Letting an AI read your email is safe only as far as four things are: the permission you grant, the text that leaves the app, how long the model provider keeps it, and whether the tool can send mail in your name. None of the four is visible from the marketing page. All four can be checked in about ten minutes, and the five checks below show how.
What you are actually granting
When an app connects to Gmail, you grant a scope, and the scope decides what the app can do, whatever its privacy page says. Google's Gmail API documentation, which we opened on October 17, 2026, sorts the scopes into sensitive and restricted, and the difference is large.
| Feature | What Google says it allows | Class |
|---|---|---|
| gmail.metadata | View labels and headers, but not the email body | Restricted |
| gmail.readonly | View your email messages and settings | Restricted |
| gmail.compose | Manage drafts and send emails | Restricted |
| gmail.modify | Read, compose and send emails; no permanent deletion that bypasses the trash | Restricted |
| gmail.send | Send email on your behalf | Sensitive |
Two readings follow. A tool that only drafts still needs a scope that can read the body, so read access is the baseline for any assistant that writes in your voice. And a tool that says it never sends is making a promise about its code, because several of these scopes would allow sending. Google also states that an app which stores restricted data on its servers must pass a security assessment, which is a reasonable thing to ask a vendor about.
Five checks before you connect any AI to your mail
Run the same five checks on every tool, ours included. Each one has a place on the vendor's site or on the permission screen where the answer should be written down.
- Read the permission screen. Match the scopes to the table above. If a tool that only ranks mail asks for send access, ask why.
- Find out what text leaves the app. Look for a statement of what is removed before the model sees a message: names, addresses, numbers, passwords. A tool that sends the raw thread says so, or says nothing.
- Find the provider's retention rule. A model provider's documentation states how long it keeps API data. OpenAI's page says logs are kept for up to 30 days unless the law requires longer, and that Zero Data Retention is an approval-based control, not a default.
- Ask whether it can send. The honest answers are "never" or "only after you tap". "Only when you allow it" deserves a follow-up.
- Test the exit. Open your Google Account's linked apps page, confirm the tool is listed, and read what removing it does.
What providers keep and what revoking does
Revoking access stops future reads, not the copies already made. Google's help page on third-party access says a revoked app can no longer reach your data, and also that removing access does not delete data the app already copied, so you may need to ask the developer to delete it. The same logic applies one step further down: a tool can delete your data from its own store and still depend on a model provider that keeps logs. When we checked OpenAI's data controls page on October 17, 2026, it stated that API data is not used to train models by default and that abuse monitoring logs are kept for up to 30 days. Other providers publish their own terms, so the check is per provider.
What we do before a model sees a message
Nolario removes identifying details from a message on our own server before any text goes to a model provider, and it does not send mail. Names, email addresses and numbers are replaced by placeholders and put back in the answer afterwards. Secrets such as passwords, login and reset links, IBANs and one-time codes are replaced by a type label and never restored. Older quoted mail and signature blocks are cut from the body, and each task gets only the part of the message it needs. If the filter fails, the request is refused instead of sent.
These are decisions we wrote down, not guarantees. On October 13, 2026 we measured the detection on a 300-case holdout set of synthetic texts in six languages: 85.4 percent of the personal values were caught, and 5.3 percent of ordinary texts were changed when they should not have been. The set was written by AI agents and not checked by native speakers. The filter is pattern based and has no name-recognition model, so a nickname or a lone surname can get through. Attached images and voice recordings are not part of it. We do not have Zero Data Retention with our providers, so their 30 day abuse-monitoring window applies, and we make no claim about where they process data. The same caution runs through our comparison of private AI email assistants.
Two product decisions show the same habit. Nolario never sends a message for you, by tap or by voice, because one wrong auto-sent reply to an investor costs more than the minutes saved. And for Google Drive it asks only for the files you pick, not the whole Drive. For how the ranking itself works, see how an AI decides which emails are important.
Where Nolario fits
Nolario pulls Gmail, Outlook, Slack, Microsoft Teams and Google Calendar into one feed, scores every item from 0 to 10 and drafts replies in your voice. It does read your mail to do that, so the five checks apply to it as much as to any other tool. It is not a private mailbox, it does not run on your device, and access today is by waitlist. If your mail is subject to a rule that forbids any outside processing, no assistant of this kind fits, and you are better off with the filters in the founder's guide to inbox overload. Details are on integrations and pricing, and the free tools need no account. More on connecting several mailboxes at once is in what a unified inbox is.
