Files and AI assistants: which permissions to review

The initial proposal was to check whether several assistants had recently announced changes to file access and data handling. The sources provided do not confirm a recent, dated, significant announcement of that kind. It would therefore be irresponsible to present this as a news story about new permissions or widespread privacy changes. The conclusion is narrower: documentation is available to help explain some Gemini features, but there is not enough evidence to say that its terms have changed recently or to make a rigorous comparison across several providers. This limitation matters because the question concerns a particular kind of development, not simply whether a product has a feature or a privacy help page. Without a dated announcement or other evidence of a change, the existence of documentation cannot be treated as proof that a policy or setting has changed.

This distinction matters because a help page explains how a feature is described or which controls it offers; by itself, it does not show that the feature differs from an earlier version, is enabled for every account, or is available in every country. Nor does the fact that a product can connect to an app establish that it has permanent access to all of that app’s files. The reported development has not been verified; the documentation can still help users ask specific questions before granting access. A careful account should keep these conclusions separate: what official pages describe, what they do not specify, and what the available sources cannot establish about a recent change. That approach avoids turning a description of a feature into a broader claim about privacy or account settings.

Google’s Gemini Apps Privacy Hub is the company’s official reference for information about the service’s privacy. The page consulted provides guidance related to using Gemini, but the evidence reviewed here does not support a precise summary of every retention, review, or deletion rule that may apply to each data type and account. Before making a decision, read the current version of the page and check whether it refers to a personal account, a work account, or an account managed by an organization. Those arrangements are not necessarily interchangeable, and a description relevant to one should not automatically be applied to another. Checking the account context is part of understanding what a policy or control means for a particular user.

Google also publishes a separate page about personalization with connected apps. Its existence confirms that app connections are covered in Gemini’s documentation and deserve separate review. It does not, however, establish that every user has the same connections enabled, which precise permissions are requested in every configuration, or what specific content is processed during an interaction. An available connection does not automatically mean unlimited access; its actual scope should be checked in settings and in the notice shown when authorization is granted. The distinction is important: documentation can identify a feature and point users toward relevant controls without proving how every account is configured or what a particular interaction will involve. Users should look at the current authorization screen rather than infer its scope from the general availability of a connection.

When an assistant works with documents, email, or other data, it helps to separate three questions that are often conflated. The first is permission: which app or source is connected, and what access does the user grant? The second is use: what information is incorporated into an answer or used for personalization? The third is retention: how long are conversations or associated data stored, and what options are available to delete them? A clear answer to one of these questions does not settle the other two. For example, knowing that a user can connect an app does not, by itself, explain what information might be used in a response or how long any associated conversation is kept. Each point needs evidence that addresses it directly.

Gemini’s privacy and connected-app documentation provides starting points for investigating these matters, but the sources included here do not support a reliable table of retention periods, exceptions, or scopes across different providers. They also do not establish that removing a connection automatically deletes information already retained, or that deleting a conversation by itself revokes permission previously granted to another app. These actions may depend on different controls. Look for each setting in its own section, and do not infer consequences that the page consulted does not confirm. Treating permission, use, and retention as separate questions makes it easier to notice what remains unspecified and to avoid relying on an assumption where a direct answer is needed. If the available help pages do not resolve a point, the evidence here does not justify filling the gap with a universal rule.

Before authorizing an integration, users can carry out a brief review, whether they are using a personal account or a workspace. The aim is neither to assume that access is dangerous nor to assume that it is harmless. Instead, limit access to what is actually needed and confirm what options exist for turning it off later. A few checks can help clarify which account is involved, what the authorization screen says, and where related settings are managed. This is a verification guide, not a claim that every product presents identical controls or uses identical menu names.

• Identify the app and account you are about to connect; check whether it is personal or managed by your employer.
• Read the authorization screen and check which data or actions it mentions. Do not assume a permission covers only the file currently open.
• Check the assistant’s settings to see which apps are connected and how to disconnect them.
• Review activity, history, and data-deletion options separately. Disconnecting, deleting a conversation, and changing data use may be different controls.
• For work information, ask the administrator which connectors are enabled and what data policy applies before uploading sensitive documents.

The names and availability of these options can vary by product. Menus change, and settings may also differ by region, account type, and organizational configuration. If an option is not visible, the service’s official help pages and the account administrator are more appropriate references than generic third-party instructions. This helps keep the checks grounded in the user’s actual setup rather than assuming that a control exists or works in a particular way. The list is intended to prompt verification; it does not assert that every assistant offers every listed option under the same name or in the same place.

The sources gathered for this article are not sufficient to compare the current practices of Gemini, ChatGPT, and other assistants at the same level of detail. They include an official OpenAI help page about a Data plugin for work environments and Codex, but that description does not, on its own, explain how all personal files or connectors are managed in ChatGPT. Nor does the page replace the applicable privacy policies or documentation for each specific integration. A description of a particular tool should not be treated as a complete account of every product, account type, or way of connecting data. A fair comparison would require relevant, current documentation for each service and the configurations being compared.

No independent sources were provided to verify a newly deployed change across several services, either. General articles about AI assistants can provide context about the category, but they do not replace an official policy or substantiate a dated modification. This article therefore avoids extrapolating from one product feature to an entire platform, or from one provider to the rest. The practical conclusion is cautious: check the specific permission, account, and current policy before connecting sensitive information; the evidence here does not support announcing a recent, widespread change. That conclusion is limited to the sources gathered for this article. It is not a claim that no individual service has ever changed a setting, nor does it settle questions that the cited documentation does not address.