The editorial frames the disclosure as neither a leak nor a bug, but the normal RLHF/preference-tuning pipeline that every frontier lab operates. OpenAI, Anthropic, and Meta all sample conversations for human scoring — Gemini's distinction is simply surface area, because Workspace integration pulls Drive and Gmail content into the 'conversation' payload.
Google's privacy hub does disclose that human reviewers read conversations, but users mentally picture 'my prompt and the model's reply' — not every file blob they dragged in. The repo's contribution is surfacing this disclosure gap: contractors at third-party labeling vendors see resumes, medical forms, and contracts verbatim in the rating UI.
The submitter elevated a GitHub repo of screenshots showing that attached Drive files and forwarded Gmail content appear verbatim to human annotators. The 487-point score and comment focus suggest the community sees value less in shock and more in documenting the specific mismatch between Google's disclosures and the actual rater-visible payload.
Because Gemini is wired directly into Workspace, the 'conversation' naturally pulls in content a user would never paste into a standalone chatbot. That makes the labeled-data pipeline — standard across the industry — materially more invasive for Gemini users than for competitors whose products aren't fused with the user's email and document store.
A GitHub repo published this week by a user going by `thisisme6598` collects screenshots and documentation showing that Google's human evaluators for Gemini are shown the full contents of personal files users attach to their chats — including Google Drive documents and content forwarded from Gmail. The thread hit the Hacker News front page at 487 points, with the top comments focused less on shock and more on the specifics: what exactly the raters see, and how Google's disclosures line up with what's actually happening.
The mechanic is straightforward. When a Gemini user attaches a file — a resume in Drive, a medical form, a contract, an email forwarded in — that attachment becomes part of the "conversation," and a sampled subset of conversations is routed to human annotators who score the model's response for helpfulness, factuality, and safety. The annotators are not Google employees; they're contractors working through third-party labeling vendors, and the rating UI shows them the attached document verbatim.
Google's [Gemini Apps Privacy Hub](https://support.google.com/gemini/answer/13594961) does say that "human reviewers (including third parties) read, annotate, and process your Gemini Apps conversations" when the Gemini Apps Activity setting is on (the default for most accounts). What the repo surfaces is the gap between the user mental model of "my prompt and the model's reply" and the actual payload — which includes every file blob the user dragged in.
This isn't a leak, a breach, or a bug. It's the labeled-data pipeline working as designed. Every frontier lab runs one: prompts and responses get sampled, scored by humans, and fed back into RLHF, constitutional training, or preference tuning. OpenAI does it. Anthropic does it. Meta does it. The difference with Gemini is the surface area — because Gemini is wired directly into Workspace, the "conversation" naturally includes content that a user would never paste into ChatGPT.
The practical threat model most people carry for an LLM assistant is "my prompt is private unless I share it." The actual threat model for any consumer-tier assistant with retention on is "my prompt — and every attachment — is a candidate for human review by a stranger paid per rating." That gap is the story. It's not that Google is doing something uniquely bad; it's that the integration depth makes the standard practice considerably more invasive by default.
The HN discussion split roughly three ways. The compliance-minded crowd pointed out that this almost certainly fails any reasonable reading of HIPAA, GLBA, or GDPR Article 9 (special categories of personal data) for users in regulated verticals — if a doctor pastes a patient chart into Gemini to summarize it, that chart is now sitting in a labeling queue at a BPO in a jurisdiction the doctor can't name. The pragmatist camp noted that you can turn it off: the "Gemini Apps Activity" toggle in [myactivity.google.com](https://myactivity.google.com/product/gemini) disables human review, with the tradeoff that your conversations stop contributing to model improvement. The toggle exists, but it's off the critical path — a user who signs up for a Google One AI Premium plan and starts attaching files is defaulted into the review pipeline, not out of it.
The third camp, which is where this story actually earns its score, pointed at the Workspace-admin angle. Enterprise Workspace customers have a separate contractual regime — Gemini for Workspace with a Business or Enterprise SKU comes with a no-training, no-human-review guarantee. But the consumer `@gmail.com` account that an employee uses for personal stuff, which may also be logged into on their work laptop, has none of that protection. The repo's screenshots are from the consumer product, and the content of those screenshots includes things that look an awful lot like work documents being handled on a personal account.
First, audit your own posture. Open [myactivity.google.com/product/gemini](https://myactivity.google.com/product/gemini) and check whether Gemini Apps Activity is on. If you've ever used Gemini on your personal Google account to look at a file that wasn't meant for strangers, the default is that it's eligible for sampling. Turning it off doesn't retroactively purge what's already been reviewed, but it stops the bleed.
Second, draw a bright line for your team. If you're shipping anything with user data in it — customer support transcripts, support emails, contracts under review, PHI, financial records — the rule should be "no consumer AI assistants, ever, for this data," and that rule needs to be a written policy, not folklore. The enterprise SKUs (Gemini for Workspace, ChatGPT Enterprise, Claude for Enterprise, Copilot for Microsoft 365 with the commercial data protection tier) exist precisely because the consumer tiers don't offer the guarantees regulated work requires. The cost delta is real but small compared to the cost of a regulator asking you to document which contractor in which country saw which patient's chart.
Third, if you're building a product on top of a model API, read the data-handling clause of your provider contract like you mean it. Zero-retention API tiers exist at every major lab, but they're usually not the default and sometimes require a specific endpoint or an enterprise agreement. The failure mode here is not "the vendor lied" — it's "the engineer picked the default SDK, the default endpoint, and the default plan, and the default is training-eligible."
The interesting question isn't whether Google will change the Gemini disclosures — they probably will, cosmetically, and the toggle will get moved one click closer to the top of the settings page. The interesting question is whether any of the major labs will ship a genuinely private-by-default consumer tier: a product where "nothing I type or attach is ever seen by a human, full stop," and the lab eats the cost of slower model improvement in exchange for the trust. Apple's Private Cloud Compute is the only serious attempt at that architecture in market right now, and its scope is narrow. Everyone else is still selling the labeled-data pipeline as the price of the product being good. The repo that triggered this discussion didn't reveal anything secret — it just made the price legible.
It's worse than that.> Google Photos data is used to infer your interests, relationships to people in your photos, and where you've been, including by associating your face with corresponding location data and timestamps. This data is also used to do things for you, like look up your in
Really frustrating that our privacy eroded to the point anyone would think this is reasonable.But it does explain some conversations with Gemini when I wonder why it's talking about particular things. Like asking it about consultation processes for changes to parks only to get a response that&#
Any tool having manual human reviewers or annotator like all of Gemini and notebooklm (now Gemini notebook) suffer from this. Your data has high chance being read by random people or being leaked for training because they might flag it then use it to "improve" the model.
In the name of the AI race we are taking a lot of shortcuts (privacy, quality, commercial viability etc). As anyone in software knows, the debt will eventually become due.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Note that this is specifically Consumer Gemini with Connected Apps; Workspace Gemini (and Workspace Intelligence, the RAG thing for enterprise/Workspace) still claims not to be subject to human review:https://knowledge.workspace.google.com/admin/generative-ai/g...So bas