10][11][12][14]. Attributed: every quoted Google sentence about consumer routing, known through the repo author[3]; the Workspace no-training and no-human-review claims, known through two commenters[4][5]; and the four-state pipeline, one author's documented tests with no independent replication in the thread[3]. Unknown: the current wording of the two Google pages the story turns on, Help Answer 16836988 and the 2023 blog post[6][7], and the year of the claimed October 16 edit, which the repository states without one[3].
Two observations would move the judgment. Direct quotation of the two pages' current text would convert the consumer-side claims from repo-author attribution into quoted Google language. Independent replication of the four-state pipeline, or press coverage of the claimed October 16 edit, would move the pipeline from one author's documentation toward an established behavior. Until one of those happens, the judgment stands: the documented retrieval-and-review behavior belongs to consumer Gemini Apps connected to personal accounts, and the Workspace protections that commenters assert are pointed at Google documents whose current wording, once read, either matches the commenters' account or replaces it. Either outcome settles the Workspace question in Google's own text.